joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406d00
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x406e0a
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x406d53
push 0x105
lea eax, [ebp - 0x109]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA_2
mov ecx, eax
lea edx, [ebp - 0x109]
mov eax, dword [ebp - 4]
call fcn.00403238
jmp 0x406df1
call sub.kernel32.dll_GetCommandLineA_1
mov ebx, eax
mov eax, ebx
call fcn.00406cb4
mov ebx, eax
mov edi, ebx
mov eax, ebx
call fcn.00406cd4
mov ebx, eax
test esi, esi
je 0x406d7b
dec esi
test esi, esi
jl 0x406d7b
cmp edi, ebx
jne 0x406d5a
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x110]
mov edx, edi
call fcn.00403278
mov eax, dword [ebp - 0x110]
mov ecx, ebx
sub ecx, edi
mov edx, 1
call fcn.004034d0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004032cc
cmp eax, 2
jl 0x406df1
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp byte [eax], 0x22
jne 0x406df1
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004032cc
mov edx, dword [ebp - 4]
mov edx, dword [edx]
cmp byte [edx + eax - 1], 0x22
jne 0x406df1
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004032cc
mov ecx, eax
sub ecx, 2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, 2
call fcn.004034d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406e11
lea eax, [ebp - 0x110]
call fcn.00403154
ret

Function at 0x406e4c
Capabilities:
Get file attributes

Disassembly:
call fcn.00405834
push eax
call sub.kernel32.dll_GetFileAttributesA
and al, 0x10
sete al
ret

Function at 0x406f70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x406fda
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x105
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
call fcn.00403278
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.00406f14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406fe1
lea eax, [ebp - 0x10c]
call fcn.00403154
ret

Function at 0x406fe8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x407052
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x105
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
call fcn.00403278
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.00406f14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407059
lea eax, [ebp - 0x10c]
call fcn.00403154
ret
Function at 0x407060
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4070ca
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x105]
push eax
push 0x105
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
call fcn.00403278
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.00406f14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4070d1
lea eax, [ebp - 0x10c]
call fcn.00403154
ret

Function at 0x4070d8
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x150], ebx
mov dword [ebp - 0xc], ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403480
mov eax, dword [ebp - 8]
call fcn.00403480
xor eax, eax
push ebp
push 0x407228
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00403154
cmp dword [ebp - 4], 0
je 0x407140
mov eax, dword [ebp - 4]
call fcn.004032cc
mov edx, dword [ebp - 4]
cmp byte [edx + eax - 1], 0x5c
je 0x407140
lea eax, [ebp - 4]
mov edx, 0x407240
call fcn.004032d4
cmp dword [ebp - 8], 0
je 0x40716f
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x40716f
lea ecx, [ebp - 0x150]
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.00406b84
mov edx, dword [ebp - 0x150]
lea eax, [ebp - 8]
call fcn.004031ec
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00403318
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00403490
push eax
call sub.kernel32.dll_FindFirstFileA
mov esi, eax
test esi, esi
setne al
jmp 0x4071f8
test dword [ebp - 0x14c], 0x10
ja 0x4071e5
cmp dword [ebx], 0
je 0x4071b8
mov eax, ebx
mov edx, 0x40724c
call fcn.004032d4
push dword [ebx]
push dword [ebp - 4]
lea eax, [ebp - 0x150]
lea edx, [ebp - 0x120]
mov ecx, 0x104
call fcn.004032b4
push dword [ebp - 0x150]
mov eax, ebx
mov edx, 3
call fcn.0040338c
lea eax, [ebp - 0x14c]
push eax
push esi
call sub.kernel32.dll_FindNextFileA
neg eax
sbb eax, eax
neg eax
test al, al
jne 0x40719b
push esi
call sub.kernel32.dll_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40722f
lea eax, [ebp - 0x150]
call fcn.00403154
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403178
ret
Function at 0x407250
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x24], edx
mov edi, eax
xor eax, eax
push ebp
push 0x407341
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.004032cc
mov ebx, eax
lea eax, [ebx + 2]
call fcn.004024ec
mov esi, eax
mov eax, edi
call fcn.00403490
mov edx, eax
mov eax, esi
call fcn.00406ab8
mov byte [esi + ebx + 1], 0
cmp ebx, 0
jl 0x4072ab
cmp byte [esi + ebx], 0x3b
jne 0x4072a5
mov byte [esi + ebx], 0
dec ebx
cmp ebx, 0xffffffff
jne 0x40729b
lea eax, [ebp - 0x1e]
xor ecx, ecx
mov edx, 0x1e
call fcn.004026f4
cmp dword [0x4544f4], 0
je 0x4072ce
mov eax, dword [0x4544f4]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], 3
mov dword [ebp - 0x16], esi
mov word [ebp - 0xe], 0x50
mov dword [ebp - 0xc], 0xffffffff
push 0x40735c
push edi
push 0x40736c
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.0040338c
mov eax, dword [ebp - 0x24]
call fcn.00403490
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1e]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
test bl, bl
je 0x407324
mov ebx, dword [ebp - 0xc]
cmp ebx, 1
sbb ebx, ebx
neg ebx
mov eax, esi
call fcn.00402504
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407348
lea eax, [ebp - 0x24]
call fcn.00403154
ret

