joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100c06f0
Capabilities:
Get file size
Read file on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x100c0706
lea eax, [esi + 0x28]
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
push ebx
push 0
push 0x80
push 3
push 0
push 1
push Ordinal_2
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x100c0735
pop ebx
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
push edi
lea eax, [ebp - 0xc]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp + 8], eax
je 0x100c082f
mov ecx, dword [ebp - 8]
test ecx, ecx
jg 0x100c082f
mov eax, dword [ebp - 0xc]
jl 0x100c076c
cmp eax, 0x7fffffff
ja 0x100c082f
or eax, ecx
je 0x100c082f
push 0
push 0
push 0
push 2
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
test edi, edi
je 0x100c082f
mov ecx, dword [ebp - 0xc]
push 0
push 0
push 0
push 4
push edi
mov dword [esi + 4], ecx
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push edi
mov dword [esi], eax
call dword [ebp + 8]
cmp dword [esi], 0
je 0x100c07bd
mov eax, 0x100c0890
jmp 0x100c07fe
push dword [esi + 4]
mov eax, dword [esi + 0x1c]
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esi], eax
test eax, eax
je 0x100c082f
xor edi, edi
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [esi + 4]
sub eax, edi
push eax
mov eax, dword [esi]
add eax, edi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100c0820
add edi, dword [ebp - 4]
cmp edi, dword [esi + 4]
jne 0x100c07d5
mov eax, 0x100c0860
push ebx
mov dword [esi + 0x18], eax
call dword [ebp + 8]
mov eax, dword [esi]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0xc]
pop edi
mov dword [esi + 0x10], eax
xor eax, eax
pop ebx
mov dword [esi + 0x14], 0
pop esi
mov esp, ebp
pop ebp
ret
push dword [esi]
mov eax, dword [esi + 0x1c]
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
call dword [ebp + 8]
pop edi
pop ebx
mov dword [esi], 0
mov eax, 0x51
mov dword [esi + 4], 0
mov dword [esi + 8], 0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10114360
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
test edx, edx
jne 0x10114373
xor eax, eax
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
not eax
cmp esi, 8
jb 0x1011442e
push edi
mov edi, esi
shr edi, 3
movzx ecx, byte [edx]
sub esi, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x110f3ce0]
movzx ecx, byte [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x110f3ce0]
movzx ecx, byte [edx + 2]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x110f3ce0]
movzx ecx, byte [edx + 3]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x110f3ce0]
movzx ecx, byte [edx + 4]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x110f3ce0]
movzx ecx, byte [edx + 5]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x110f3ce0]
movzx ecx, byte [edx + 6]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x110f3ce0]
movzx ecx, byte [edx + 7]
add edx, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x110f3ce0]
sub edi, 1
jne 0x10114387
pop edi
test esi, esi
je 0x1011444c
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x110f3ce0]
sub esi, 1
jne 0x10114432
not eax
pop esi
pop ebp
ret
Function at 0x1011944e
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push 0x110f44b0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov esi, dword [ebp + 0xc]
neg eax
sbb eax, eax
xor ecx, ecx
and eax, dword [ebp - 4]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.1011942a
pop esi
leave
ret 8

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x401b30
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x407044
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [0x40703c]
sub esp, 4
test ebx, ebx
je 0x401b7b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov esi, eax
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x401b74
test esi, esi
je 0x401b74
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401b50
mov dword [esp], 0x407044
call sub.KERNEL32.dll_LeaveCriticalSection
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x401d60
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x401db0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x401e88
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x401dee
cmp eax, 4
jne 0x401e10
