joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a483
Capabilities:
Timestomp file

Disassembly:
push 0x4c
mov eax, 0x448a86
call fcn.00440fb0
mov edi, dword [ebp + 8]
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push ebx
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x48], esi
push edi
lea eax, [ebp - 0x2c]
push str.SetFileModTime_couldnt_open__S
push eax
mov dword [ebp - 4], ebx
call fcn.0040fe60
add esp, 0xc
mov byte [ebp - 4], 1
cmp esi, 0xffffffff
jne 0x43a4d0
mov ecx, eax
call fcn.00434015
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], bl
call fcn.00402286
push edi
lea eax, [ebp - 0x2c]
push str.SetFileModTime_failed_GetFileTime:__S
push eax
call fcn.0040fe60
add esp, 0xc
mov ebx, eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x58]
push eax
push esi
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
jne 0x43a511
mov ecx, ebx
call fcn.00434015
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.00402286
push edi
lea eax, [ebp - 0x2c]
push str.SetFileModTime_failed_DosDateTimeToFileTime:__S
push eax
call fcn.0040fe60
add esp, 0xc
mov ebx, eax
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x44]
push eax
push ecx
shr ecx, 0x10
push ecx
mov byte [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
test eax, eax
jne 0x43a552
mov ecx, ebx
call fcn.00434015
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.00402286
push edi
lea eax, [ebp - 0x2c]
push str.SetFileModTime_failed_LocalFileTimeToFileTime:__S
push eax
call fcn.0040fe60
add esp, 0xc
mov ebx, eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x44]
push eax
mov byte [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
test eax, eax
jne 0x43a58f
mov ecx, ebx
call fcn.00434015
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.00402286
push edi
lea eax, [ebp - 0x2c]
push str.SetFileModTime_failed_SetFileTime:__S
push eax
call fcn.0040fe60
add esp, 0xc
mov edi, eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x34]
push eax
push esi
mov byte [ebp - 4], 5
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x43a5d1
mov ecx, edi
call fcn.00434015
lea ecx, [ebp - 0x2c]
call fcn.00402286
test esi, esi
je 0x43a5e4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00440f5f
ret 8

Function at 0x43a693
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov ebx, 0xff
mov esi, dword [edi]
mov eax, esi
xor eax, dword [ebp + 8]
mov ecx, dword [edi + 8]
and eax, ebx
shr esi, 8
mov eax, dword [edx + eax*4]
xor eax, esi
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [edi + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, ebx
shr ecx, 8
xor ecx, dword [edx + eax*4]
mov eax, dword [ebp + 8]
mov dword [edi + 8], ecx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x440960
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x441378
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x46a034]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov eax, dword [0x46a0ec]
cmp eax, 0xffffffff
jne 0x440999
xor ebp, ebp
mov dword [esp + 0x14], ebp
jmp 0x4409a6
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], ebp
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 0x2c], 0
test ebp, ebp
je 0x440a0d
jmp 0x4409dc
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp + 0x14], 0
mov edi, dword [ebp + 0xc]
jne 0x440a4a
test edi, edi
jne 0x440a50
push 0x43fd80
push 0x472adc
call fcn.0043fb10
mov eax, dword [0x46a0ec]
add esp, 8
cmp eax, 0xffffffff
je 0x440a0d
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 0x2c], 0xffffffff
test ebp, ebp
je 0x440a36
lea eax, [ebp + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x440a36
mov eax, dword [ebp]
push 0
mov ecx, ebp
call dword [eax]
push ebp
push 0
call esi
push eax
call ebx
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
test edi, edi
je 0x440a88
mov edi, edi
mov eax, dword [edi + 4]
mov dword [ebp + 0xc], eax
mov ecx, dword [edi]
test ecx, ecx
je 0x440a79
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [edi]
push 0
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
call esi
