joyce8/EMBER2024-capa huggingface dataset:
Function at 0x461e00
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x8c
mov eax, dword [0x4a2014]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
push ebp
mov ebp, dword [esp + 0x98]
xor ebx, ebx
push esi
push edi
mov eax, dword [ebp + 0x18]
mov edi, dword [eax + 0x430]
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0x80
lea eax, [esp + 0x1c]
push eax
mov eax, dword [edi + 0x13c]
push ebx
add eax, 4
push eax
push dword [edi + 0x148]
push dword [edi + 0x14]
call dword [sym.imp.WS2_32.dll_recvfrom]
mov dword [edi + 0x134], eax
cmp dword [edi + 0x130], ebx
jne 0x461e86
push dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
lea eax, [edi + 0xb0]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov dword [edi + 0x130], eax
mov esi, dword [edi + 0x134]
cmp esi, 4
jge 0x461ec1
push str.Received_too_short_packet
push ebp
call fcn.004433e0
add esp, 8
mov dword [edi + 0xc], 7
mov eax, ebx
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042a51d
add esp, 0x8c
ret
mov edx, dword [edi + 0x148]
movzx eax, byte [edx]
movzx ecx, byte [edx + 1]
shl eax, 8
or ecx, eax
mov dword [edi + 0xc], ecx
dec ecx
cmp ecx, 5
ja case.0x461ee0.1
jmp dword [ecx*4 + 0x461fcc]
cmp esi, 4
jle case.0x461ee0.4
movzx ecx, byte [edx + 2]
movzx eax, byte [edx + 3]
shl ecx, 8
or ecx, eax
movzx eax, word [edi + 0x144]
inc eax
movzx eax, ax
cmp eax, ecx
jne case.0x461ee0.4
lea eax, [esi - 4]
push eax
lea eax, [edx + 4]
push eax
push 1
push ebp
call fcn.00444630
mov ebx, eax
add esp, 0x10
test ebx, ebx
je case.0x461ee0.4
push 5
push edi
call fcn.004628e0
add esp, 8
jmp 0x461ea6
movzx ecx, byte [edx + 2]
lea eax, [edx + 4]
mov dword [esp + 0x14], eax
add esi, 0xfffffffc
movzx eax, byte [edx + 3]
shl ecx, 8
or ecx, eax
lea eax, [edx + 4]
push esi
push eax
mov dword [edi + 8], ecx
call fcn.00462950
add esp, 8
cmp eax, esi
jae case.0x461ee0.4
push dword [esp + 0x14]
push str.TFTP_error:__s
push ebp
call fcn.004434b0
jmp 0x461fa1
lea eax, [esi - 2]
push eax
lea eax, [edx + 2]
push eax
push edi
call fcn.00461bb0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je case.0x461ee0.4
jmp 0x461ea6
push str.Internal_error:_Unexpected_packet
push 0x48b0c0
push ebp
call fcn.004433e0
add esp, 0xc
push ebp
call fcn.00456b70
add esp, 4
test eax, eax
je 0x461ea6
push 5
push edi
call fcn.004628e0
add esp, 8
mov eax, 0x2a
jmp 0x461ea8
Function at 0x47e790
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x120
mov eax, dword [0x4a2014]
xor eax, esp
mov dword [esp + 0x11c], eax
mov eax, dword [esp + 0x124]
push ebx
push ebp
mov ebp, dword [esp + 0x134]
xor ebx, ebx
push esi
push edi
mov edi, dword [esp + 0x138]
xor esi, esi
push edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
add esp, 4
mov dword [esp + 0x20], eax
test eax, eax
jne 0x47e810
push 0x100
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0042f270
push eax
push edi
push str.schannel:_invalid_path_name_for_CA_file__s:__s
push ebp
call fcn.004433e0
push esi
call dword [0x4a2024]
add esp, 0x20
lea eax, [ebx + 0x4d]
jmp 0x47e970
push 0
push 0x80
push 3
push 0
push 1
push accept
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esp + 0x18], eax
cmp eax, 0xffffffff
jne 0x47e86a
push 0x100
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0042f270
push eax
push edi
push str.schannel:_failed_to_open_CA_file__s:__s
push ebp
call fcn.004433e0
push 0
mov esi, 0x4d
call dword [0x4a2024]
add esp, 0x20
jmp 0x47e961