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sub.msvcrt.dll_memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x401dfe
cmp edx, 4
je 0x401dfe
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00401d60
Function at 0x710c79
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x7109ec
add edx, 0x1cd08286
sub eax, 0x7c86e1cf
call fcn.00710cbf
inc edx
xor dword [ecx], edi
add eax, 0x38f78189
inc ecx
sub eax, 0xcefe8a5f
add eax, 0x842297a4
or edx, eax
cmp ecx, ebx
jne fcn.00710c79
add eax, 0x36d3d579
add eax, edx
inc eax
ret

Function at 0x408929
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x4085d8
push edi
pop eax
sub edi, 0x435aac50
call fcn.00408957
and edi, edi
xor dword [esi], edx
and eax, edi
or edi, eax
inc esi
sub edi, 0xcbed01c2
cmp esi, ecx
jne fcn.00408929
add edi, edi
ret
Function at 0x1608b0fd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
popfd
and dh, al
inc ebp
sahf
sub eax, 0x119f45c6
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.1608ad2c
push eax
push esi
push dword [ebp + 8]
call fcn.1608ace1
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.1608ad2c
push eax
push esi
push dword [ebp + 8]
call fcn.1608ace1
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.1608ad1c
mov ch, 0x53
sub al, byte [eax]
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.1608ad1c
js 0x1608b1d5
xchg dword [edx - 0x3a], edi
inc ebp
mov byte [ebx - 0x3a], dh
inc ebp
mov dword [esi - 0x3a], ebx
inc ebp
mov dh, byte [edi - 0x3a]
inc ebp
mov edi, dword [eax - 0x3a]
inc ebp
invalid
mov dword [0x7c858dbe], eax
invalid

Function at 0x1608ca0c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jne 0x1608caa6
and byte [ebp - 0x7ac], 0
and byte [ebp - 0x7ab], 0
mov byte [ebp - 0x7aa], 0xed
and byte [ebp - 0x7a9], 0
mov byte [ebp - 0x7a8], 0x4e
mov byte [ebp - 0x7a7], 0x55
mov byte [ebp - 0x7a6], 0x56
mov byte [ebp - 0x7a5], 0x7e
mov byte [ebp - 0x7a4], 0x21
mov byte [ebp - 0x7a3], 0x20
mov byte [ebp - 0x7a2], 0x3c
invalid
invalid
Function at 0x1608d114
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.16088840
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1608d1af
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x16093e68]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x1608d1af
cmp eax, 1
je 0x1608d1d0
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1608d1af
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x1608d17c
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x1608d1ab
xor eax, eax
inc eax
jmp 0x1608d1ef
cmp edi, eax
jae 0x1608d1b3
xor eax, eax
jmp 0x1608d1ef
cmp eax, esi
jae 0x1608d1ba
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x16093e68]
jmp 0x1608d1d3
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1608e482
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x16092340
call fcn.16084654
xor edi, edi
xor ebx, ebx
inc ebx
cmp dword [0x16094120], edi
jne 0x1608e4c6
push edi
push edi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1608e4b1
mov dword [0x16094120], ebx
jmp 0x1608e4c6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x1608e4c6
mov dword [0x16094120], 2
mov eax, dword [0x16094120]
cmp eax, ebx
jne 0x1608e4e6
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x1608e5a9
cmp eax, 2
je 0x1608e4ef
cmp eax, edi
jne 0x1608e517
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], edi
cmp dword [ebp + 0x18], edi
jne 0x1608e502
mov eax, dword [0x16094024]
mov dword [ebp + 0x18], eax
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov dword [ebp - 0x20], eax
cmp eax, edi
jne 0x1608e51e
xor eax, eax
jmp 0x1608e5a9
mov dword [ebp - 4], edi
add eax, 3
and eax, 0xfffffffc
call fcn.16088840
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x28], esi
or dword [ebp - 4], 0xffffffff
jmp 0x1608e551
cmp esi, edi
jne 0x1608e567
push dword [ebp - 0x20]
call fcn.16083d3b
pop ecx
mov esi, eax
cmp esi, edi
je 0x1608e517
mov dword [ebp - 0x24], ebx
push dword [ebp - 0x20]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x1608e59a
cmp dword [ebp + 0x14], edi
jne 0x1608e584
push edi
push edi
jmp 0x1608e58a
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push esi
push ebx
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x24], edi
je 0x1608e5a6
push esi
call fcn.16083273
pop ecx
mov eax, dword [ebp - 0x1c]
lea esp, [ebp - 0x34]
call fcn.1608468f
ret
Function at 0x1608e5b2
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x16092350
call fcn.16084654
xor esi, esi
cmp dword [0x16094124], esi
jne 0x1608e5f6
push esi
push esi
xor edi, edi
inc edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1608e5e1
mov dword [0x16094124], edi
jmp 0x1608e5f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x1608e5f6
mov dword [0x16094124], 2
mov eax, dword [0x16094124]
cmp eax, 2
je 0x1608e6d7
cmp eax, esi
je 0x1608e6d7
cmp eax, 1
jne 0x1608e63b
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
cmp dword [ebp + 0x18], esi
jne 0x1608e624
mov eax, dword [0x16094024]
mov dword [ebp + 0x18], eax
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, esi
jne 0x1608e642
xor eax, eax
jmp 0x1608e6e9
mov dword [ebp - 4], esi
lea eax, [ebx + ebx]
add eax, 3
and eax, 0xfffffffc
call fcn.16088840
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x28], edi
or dword [ebp - 4], 0xffffffff
jmp 0x1608e678
cmp edi, esi
jne 0x1608e693
lea eax, [ebx + ebx]
push eax
call fcn.16083d3b
pop ecx
mov edi, eax
cmp edi, esi
je 0x1608e63b
mov dword [ebp - 0x20], 1
push ebx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1608e6c6
push esi
push esi
cmp dword [ebp + 0x14], esi
jne 0x1608e6b0
push esi
push esi
jmp 0x1608e6b6
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push edi
push esi
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], esi
je 0x1608e6d2
push edi
call fcn.16083273
pop ecx
mov eax, dword [ebp - 0x1c]
jmp 0x1608e6e9
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea esp, [ebp - 0x34]
call fcn.1608468f
ret
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x401012
mov eax, dword [0x4aa493]
shl eax, 2
mov dword [0x4aa497], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.0049bf38
pop edx
call fcn.0049be9c
call fcn.0049bf78
push 0
call fcn.0049d234
pop ecx
push 0x4aa43c
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x4aa49b], eax
push 0
jmp fcn.004a3c34
Function at 0x403860
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
mov eax, 0x4af840
call fcn.0049c620
mov dword [ebp - 0x20], 1
lea edx, [ebp + 8]
lea eax, [ebp + 8]
call fcn.004a84d4
inc dword [ebp - 0x20]
mov word [ebp - 0x2c], 8
mov dword [ebp - 0x40], 0x103
push 0x44
push 0
lea edx, [ebp - 0x84]
push edx
call fcn.0049c28c
add esp, 0xc
mov dword [ebp - 0x84], 0x44
lea ecx, [ebp - 0x94]
push ecx
lea eax, [ebp - 0x84]
push eax
mov word [ebp - 0x2c], 0x14
xor edx, edx
mov dword [ebp - 4], edx
lea eax, [ebp - 4]
inc dword [ebp - 0x20]
call fcn.004920fc
mov edx, dword [ebp - 4]
test edx, edx
je 0x4038e2
mov ecx, dword [ebp - 4]
jmp 0x4038e7
mov ecx, 0x4abe2d
push ecx
push 0
push 0
push 1
push 0
push 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x4038fe
mov edx, dword [ebp + 8]
jmp 0x403903
mov edx, 0x4abe2c
push edx
push 0
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
sete al
and eax, 1
push eax
dec dword [ebp - 0x20]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004a8640
pop ecx
test cl, cl
je 0x403a19
mov word [ebp - 0x2c], 0x20
xor eax, eax
mov dword [ebp - 8], eax
lea ecx, [ebp - 8]
inc dword [ebp - 0x20]
lea edx, [ebp + 8]
mov eax, 0x4abe2e
call fcn.004a89e0
lea edx, [ebp - 8]
push edx
mov edx, 0x4abe40
lea eax, [ebp - 0xc]
call fcn.004a849c
inc dword [ebp - 0x20]
lea edx, [ebp - 0xc]
xor eax, eax
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x10]
inc dword [ebp - 0x20]
pop eax
call fcn.004a8698
lea edx, [ebp - 0x10]
push edx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
lea eax, [ebp - 0x14]
push eax
inc dword [ebp - 0x20]
call fcn.00403394
pop ecx
lea edx, [ebp - 0x14]
xor ecx, ecx
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x18]
inc dword [ebp - 0x20]
pop eax
call fcn.004a8698
lea edx, [ebp - 0x18]
push dword [edx]
call fcn.00404584
pop ecx
dec dword [ebp - 0x20]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004a8640
dec dword [ebp - 0x20]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004a8640
dec dword [ebp - 0x20]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004a8640
dec dword [ebp - 0x20]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004a8640
dec dword [ebp - 0x20]
lea eax, [ebp - 8]
mov edx, 2
call fcn.004a8640