push eax
call ebx
push edi
push 0
call esi
push eax
call ebx
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x440a50
mov ebx, dword [ebp + 0x10]
lea eax, [ebp + 0x10]
mov esi, dword [ebx]
mov dword [esp + 0x18], eax
cmp esi, ebx
je 0x4409d0
mov ebp, eax
mov edi, edi
cmp byte [esi + 0xd], 0
mov edi, esi
jne 0x440ae7
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x440acc
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x440ae7
jmp 0x440ac0
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x440ac0
jmp 0x440ae7
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x440ae5
cmp esi, dword [eax + 8]
jne 0x440ae5
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x440ad5
mov esi, eax
mov ecx, dword [edi + 0x14]
test ecx, ecx
je 0x440afb
mov edx, dword [edi + 0x1c]
test edx, edx
je 0x440afb
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push edi
lea eax, [esp + 0x24]
push eax
mov ecx, ebp
call fcn.0042d87d
cmp esi, ebx
jne 0x440aa0
mov ebp, dword [esp + 0x14]
jmp 0x4409d0
Function at 0x440b20
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push esi
mov esi, ecx
mov edx, dword [esi]
lea eax, [edx + 0x18]
push eax
push 4
push edx
push 0x440b90
push 0
push 0
call dword [sym.imp.MSVCR110.dll__beginthreadex]
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x440b4a
pop esi
xor al, al
pop ebx
ret
mov ecx, dword [esi]
push edi
add ecx, 4
mov eax, 1
lock xadd dword [ecx], eax
mov edi, dword [esi]
mov eax, dword [edi + 8]
test eax, eax
je 0x440b6e
cmp eax, 0xffffffff
je 0x440b6e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 8], ebx
mov eax, dword [esi]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
mov al, 1
pop ebx
ret
Function at 0x401af0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov ecx, eax
push edi
mov edi, dword [ebp + 8]
lea esi, [ecx + 1]
mov edi, edi
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x401b00
sub ecx, esi
xor esi, esi
mov dword [ebp - 4], ecx
test ecx, ecx
jle 0x401bcb
push ebx
mov bl, byte [ebp + 0xb]
lea ebx, [ebx]
cmp byte [eax], 0x3d
je 0x401bca
lea esp, [esp]
mov cl, byte [eax]
test cl, cl
je 0x401bca
lea edx, [ecx - 0x41]
cmp dl, 0x19
ja 0x401b47
sub cl, 0x41
jmp 0x401b73
lea edx, [ecx - 0x61]
cmp dl, 0x19
ja 0x401b54
sub cl, 0x47
jmp 0x401b73
lea edx, [ecx - 0x30]
cmp dl, 9
ja 0x401b61
add cl, 4
jmp 0x401b73
cmp cl, 0x2b
jne 0x401b6a
mov cl, 0x3e
jmp 0x401b73
cmp cl, 0x2f
setne cl
add cl, 0x3f
inc eax
cmp cl, 0x40
je 0x401b30
cmp cl, 0x41
je 0x401bca
mov edx, esi
and edx, 3
cmp edx, 3
ja case.default.0x401b88
jmp dword [edx*4 + 0x401bd8]
add cl, cl
add cl, cl
mov bl, cl
jmp case.default.0x401b88
mov dl, cl
shr dl, 4
or dl, bl
mov byte [edi], dl
inc edi
shl cl, 4
mov bl, cl
jmp case.default.0x401b88
mov dl, cl
shr dl, 2
or dl, bl
mov byte [edi], dl
inc edi
shl cl, 6
mov bl, cl
jmp case.default.0x401b88
mov dl, bl
or dl, cl
mov byte [edi], dl
inc edi
inc esi
cmp esi, dword [ebp - 4]
jl 0x401b20
pop ebx
mov eax, edi
sub eax, dword [ebp + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x405770
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x460
mov eax, dword [0x6c3afc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x10], 0
mov dword [ebp - 0x460], esi
mov dword [ebp - 0x458], 0
jne 0x4057ad
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005dd8e2
mov esp, ebp
pop ebp
ret
push ebx
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
mov dword [ebp - 0x45c], ebx
cmp ebx, 0xffffffff
je 0x4057e8
lea eax, [ebp - 0x454]
push eax
push ebx
mov dword [ebp - 0x454], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x4057fa
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005dd8e2
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x454]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x405920
jmp 0x405818
mov esi, dword [ebp - 0x460]
lea edx, [ebp - 0x430]
push edx
mov ecx, esi
call fcn.00403dd0
push eax
call fcn.005de254
add esp, 8
test eax, eax
jne 0x4058fc
cmp dword [edi + 0x10], eax
je 0x405914
mov eax, dword [ebp - 0x44c]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4058fc