lea ecx, [esp + 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x47e8aa
push 0x100
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0042f270
push eax
push edi
push str.schannel:_failed_to_determine_size_of_CA_file__s:__s
push ebp
call fcn.004433e0
add esp, 0x1c
mov esi, 0x4d
jmp 0x47e94d
mov edi, dword [esp + 0x24]
cmp dword [esp + 0x28], ebx
jl 0x47e8d8
jg 0x47e8be
cmp edi, 0x100000
jbe 0x47e8d8
push 0x100000
push str.schannel:_CA_file_exceeds_max_size_of__u_bytes
push ebp
call fcn.004433e0
add esp, 0xc
mov esi, 0x4d
jmp 0x47e94d
lea eax, [edi + 1]
push eax
call dword [0x4a2020]
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x47e8f0
lea esi, [eax + 0x1b]
jmp 0x47e94d
test edi, edi
je 0x47e934
nop dword [eax]
nop dword [eax + eax]
push 0
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
mov eax, edi
sub eax, esi
push eax
lea eax, [esi + ebx]
push eax
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x47e98d
mov eax, dword [esp + 0x10]
test eax, eax
je 0x47e989
add esi, eax
cmp esi, edi
jb 0x47e900
push ebp
push dword [esp + 0x18]
mov byte [edi + ebx], 0
push edi
push ebx
push dword [esp + 0x2c]
call fcn.0047e590
add esp, 0x14
mov esi, eax
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [0x4a2024]
add esp, 4
push dword [esp + 0x20]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x12c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042a51d
add esp, 0x120
ret
mov edi, esi
jmp 0x47e934
push 0x100
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0042f270
push eax
push dword [esp + 0x24]
push str.schannel:_failed_to_read_from_CA_file__s:__s
push ebp
call fcn.004433e0
add esp, 0x1c
mov esi, 0x4d
jmp 0x47e94d
Function at 0x484c20
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push dword [esp + 0x24]
call fcn.00446920
mov edx, dword [ebp + 0xc]
mov ebx, eax
mov ecx, dword [ebp + 0x14]
mov dword [esp + 0x14], ebx
lea ecx, [ecx + edx*2]
add ecx, 0xc
push ecx
call dword [0x4a2020]
mov esi, eax
add esp, 8
test esi, esi
je 0x484da2
lea ecx, [esi + 0xc]
mov dword [esi], ebp
mov dword [esi + 4], ecx
mov eax, dword [ebp + 0xc]
add eax, ecx
mov dword [esi + 8], eax
push edi
lea edi, [ebp + 4]
cmp ebx, dword [ebp + 0x10]
jbe 0x484ca2
mov eax, dword [ebp]
push ecx
call eax
mov eax, dword [esp + 0x28]
push ebx
push eax
push dword [esi + 4]
mov eax, dword [edi]
call eax
mov eax, dword [esi + 8]
add eax, dword [ebp + 0xc]
push dword [esi + 4]
mov dword [esp + 0x38], eax
push eax
mov eax, dword [ebp + 8]
call eax
mov eax, dword [ebp + 0x14]
add esp, 0x18
mov dword [esp + 0x14], eax
push dword [esi + 4]
mov eax, dword [ebp]
call eax
push dword [esi + 8]
mov eax, dword [ebp]
call eax
mov eax, dword [esp + 0x1c]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x484d13
mov ebp, dword [esp + 0x24]
mov ebx, eax
mov dword [esp + 0x18], eax
nop dword [eax]
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x13], al
lea eax, [esp + 0x13]
push 1
push eax
push dword [esi + 4]
mov eax, dword [edi]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x1f], al
lea eax, [esp + 0x1f]
push 1
push eax
push dword [esi + 8]
mov eax, dword [edi]
call eax
add esp, 0x18
sub ebx, 1
jne 0x484cd0
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x20]
cmp ebx, dword [ebp + 0x10]
jae 0x484d45
nop dword [eax + eax]
mov eax, dword [edi]
push 1
push 0x49881d
push dword [esi + 4]
call eax
mov eax, dword [edi]
push 1
push 0x49881e
push dword [esi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [ebp + 0x10]