or eax, 0xffffffff
push eax
dec dword [ebp - 0x20]
lea eax, [ebp + 8]
mov edx, 2
call fcn.004a8640
pop eax
mov edx, dword [ebp - 0x3c]
mov dword fs:[0], edx
jmp 0x403a87
mov cl, byte [ebp + 0xc]
test cl, cl
je 0x403a4f
mov eax, dword [ebp - 0x40]
cmp eax, 0x103
jne 0x403a4f
push 0x1c2
call fcn.004026fc
pop ecx
lea edx, [ebp - 0x40]
push edx
push dword [ebp - 0x94]
call sub.KERNEL32.DLL_GetExitCodeProcess
mov ecx, dword [ebp - 0x40]
cmp ecx, 0x103
je 0x403a2a
push dword [ebp - 0x90]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0x94]
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 0x8c]
push eax
dec dword [ebp - 0x20]
lea eax, [ebp + 8]
mov edx, 2
call fcn.004a8640
pop eax
mov edx, dword [ebp - 0x3c]
mov dword fs:[0], edx
mov esp, ebp
pop ebp
ret
Function at 0x404228
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbec
mov eax, 0x4afbf4
call fcn.0049c620
mov dword [ebp - 0x2c], 0x3e6
mov byte [ebp - 0x414], 0
lea edx, [ebp - 0x2c]
push edx
lea ecx, [ebp - 0x414]
push ecx
call sub.ADVAPI32.DLL_GetUserNameA
mov word [ebp - 0x18], 8
lea edx, [ebp - 0x414]
lea eax, [ebp - 4]
call fcn.004a849c
mov edx, eax
inc dword [ebp - 0xc]
mov eax, dword [ebp + 8]
call fcn.004a8670
mov eax, dword [ebp + 8]
mov word [ebp - 0x18], 0x14
push eax
dec dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004a8640
pop eax
mov word [ebp - 0x18], 8
inc dword [ebp - 0xc]
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
mov esp, ebp
pop ebp
ret
Function at 0x413a48
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00499d80
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
test eax, eax
jns 0x413a68
call fcn.00498c20
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x413a77
test byte [ebp - 0xc], 0x10
jne 0x413a7b
xor eax, eax
jmp 0x413a7d
mov al, 1
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret

Function at 0x416f34
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sym.mjrwsvc.exe__Wsocket_TSslContext_Lock_qqrv
xor eax, eax
push ebp
push 0x4170c1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x5c], edx
test byte [ebp - 8], 1
je 0x416f6e
mov eax, dword [ebp - 4]
add dword [eax + 0x5c], 0x400000
test byte [ebp - 8], 2
je 0x416f7a
mov eax, dword [ebp - 4]
inc dword [eax + 0x5c]
test byte [ebp - 8], 4
je 0x416f87
mov eax, dword [ebp - 4]
add dword [eax + 0x5c], 2
test byte [ebp - 8], 8
je 0x416f94
mov eax, dword [ebp - 4]
add dword [eax + 0x5c], 8
test byte [ebp - 8], 0x10
je 0x416fa1
mov eax, dword [ebp - 4]
add dword [eax + 0x5c], 0x10
test byte [ebp - 8], 0x20
je 0x416fae
mov eax, dword [ebp - 4]
add dword [eax + 0x5c], 0x20
test byte [ebp - 8], 0x40
je 0x416fbb
mov eax, dword [ebp - 4]
add dword [eax + 0x5c], 0x40
test byte [ebp - 8], 0x80
je 0x416fcb
mov eax, dword [ebp - 4]
add dword [eax + 0x5c], 0x80
test byte [ebp - 7], 1
je 0x416fdb
mov eax, dword [ebp - 4]
add dword [eax + 0x5c], 0x100
test byte [ebp - 7], 2
je 0x416feb
mov eax, dword [ebp - 4]
add dword [eax + 0x5c], 0x200
test byte [ebp - 7], 4
je 0x416ffb
mov eax, dword [ebp - 4]
add dword [eax + 0x5c], 0x800000
test byte [ebp - 7], 8
je 0x41700b
mov eax, dword [ebp - 4]
add dword [eax + 0x5c], 0x800
test byte [ebp - 7], 0x10
je 0x41701b
mov eax, dword [ebp - 4]
add dword [eax + 0x5c], 0x100000
test byte [ebp - 7], 0x20
je 0x41702b
mov eax, dword [ebp - 4]
add dword [eax + 0x5c], 0x200000
test byte [ebp - 7], 0x40
je 0x41703b
mov eax, dword [ebp - 4]
add dword [eax + 0x5c], 0x1000000
test byte [ebp - 7], 0x80
je 0x41704b
mov eax, dword [ebp - 4]
add dword [eax + 0x5c], 0x2000000
test byte [ebp - 6], 1
je 0x41705b
mov eax, dword [ebp - 4]
add dword [eax + 0x5c], 0x4000000
test byte [ebp - 6], 2
je 0x41706b
mov eax, dword [ebp - 4]
add dword [eax + 0x5c], 0x8000000
test byte [ebp - 6], 4
je 0x41707b
mov eax, dword [ebp - 4]
add dword [eax + 0x5c], 0x10000000
test byte [ebp - 6], 8
je 0x41708b
mov eax, dword [ebp - 4]
add dword [eax + 0x5c], 0x20000000
test byte [ebp - 6], 0x10
je 0x41709b
mov eax, dword [ebp - 4]
add dword [eax + 0x5c], 0x10000
test byte [ebp - 6], 0x20
je 0x4170ab
mov eax, dword [ebp - 4]
add dword [eax + 0x5c], 0x40000000
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4170c8
mov eax, dword [ebp - 4]
call sym.mjrwsvc.exe__Wsocket_TSslContext_Unlock_qqrv
ret