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x20a]
push edx
mov word [ebp - 0x20c], cx
call fcn.005de050
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
push esi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
test eax, eax
je 0x4058fc
lea ecx, [ebp - 0x20c]
push ecx
lea ecx, [ebp - 0x228]
call fcn.004036f0
cmp dword [edi + 0x14], 8
mov ecx, dword [edi + 0x10]
jb 0x4058b4
mov edx, dword [edi]
jmp 0x4058b6
mov edx, edi
push ecx
push 0
push edx
mov ecx, eax
call fcn.00402580
cmp eax, 0xffffffff
sete bl
cmp dword [ebp - 0x214], 8
jb 0x4058df
mov edx, dword [ebp - 0x228]
push edx
call fcn.004effaf
add esp, 4
test bl, bl
jne 0x4058f6
mov eax, dword [ebp - 0x44c]
push esi
mov dword [ebp - 0x458], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0x45c]
lea ecx, [ebp - 0x454]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x405812
jmp 0x405920
mov edx, dword [ebp - 0x44c]
mov dword [ebp - 0x458], edx
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x458]
pop ebx
xor ecx, ebp
pop esi
call fcn.005dd8e2
mov esp, ebp
pop ebp
ret
Function at 0x405940
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x6456f8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x6c3afc]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp dword [esi + 0x10], ebx
je 0x405a24
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov edi, dword [ebp + 0xc]
push edi
lea eax, [esp + 0x18]
push eax
push esi
mov dword [esp + 0x3c], ebx
call fcn.00405ab0
add esp, 0xc
test al, al
je 0x405a08
mov edi, dword [esp + 0x14]
cmp edi, dword [esp + 0x18]
je 0x4059e6
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
mov eax, dword [edi]
test eax, eax
je 0x4059d7
push eax
push 0
push 1
call ebx
mov esi, eax
test esi, esi
je 0x4059d7
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x4059d7
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add edi, 4
cmp edi, dword [esp + 0x18]
jne 0x4059b0
mov edi, dword [esp + 0x14]
xor ebx, ebx
cmp edi, ebx
je 0x4059f3
push edi
call fcn.004effaf
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, esi
call fcn.00405770
cmp eax, ebx
ja 0x405a39
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x405a24
push eax
call fcn.004effaf
add esp, 4
xor al, al
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00405a70
mov bl, al
mov eax, dword [esp + 0x14]
test eax, eax
je 0x405a51
push eax
call fcn.004effaf
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x405a70
Capabilities:
Terminate process

Disassembly:
test eax, eax
jne 0x405a77
xor al, al
ret
push esi
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x405a96
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x405a9a
xor al, al
pop esi
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop esi
ret
Function at 0x405ab0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x464
mov eax, dword [0x6c3afc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
push edi
mov edi, dword [ebp + 0x10]
push 0x228
lea edx, [ebp - 0x450]
push 0
push edx
mov dword [ebp - 0x464], eax
mov dword [ebp - 0x45c], ecx
call fcn.005de050
add esp, 0xc
push 0
push 2
mov dword [ebp - 0x454], 0x22c
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
lea eax, [ebp - 0x454]
push eax
push ebx
mov dword [ebp - 0x460], ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x405b37
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005dd8e2
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x454]
push ecx
push ebx
mov byte [ebp - 0x455], 0
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x405cbf
push esi
mov ecx, dword [ebp - 0x464]
call fcn.00403dd0
push eax
lea edx, [ebp - 0x430]
push edx
call fcn.005de254
add esp, 8
test eax, eax
jne 0x405ca8
cmp dword [edi + 0x10], eax
jne 0x405b9b
mov ecx, dword [ebp - 0x45c]
lea eax, [ebp - 0x44c]
push eax
call fcn.00406900
mov byte [ebp - 0x455], 1
jmp 0x405ca8
mov ecx, dword [ebp - 0x44c]
push ecx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x405ca8
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x20a]
push eax