jb 0x484d20
push dword [esp + 0x30]
call fcn.00446920
mov ecx, dword [esi]
push eax
push dword [esp + 0x34]
push dword [esi + 4]
mov eax, dword [ecx + 4]
call eax
mov edi, dword [esp + 0x44]
add esp, 0x10
mov ebx, dword [esi]
test edi, edi
jne 0x484d70
mov edi, dword [ebx + 0xc]
add edi, dword [esi + 8]
push dword [esi + 4]
mov eax, dword [ebx + 8]
push edi
call eax
push dword [ebx + 0x14]
mov eax, dword [ebx + 4]
push edi
push dword [esi + 8]
call eax
push dword [esi + 8]
mov eax, dword [ebx + 8]
push edi
call eax
push esi
call dword [0x4a2024]
add esp, 0x20
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
pop esi
pop ebp
mov eax, 0x1b
pop ebx
add esp, 0xc
ret
Function at 0x484e90
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 0xc
lea eax, [esp + 4]
push 0xf0000040
push 0x18
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x484eb6
mov eax, 0x1b
add esp, 0xc
ret
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x800c
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x484eee
push eax
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esp + 4], 0
mov eax, 2
add esp, 0xc
ret
push dword [esp + 0x18]
call fcn.00446920
add esp, 4
push 0
push eax
push dword [esp + 0x1c]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push 0
push 2
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [esp], 0x20
jne 0x484f45
push 0
lea eax, [esp + 4]
push eax
push dword [esp + 0x18]
push 2
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov eax, dword [esp + 8]
test eax, eax
je 0x484f54
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x484f65
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
add esp, 0xc
ret

Function at 0x485ba0
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x485bec
push ebx
mov ebx, dword [esp + 0x10]
mov cl, byte [esi + ebx]
mov dl, cl
mov al, cl
shr dl, 1
and al, 0xfe
not dl
movzx eax, al
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
or cl, 1
test dl, 2
movzx ecx, cl
cmove ecx, eax
mov byte [esi + ebx], cl
inc esi
cmp esi, edi
jb 0x485bb1
pop ebx
pop edi
pop esi
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x432072
nop
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x611a0f1f
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x432060
nop
nop
nop
mov eax, section..tls
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4320d2
nop
mov ebx, 0x42f314
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x328d3516
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x402b70
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e0827
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
push ebx
push esi
push edi
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x10], esp
mov ebx, 1
push 0x5188e8
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], ebx
call fcn.004d489b
mov eax, dword [ebp + 0x1c]
mov byte [ebp - 4], 3
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x402c1e
mov esi, dword [ebp + 8]
push 0x5188e8
mov ecx, esi
call fcn.004d489b
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.004d482d
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x402d3c
mov al, byte [ecx - 1]
test al, al
je 0x402d32
cmp al, 0xff
je 0x402d32
dec al
mov byte [ecx - 1], al
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x11c]
push 0x104
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x11c]
push ecx
push esi
call sub.PSAPI.DLL_GetProcessImageFileNameA
lea edi, [ebp - 0x11c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x402c7d
lea edx, [ebp - 0x11c]
lea eax, [ebp + 0x1c]
push edx
push eax
call fcn.00402920
add esp, 8
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 4
call fcn.004d4966
lea ecx, [ebp + 0x1c]
mov byte [ebp - 4], 3
call fcn.004d482d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x402ce0
mov esi, dword [ebp + 8]
lea edx, [ebp - 0x14]
push edx
mov ecx, esi
mov dword [ebp - 4], 2
call fcn.004d45a2
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 4], bl
or ecx, ebx
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x14]
call fcn.004d482d
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x402d3c
mov al, byte [ecx - 1]
test al, al
je 0x402d32
cmp al, 0xff
je 0x402d32
dec al
mov byte [ecx - 1], al
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
dec ecx
push ecx
call fcn.004d4597
add esp, 4
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403900
Capabilities:
Get file version info

Disassembly:
sub esp, 0x118
lea eax, [esp + 0x10]
push ebx
mov ebx, dword [esp + 0x120]
push esi
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jbe 0x403a26
push edi
call fcn.004d456e
add esp, 4
mov esi, eax
push esi
push edi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoA
lea ecx, [esp + 0x14]
lea edx, [esp + 0x10]
push ecx
push edx
push str.VarFileInfoTranslation
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x403a1d
mov eax, dword [esp + 0x10]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
xor ecx, ecx
xor edx, edx
mov cx, word [eax + 2]
mov dx, word [eax]
push ecx
push edx
lea eax, [esp + 0x28]
push str.StringFileInfo_04x_04xCompanyName
push eax
call edi
add esp, 0x10
lea ecx, [esp + 0x18]
lea edx, [esp + 0xc]
lea eax, [esp + 0x20]
push ecx
push edx
push eax
push esi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x28], 0
call sub.VERSION.dll_VerQueryValueA
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4039bf
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4039bf
mov ecx, dword [esp + 0x12c]
push eax
call fcn.004d49b6
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov dword [esp + 0xc], 0
xor edx, edx
mov cx, word [eax + 2]
mov dx, word [eax]
push ecx
push edx
lea eax, [esp + 0x28]
push str.StringFileInfo_04x_04xProductVersion
push eax
call edi
add esp, 0x10
lea ecx, [esp + 0x14]
lea edx, [esp + 0xc]
lea eax, [esp + 0x20]
push ecx
push edx
push eax
push esi
call sub.VERSION.dll_VerQueryValueA
mov eax, dword [esp + 0x14]
test eax, eax
je 0x403a19
mov eax, dword [esp + 0xc]
test eax, eax
je 0x403a19
mov ecx, dword [esp + 0x130]
push eax
call fcn.004d49b6
test esi, esi
je 0x403a26
push esi
call fcn.004d4597
add esp, 4
pop edi
pop esi
pop ebx
add esp, 0x118
ret

Function at 0x403a30
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
push esi
test eax, eax
je 0x403a7a
cmp byte [eax], 0
je 0x403a7a
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
test esi, esi
je 0x403a7a
cmp esi, 0xffffffff
je 0x403a7a
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
ret
or eax, 0xffffffff
pop esi
ret
Function at 0x405930
Capabilities:
Enumerate processes
Print debug messages

Disassembly:
sub esp, 0x140
push ebx
push esi
push edi
mov esi, ecx
push 0
push 2
mov dword [esp + 0x1c], esi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
mov eax, dword [0x508464]
xor edi, edi
cmp eax, 0xf
jge 0x405961
inc eax
mov edi, 1
mov dword [0x508464], eax
lea eax, [esp + 0x24]
push ebp
push eax
push ebx
mov dword [esp + 0x30], pe_nt_image_headers32
call sub.KERNEL32.dll_Process32First
mov ecx, dword [0x518b70]
mov dword [esp + 0x1c], eax
call fcn.00434420
mov ecx, eax
mov eax, 0xc22e4507
add ecx, 0x7080
imul ecx
mov eax, dword [0x518904]
add edx, ecx
sar edx, 0x10
mov ecx, edx
push eax
shr ecx, 0x1f
add edx, ecx
mov ecx, dword [eax]
mov ebp, edx
lea edx, [esp + 0x18]
push ecx
push edx
mov ecx, 0x518900
call fcn.00408310
cmp edi, 1
jne 0x4059d6
mov eax, dword [0x51891c]
push eax
mov ecx, dword [eax]
lea eax, [esp + 0x18]
push ecx
push eax
mov ecx, 0x518918
call fcn.00407810
mov ecx, dword [0x51891c]
mov eax, dword [ecx]
cmp eax, ecx
mov dword [esp + 0x10], eax
je 0x405a88
mov ecx, dword [eax + 0xc]
lea edx, [esp + 0x14]
lea eax, [esp + 0x20]
mov dword [esp + 0x14], ecx
push edx
push eax
mov ecx, 0x518900
call fcn.00407cd0
cmp dword [0x51895c], 1
je 0x405a5e
cmp edi, 1
je 0x405a5e
mov ecx, dword [esp + 0x10]
mov esi, dword [ecx + 0x10]
test esi, esi
je 0x405a69
mov eax, dword [esi + 0x9c]
test eax, eax
jne 0x405a3f
mov ecx, esi
call fcn.00402e40
cmp eax, 0xe10
jb 0x405a3f
mov ecx, esi
call fcn.00402f10
jmp 0x405a69
push ebp
mov ecx, esi
call fcn.00402ee0
test al, al
je 0x405a69
mov ecx, esi
call fcn.00402f10
mov dword [esi + 0x9c], 0
jmp 0x405a69
push str.bAppPause__TRUE_r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [esp + 0x10]
call fcn.00408b50
mov eax, dword [esp + 0x10]
mov ecx, dword [0x51891c]
cmp eax, ecx
jne 0x4059ea
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
pop ebp
test eax, eax
je 0x405aba
cmp dword [0x51895c], 1
je 0x405aba
cmp edi, 1
je 0x405aba
lea edx, [esp + 0x24]
mov ecx, esi
push edx
call fcn.00403a80
lea eax, [esp + 0x24]
push eax
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x405a91
call fcn.00405010
test ebx, ebx
je 0x405aca
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
add esp, 0x140
ret
Function at 0x405ae0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e0cf0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [esp + 0x28]
push ebx
push esi
push edi
push eax
lea ecx, [esp + 0x38]
call fcn.004d489b
xor ebx, ebx
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], ebx
call fcn.004d4d41
mov cl, byte [esp + 0x34]
mov edx, dword [esp + 0x34]
mov byte [esp + 0x14], cl
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
lea ecx, [esp + 0x1c]
call fcn.00406da0
lea edx, [esp + 0x14]
mov ecx, 0x518930
push edx
mov byte [esp + 0x30], 1
call fcn.0040a540
mov ecx, dword [0x518934]
mov dword [esp + 0xc], eax
cmp eax, ecx
je 0x405b80
add eax, 0xc
lea ecx, [esp + 0x14]
push eax
call fcn.0040ad20
test eax, eax
jl 0x405b80
lea eax, [esp + 0xc]
jmp 0x405b8d
mov eax, dword [0x518934]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
mov esi, dword [eax]
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x405bb4
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x405bab
cmp al, 0xff
je 0x405bab
dec al
mov byte [ecx], al
jmp 0x405bb4
push ecx
call fcn.004d4597
add esp, 4
mov eax, dword [0x518934]
pop edi
cmp esi, eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
pop esi
pop ebx
mov dword [esp + 0x20], 0xffffffff
lea ecx, [esp + 0x28]
je 0x405bf1
call fcn.004d482d
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret
call fcn.004d482d
mov ecx, dword [esp + 0x18]
xor eax, eax
mov dword fs:[0], ecx
add esp, 0x24
ret

Function at 0x405c10
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x28
mov edx, dword [0x5098d0]
mov eax, dword [str.SeDebugPrivilege]
mov ecx, dword [0x5098cc]
mov dword [esp + 0x1c], edx
lea edx, [esp]
mov dword [esp + 0x14], eax
mov eax, dword [0x5098d4]
mov dword [esp + 0x18], ecx
mov cl, byte [0x5098d8]
push edx
push 0x28
mov dword [esp + 0x28], eax
mov byte [esp + 0x2c], cl
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x405cc6
lea eax, [esp + 8]
lea ecx, [esp + 0x14]
push eax
push ecx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x405c80
mov edx, dword [esp]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x28
ret
mov ecx, dword [esp]
push 0
push 0
lea eax, [esp + 0xc]
push 0x10
push eax
push 0
push ecx
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x405cbb
mov edx, dword [esp]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x28
ret
mov eax, dword [esp]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x28
ret
Function at 0x406190
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x4e0d43
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x12c
push ebx
push esi
push edi
mov eax, dword [0x513458]
xor ebx, ebx
mov dword [esp + 0x140], ebx
xor edi, edi
mov dword [esp + 0xc], eax
push ebx
push 2
mov byte [esp + 0x148], 1
mov dword [esp + 0x18], pe_nt_image_headers32
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x406284
lea ecx, [esp + 0x10]
push ecx
push esi
call sub.KERNEL32.dll_Process32First
cmp eax, ebx
je 0x40624b
lea edx, [esp + 0x34]
lea ecx, [esp + 0xc]
push edx
call fcn.004d49b6
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x148]
push eax
push ecx
call fcn.004aee23
add esp, 8
test eax, eax
je 0x40622c
lea edx, [esp + 0x10]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
cmp eax, ebx
jne 0x4061f4
jmp 0x40624b
mov eax, dword [esp + 0x14c]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x150]
mov edi, 1
mov dword [eax], ecx
mov eax, dword [esp + 0x28]
mov dword [edx], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebx
jle 0x406284
lea ecx, [esp + 0xc]
mov byte [esp + 0x140], bl
call fcn.004d482d
lea ecx, [esp + 0x148]
mov dword [esp + 0x140], 0xffffffff
call fcn.004d482d
mov eax, 1
jmp 0x4062ad
lea ecx, [esp + 0xc]
mov byte [esp + 0x140], bl
call fcn.004d482d
lea ecx, [esp + 0x148]
mov dword [esp + 0x140], 0xffffffff
call fcn.004d482d
xor eax, eax
mov ecx, dword [esp + 0x138]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x138
ret

Function at 0x40adf0
Capabilities:
Create thread

Disassembly:
mov edx, dword [ecx + 0xc]
lea eax, [ecx + 0xc]
test edx, edx
jne 0x40ae0f
push eax
push 0
push ecx
push 0x40ae10
push 0
push 0
call fcn.004af3a5
add esp, 0x18
ret

Function at 0x40b1a0
Capabilities:
Enumerate internet cache

Disassembly:
push ebx
push ebp
mov ebp, dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryA]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x18]
push edi
push esi
push 0
call ebp
mov ebx, eax
test ebx, ebx
jne 0x40b1ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x40b1f3
push esi
call fcn.004d4597
mov eax, dword [edi]
push eax
call fcn.004d456e
mov ecx, dword [edi]
add esp, 8
mov esi, eax
push edi
push esi
push 0
mov dword [esi], ecx
call ebp
mov ebx, eax
test ebx, ebx
je 0x40b1be
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
ret
push ebx
cmp eax, 0x103
call dword [sym.imp.WININET.dll_FindCloseUrlCache]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x40c880
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0
push ecx
push 0x40cdb0
push 0
push 0
call fcn.004af3a5
mov dword [0x518b8c], eax
add esp, 0x1c
ret