Function at 0x4078d8
Capabilities:
Create thread

Disassembly:
push ebx
mov eax, dword [0x453c18]
mov byte [eax], 1
mov edx, dword [0x4056cc]
xor eax, eax
call fcn.004059b8
mov ebx, eax
mov byte [ebx + 0x18], 1
lea eax, [ebx + 0x1e]
push eax
push 4
push ebx
push 0x4078c8
push 0
push 0
call sub.kernel32.dll_CreateThread
mov dword [ebx + 0x1a], eax
mov eax, ebx
pop ebx
ret

Function at 0x407968
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
mov byte [ebx + 0x18], 0
mov eax, dword [ebx + 0x1a]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
jbe 0x407983
mov byte [ebx + 0x18], 1
pop ebx
ret
cmp word [ebx + 0x2c], 0
je 0x407992
mov edx, ebx
mov eax, dword [ebx + 0x2e]
call dword [ebx + 0x2a]
pop ebx
ret

Function at 0x4079f0
Capabilities:
Terminate thread

Disassembly:
push ebx
mov ebx, eax
push 0
mov eax, dword [ebx + 0x1a]
push eax
call sub.kernel32.dll_TerminateThread
mov byte [ebx + 0x19], 1
pop ebx
ret
Function at 0x407e0c
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x407ea4
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x18], 0
jne 0x407e59
mov eax, dword [ebx + 0x19]
call fcn.00403490
push eax
push esi
mov eax, edi
call fcn.00403490
push eax
mov eax, dword [ebx + 0x1d]
call fcn.00403490
push eax
call sub.kernel32.dll_GetPrivateProfileIntA
mov dword [ebp - 4], eax
jmp 0x407e8e
mov dword [ebp - 4], esi
mov eax, dword [ebx + 0x19]
call fcn.00403490
push eax
lea edx, [ebp - 8]
mov eax, esi
call fcn.00406a30
mov eax, dword [ebp - 8]
call fcn.00403490
push eax
mov eax, edi
call fcn.00403490
push eax
mov eax, dword [ebx + 0x1d]
call fcn.00403490
push eax
call sub.kernel32.dll_WritePrivateProfileStringA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407eab
lea eax, [ebp - 8]
call fcn.00403154
ret