mov word [ebp - 0x20c], dx
call fcn.005de050
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push 0
push esi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
test eax, eax
je 0x405ca8
xor edx, edx
lea eax, [ebp - 0x20c]
mov word [ebp - 0x228], dx
mov dword [ebp - 0x214], 7
mov dword [ebp - 0x218], 0
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405c20
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x228]
call fcn.00403600
cmp dword [edi + 0x14], 8
mov ecx, dword [edi + 0x10]
jb 0x405c4f
mov eax, dword [edi]
jmp 0x405c51
mov eax, edi
push ecx
push 0
push eax
lea ecx, [ebp - 0x228]
call fcn.00402580
cmp eax, 0xffffffff
setne bl
cmp dword [ebp - 0x214], 8
jb 0x405c7e
mov ecx, dword [ebp - 0x228]
push ecx
call fcn.004effaf
add esp, 4
test bl, bl
je 0x405c9b
mov ecx, dword [ebp - 0x45c]
lea edx, [ebp - 0x44c]
push edx
call fcn.00406900
mov byte [ebp - 0x455], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0x460]
lea eax, [ebp - 0x454]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x405b55
pop esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x455]
pop edi
xor ecx, ebp
pop ebx
call fcn.005dd8e2
mov esp, ebp
pop ebp
ret
Function at 0x4060a0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6464e6
mov eax, dword fs:[0]
push eax
sub esp, 0x484
mov eax, dword [0x6c3afc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
push ebx
push 2
mov edi, ecx
mov dword [ebp - 0x48c], ebx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 0x490], esi
cmp esi, 0xffffffff
je 0x406111
lea eax, [ebp - 0x488]
push eax
push esi
mov dword [ebp - 0x488], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x406120
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4062e6
cmp dword [ebp - 0x480], 0xa
jb 0x4062c3
xor ecx, ecx
push ebx
mov word [ebp - 0x250], cx
mov esi, 7
push 0x688638
lea ecx, [ebp - 0x250]
mov dword [ebp - 0x258], ebx
mov dword [ebp - 0x254], ebx
mov dword [ebp - 0x23c], esi
mov dword [ebp - 0x240], ebx
call fcn.00403600
mov dword [ebp - 4], ebx
push ebx
xor edx, edx
push 0x688638
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x224], ebx
mov word [ebp - 0x234], dx
call fcn.00403600
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x480]
mov dword [ebp - 0x254], eax
lea eax, [ebp - 0x464]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4061b0
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp - 0x464]
push ecx
lea ecx, [ebp - 0x250]
call fcn.00403600
mov edx, dword [ebp - 0x480]
push edx
push ebx
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebx
je 0x406259
push 0x206
lea ecx, [ebp - 0x216]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x218], ax
call fcn.005de050
add esp, 0xc
push 0x104
lea edx, [ebp - 0x218]
push edx
push ebx
push esi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
test eax, eax
je 0x406252
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x406230
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x234]
call fcn.00403600
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x258]
call fcn.00406970
inc dword [ebp - 0x48c]
mov esi, 8
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x220], esi
jb 0x40628d
mov ecx, dword [ebp - 0x234]
push ecx
call fcn.004effaf
add esp, 4
xor edx, edx
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], ebx
mov word [ebp - 0x234], dx
cmp dword [ebp - 0x23c], esi
jb 0x4062bd
mov eax, dword [ebp - 0x250]
push eax
call fcn.004effaf
add esp, 4
mov esi, dword [ebp - 0x490]
lea ecx, [ebp - 0x488]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x406120
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x48c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005dd8e2
mov esp, ebp
pop ebp
ret
Function at 0x406310
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
mov eax, dword [0x6c3afc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0x43c], ebx
mov esi, dword [eax]
cmp esi, ebx
jne 0x40633e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
push 0x206
lea ecx, [ebp - 0x20a]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x20c], ax