Function at 0x407eb8
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 8
add esp, 0xfffff004
push eax
dec eax
jne 0x407ec1
mov eax, dword [ebp - 4]
add esp, 4
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp byte [ebx + 0x18], 0
jne 0x407f2f
mov byte [ebp - 0x8000], 0
mov eax, dword [ebx + 0x19]
call fcn.00403490
push eax
push 0x8000
lea eax, [ebp - 0x8000]
push eax
mov eax, esi
call fcn.00403490
push eax
mov eax, edi
call fcn.00403490
push eax
mov eax, dword [ebx + 0x1d]
call fcn.00403490
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x8000]
mov ecx, 0x8000
call fcn.004032b4
jmp 0x407f60
mov eax, dword [ebp + 8]
mov edx, esi
call fcn.004031ec
mov eax, dword [ebx + 0x19]
call fcn.00403490
push eax
mov eax, esi
call fcn.00403490
push eax
mov eax, edi
call fcn.00403490
push eax
mov eax, dword [ebx + 0x1d]
call fcn.00403490
push eax
call sub.kernel32.dll_WritePrivateProfileStringA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x409bd8
Capabilities:
Get graphical window text

Disassembly:
xchg edx, eax
movzx ecx, byte [edx + 0x3a]
jecxz 0x409be7
mov edx, dword [edx + 0x36]
jmp fcn.00403278
mov ecx, dword [edx + 0x18]
jecxz 0x409bdf
push ebx
push esi
xchg ebx, eax
mov esi, ecx
push esi
call sub.user32.dll_GetWindowTextLengthA
mov edx, eax
inc eax
push eax
mov eax, ebx
call fcn.004035fc
pop edx
mov ecx, dword [ebx]
jecxz 0x409c0f
push edx
push ecx
push esi
call sub.user32.dll_GetWindowTextA
pop esi
pop ebx
ret

Function at 0x409c80
Capabilities:
Hide graphical window

Disassembly:
and byte [eax + 0x27], 0xef
test dl, dl
je 0x409c8c
or byte [eax + 0x27], 0x10
mov byte [eax + 0x4e], dl
mov ecx, dword [eax + 0x18]
jecxz 0x409ca8
push eax
je 0x409ca9
call dword [0x452134]
pop eax
push 5
push dword [eax + 0x18]
call sub.user32.dll_ShowWindow
ret
mov byte [eax + 0x15a], dl
push 0
push ecx
call sub.user32.dll_ShowWindow
pop eax
call dword [0x452134]
ret

Function at 0x40c038
Capabilities:
Capture screenshot

Disassembly:
push ebx
mov ebx, eax
call fcn.0040b988
je 0x40c07d
mov eax, ebx
push edx
call fcn.0040c37c
pop edx
cmp eax, edx
je 0x40c07d
test edx, edx
mov eax, ebx
jne 0x40c05c
pop ebx
inc edx
jmp fcn.0040c36c
mov byte [ebx + 0x49], dl
cmp dl, 5
jne 0x40c065
dec edx
push edx
xor edx, edx
call fcn.0040c36c
mov eax, dword [ebx + 0x3d]
movzx eax, word [eax + 0xe]
call fcn.0040b62c
pop edx
cmp al, dl
xchg ebx, eax
pop ebx
jne fcn.0040c09c
ret
Function at 0x40ca74
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov eax, ebx
call fcn.00403154
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x40cac3
push 1
call sub.user32.dll_IsClipboardFormatAvailable
test eax, eax
je 0x40cabe
push 1
call sub.user32.dll_GetClipboardData
mov esi, eax
test esi, esi
je 0x40cabe
push esi
call sub.kernel32.dll_GlobalLock
mov edi, eax
test edi, edi
je 0x40cabe
mov eax, ebx
mov edx, edi
call fcn.00403278
push esi
call sub.kernel32.dll_GlobalUnlock
call sub.user32.dll_CloseClipboard
pop edi
pop esi
pop ebx
ret

Function at 0x40cac8
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov eax, ebx
call fcn.00403678
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x40cb17
push 0xd
call sub.user32.dll_IsClipboardFormatAvailable
test eax, eax
je 0x40cb12
push 0xd
call sub.user32.dll_GetClipboardData
mov esi, eax
test esi, esi
je 0x40cb12
push esi
call sub.kernel32.dll_GlobalLock
mov edi, eax
test edi, edi
je 0x40cb12
mov eax, ebx
mov edx, edi
call fcn.004036fc
push esi
call sub.kernel32.dll_GlobalUnlock
call sub.user32.dll_CloseClipboard
pop edi
pop esi
pop ebx
ret

Function at 0x40cb94
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push esi
push edi
mov edi, eax
xor ebx, ebx
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x40cc0f
call sub.user32.dll_EmptyClipboard
mov eax, edi
xor edx, edx
call fcn.00403754
je 0x40cc08
mov eax, edi
call fcn.00403748
inc eax
add eax, eax
push eax
push 0x2000
call sub.kernel32.dll_GlobalAlloc
mov esi, eax
test esi, esi
je 0x40cc0a
push esi
call sub.kernel32.dll_GlobalLock
mov ebx, eax
mov eax, edi
call fcn.00403748
inc eax
add eax, eax
push eax
mov eax, edi
call fcn.00403738
mov edx, ebx
pop ecx
call fcn.004025c0
push esi
call sub.kernel32.dll_GlobalUnlock
push esi
push 0xd
call sub.user32.dll_SetClipboardData
test eax, eax
setne bl
jmp 0x40cc0a
mov bl, 1
call sub.user32.dll_CloseClipboard
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x40cda4
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
cmp byte [0x4523b4], 0xff
je 0x40cdba
mov al, byte [0x4523b4]
jmp 0x40ce1a
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
mov eax, dword [esp + 0x10]
cmp eax, 2
jne 0x40cdf3
mov al, 3
mov edx, dword [esp + 4]
cmp edx, 6
jb 0x40cddf
mov al, 6
jmp 0x40ce15
cmp edx, 5
jb 0x40ce15
cmp dword [esp + 8], 1
jb 0x40cdef
mov al, 5
jmp 0x40ce15
mov al, 4
jmp 0x40ce15
cmp eax, 1
jne 0x40ce13
mov al, 1
cmp dword [esp + 4], 4
ja 0x40ce0f
cmp dword [esp + 4], 4
jne 0x40ce15
cmp dword [esp + 8], 0xa
jb 0x40ce15
mov al, 2
jmp 0x40ce15
xor eax, eax
mov byte [0x4523b4], al
add esp, 0x94
ret
Function at 0x413b68
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x413c36
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
xor eax, eax
mov dword [ebx + 0x2c], eax
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.004026f4
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 1
xor eax, eax
mov al, byte [ebx + 0x38]
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
push 0
push 0x4000000
push 0
push 0
push 0
push edi
push 0x413c50
push dword [ebp - 4]
lea eax, [ebp - 0x60]
mov edx, 3
call fcn.0040338c
mov eax, dword [ebp - 0x60]
lea edx, [ebp - 0x5c]
call fcn.00406b4c
mov eax, dword [ebp - 0x5c]
call fcn.00403490
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x413c1b
mov eax, dword [ebp - 0x50]
mov dword [ebx + 0x2c], eax
mov esi, dword [ebp - 0x58]
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413c3d
lea eax, [ebp - 0x60]
mov edx, 2
call fcn.00403178
ret
Function at 0x415b54
Capabilities:
Check os version
Link many functions at runtime

Disassembly:
push ebx
push esi
test dl, dl
je 0x415b62
add esp, 0xfffffff0
call fcn.00402a28
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.00402928
lea eax, [esi + 0x24]
xor ecx, ecx
mov edx, 0x94
call fcn.004026f4
mov dword [esi + 0x24], 0x94
lea eax, [esi + 0x24]
push eax
call sub.kernel32.dll_GetVersionExA
cmp dword [0x454664], 0
jne 0x415beb
push 0x415cf8
call sub.kernel32.dll_LoadLibraryA
mov dword [0x454664], eax
push 0x415d04
mov eax, dword [0x454664]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x454674], eax
cmp dword [esi + 0x28], 6
jae 0x415bd6
push 0x415d1c
mov eax, dword [0x454664]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x454694], eax
push 0x415d34
mov eax, dword [0x454664]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x45469c], eax
cmp dword [0x454668], 0
jne 0x415c2d
push 0x415d50
call sub.kernel32.dll_LoadLibraryA
mov dword [0x454668], eax
push 0x415d5c
mov eax, dword [0x454668]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x45467c], eax
push 0x415d78
mov eax, dword [0x454668]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x454680], eax
cmp dword [0x45466c], 0
jne 0x415c5a
push 0x415d94
call sub.kernel32.dll_LoadLibraryA
mov dword [0x45466c], eax
push 0x415da4
mov eax, dword [0x45466c]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x454678], eax
cmp dword [0x454670], 0
jne 0x415cdb
push 0x415db4
call sub.kernel32.dll_LoadLibraryA
mov dword [0x454670], eax
push 0x415dc4
mov eax, dword [0x454670]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x454684], eax
push 0x415ddc
mov eax, dword [0x454670]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x454688], eax
push 0x415df4
mov eax, dword [0x454670]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x45468c], eax
push 0x415e0c
mov eax, dword [0x454670]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x454690], eax
push 0x415e24
mov eax, dword [0x454670]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x454698], eax
mov eax, esi
test bl, bl
je 0x415cf0
call fcn.00402a80
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
ret

Function at 0x415e74
Capabilities:
Acquire debug privileges

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffd8
mov ebx, edx
push esp
push 0xf00ff
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov dword [esp + 8], 1
test bl, bl
je 0x415ea3
mov dword [esp + 0x14], 2
jmp 0x415ea9
xor eax, eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0xc]
push eax
push 0x415efc
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
xor eax, eax
mov dword [esp + 4], eax
lea esi, [esp + 8]
lea edi, [esp + 0x18]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x1c]
push eax
push 0x10
lea eax, [esp + 0x14]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
mov eax, dword [esp]
push eax
call sub.kernel32.dll_CloseHandle_1
add esp, 0x28
pop edi
pop esi
pop ebx
ret
Function at 0x415f10
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push eax
push 0xffffffffffffffff
push 1
call sub.kernel32.dll_OpenProcess
mov esi, eax
push 1
push esi
call sub.kernel32.dll_TerminateProcess
neg eax
sbb ebx, ebx
neg ebx
push esi
call sub.kernel32.dll_CloseHandle_1
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x416cfc
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov dword [esp], ecx
mov esi, edx
mov edi, eax
xor ebx, ebx
xor ecx, ecx
mov eax, dword [esp]
mov ebp, 3
cdq
idiv ebp
lea eax, [eax + eax*2]
mov dword [esp + 4], eax
cmp ecx, dword [esp + 4]
jge 0x416d8f
xor eax, eax
mov al, byte [edi]
shl eax, 0x10
xor edx, edx
mov dl, byte [edi + 1]
shl edx, 8
or eax, edx
xor edx, edx
mov dl, byte [edi + 2]
or eax, edx
mov edx, eax
shr edx, 0x12
and edx, 0x3f
mov dl, byte [edx + 0x452454]
mov byte [esi + ebx], dl
mov edx, eax
shr edx, 0xc
and edx, 0x3f
mov dl, byte [edx + 0x452454]
mov byte [esi + ebx + 1], dl
mov edx, eax
shr edx, 6
and edx, 0x3f
mov dl, byte [edx + 0x452454]
mov byte [esi + ebx + 2], dl
and eax, 0x3f
mov al, byte [eax + 0x452454]
mov byte [esi + ebx + 3], al
add ebx, 4
add edi, 3
add ecx, 3
cmp ecx, dword [esp + 4]
jl 0x416d26
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
mov ecx, edx
test ecx, ecx
je 0x416dfd
xor eax, eax
mov al, byte [edi]
shl eax, 0x10
cmp ecx, 2
jne 0x416db6
xor edx, edx
mov dl, byte [edi + 1]
shl edx, 8
or eax, edx
mov edx, eax
shr edx, 0x12
and edx, 0x3f
mov dl, byte [edx + 0x452454]
mov byte [esi + ebx], dl
mov edx, eax
shr edx, 0xc
and edx, 0x3f
mov dl, byte [edx + 0x452454]
mov byte [esi + ebx + 1], dl
cmp ecx, 2
jne 0x416df0
shr eax, 6
and eax, 0x3f
mov al, byte [eax + 0x452454]
mov byte [esi + ebx + 2], al
jmp 0x416df5
mov byte [esi + ebx + 2], 0x3d
mov byte [esi + ebx + 3], 0x3d
add ebx, 4
mov eax, ebx
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4251b8
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x45482c
mov eax, esi
mov edx, 8
test al, 1
je 0x4251d4
shr eax, 1
xor eax, 0xedb88320
jmp 0x4251d6
shr eax, 1
dec edx
jne 0x4251c7
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4251c0
mov byte [0x454c2c], 1
pop esi
ret

Function at 0x4251f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x454c2c], 0
jne 0x425207
call fcn.004251b8
mov eax, edi
dec eax
test eax, eax
jl 0x425230
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x45482c]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x425211
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x42c8e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
test dl, dl
je 0x42c8f9
add esp, 0xfffffff0
call fcn.00402a28
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x42cd89
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 0xc]
push eax
push esi
mov ecx, dword [ebp - 8]
xor edx, edx
mov eax, ebx
call fcn.004111e4
mov dword [ebx + 0x3c], esi
mov dl, 1
mov eax, dword [0x411618]
call fcn.00402928
mov esi, eax
mov dword [ebx + 0xc], esi
push 1
lea eax, [esi + 0xc]
mov ecx, 1
mov edx, dword [0x4115f0]
call fcn.004040e0
add esp, 4
push 0
lea eax, [esi + 0x10]
mov ecx, 1
mov edx, dword [0x411604]
call fcn.004040e0
add esp, 4
mov dl, 1
mov eax, dword [0x414d58]
call fcn.00402928
mov esi, eax
mov dword [ebx + 0x10], esi
mov eax, esi
mov dword [eax + 4], 0xc
xor edx, edx
mov dword [eax + 8], edx
xor edx, edx
mov dword [eax + 0xc], edx
mov dl, 1
mov eax, dword [0x414e50]
call fcn.00414eac
mov dword [ebx + 0x14], eax
mov dl, 1
mov eax, dword [0x411754]
call fcn.00402928
mov esi, eax
mov dword [ebx + 0x18], esi
mov eax, esi
mov byte [eax + 5], 1
mov dx, 5
call fcn.004117bc
mov dl, 1
mov eax, dword [0x414f98]
call fcn.00402928
mov dword [ebx + 0x1c], eax
mov dl, 1
mov eax, dword [0x41508c]
call fcn.00402928
mov esi, eax
mov dword [ebx + 0x20], esi
mov eax, esi
mov dword [eax + 8], eax
mov dword [eax + 4], 0x4151cc
mov dl, 1
mov eax, dword [0x42c6b0]
call fcn.00402928
mov esi, eax
mov dword [ebx + 0x24], esi
mov eax, esi
mov dword [eax + 8], 0xd
xor edx, edx
mov dword [eax + 0xc], edx
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
mov dl, 1
mov eax, dword [0x41377c]
call fcn.00402928
mov esi, eax
mov dword [ebx + 0x28], esi
lea eax, [ebp - 0xc]
mov edx, 0x42cdb4