call fcn.005de050
push 0x206
lea eax, [ebp - 0x412]
xor edx, edx
push ebx
push eax
mov word [ebp - 0x414], dx
call fcn.005de050
add esp, 0x18
xor ecx, ecx
mov eax, 0x104
push 0x10
mov word [ebp - 0x430], cx
push 0x688704
lea ecx, [ebp - 0x430]
mov dword [ebp - 0x440], eax
mov dword [ebp - 0x43c], eax
mov dword [ebp - 0x438], ebx
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x41c], 7
mov dword [ebp - 0x420], ebx
call fcn.00403600
lea ecx, [ebp - 0x430]
call fcn.00406500
cmp dword [ebp - 0x41c], 8
jb 0x4063e2
mov edx, dword [ebp - 0x430]
push edx
call fcn.004effaf
add esp, 4
push esi
push ebx
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, ebx
je 0x4064a9
lea ecx, [ebp - 0x438]
push ecx
push 8
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4064a9
mov eax, dword [ebp - 0x434]
mov ecx, dword [ebp - 0x438]
lea edx, [ebp - 0x434]
push edx
push eax
push ebx
push 1
push ecx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x40643c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4064a9
mov edx, dword [ebp - 0x434]
push edx
call fcn.005df877
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x4064a9
mov ecx, dword [ebp - 0x434]
mov edx, dword [ebp - 0x438]
lea eax, [ebp - 0x434]
push eax
push ecx
push esi
push 1
push edx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x4064a0
lea eax, [ebp - 0x444]
push eax
lea ecx, [ebp - 0x440]
push ecx
lea edx, [ebp - 0x414]
push edx
mov edx, dword [esi]
lea eax, [ebp - 0x43c]
push eax
lea ecx, [ebp - 0x20c]
push ecx
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
push esi
call fcn.005df83d
add esp, 4
xor eax, eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], ebx
mov word [edi], ax
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4064c1
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp - 0x20c]
push ecx
mov ecx, edi
call fcn.00403600
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
mov eax, edi
pop ebx
call fcn.005dd8e2
mov esp, ebp
pop ebp
ret
Function at 0x4067a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
xor eax, eax
push edi
push 0x40
push eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x50]
push eax
call fcn.005de050
movzx ecx, byte [ebp + 0x14]
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
neg ecx
sbb ecx, ecx
and ecx, 5
mov word [ebp - 0x24], cx
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
mov ebx, 1
mov dword [ebp - 0x54], 0x44
mov dword [ebp - 0x28], ebx
neg ecx
or ecx, eax
push ecx
call fcn.004effa4
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x406810
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x10]
add eax, ebx
push eax
push 0
push edi
call fcn.005de050
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x406829
mov esi, dword [esi]
push esi
push 0x68872c
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp + 0x10]
add esp, 0xc
cmp dword [ecx + 0x10], 0
ja 0x406846
xor esi, esi
jmp 0x40684d
call fcn.00403dd0
mov esi, eax
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 0x10], 0
ja 0x40685a
xor eax, eax
jmp 0x40685f
call fcn.00403dd0
lea ecx, [ebp - 0x10]
push ecx
xor ecx, ecx
cmp byte [ebp + 0x18], cl
lea edx, [ebp - 0x54]
push edx
push esi
push 0
setne cl
push 0x20
push ecx
push 0
push 0
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x406889
xor bl, bl
jmp 0x4068d7
cmp byte [ebp + 0x1c], 0
je 0x4068a5
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4068a5
mov edx, dword [ebp + 0x20]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x406885
mov eax, dword [ebp + 0x2c]
test eax, eax
je 0x4068bf
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x4068bf
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x406885
mov eax, dword [ebp + 0x24]
test eax, eax
je 0x4068cb
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov eax, dword [ebp + 0x28]
test eax, eax
je 0x4068d7
mov edx, dword [ebp - 8]
mov dword [eax], edx
mov eax, dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [ebp - 0xc]
push ecx
call esi
push edi
call fcn.004effaf
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret