joyce8/EMBER2024-capa huggingface dataset:
Function at 0x460efc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, eax
push esi
push edi
mov dword [ebp - 4], ecx
lea eax, [ebx + 0x3c]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0x10
mov edi, edx
mov edx, dword [ebx + 0x38]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
add eax, dword [ebp - 4]
mov dword [edx], eax
cmp eax, dword [ebp - 0xc]
jae 0x460f5c
mov ecx, dword [ebp - 4]
push ecx
push edi
mov eax, dword [ebp - 0x10]
add eax, ebx
add eax, 0x28
push eax
call fcn.004603a4
add esp, 0xc
mov edx, dword [ebp - 4]
add dword [ebx + 0x38], edx
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [ecx], eax
xor eax, eax
jmp 0x461051
cmp esi, edi
jne 0x460f6a
mov eax, 0x1001
jmp 0x461051
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 0x10]
push edx
push edi
mov ecx, dword [ebp - 0x10]
add ecx, ebx
add ecx, 0x28
push ecx
call fcn.004603a4
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
sub eax, dword [ebp - 0x10]
sub edx, dword [ebp - 0x10]
add edi, eax
add esp, 0xc
sub dword [ebp - 4], edx
lea edx, [ebx + 0x18]
mov eax, dword [ebp - 8]
call fcn.0046278c
mov ecx, dword [ebx + 0x28]
xor dword [ebx + 0x18], ecx
mov eax, dword [ebx + 0x2c]
xor dword [ebx + 0x1c], eax
mov edx, dword [ebx + 0x30]
xor dword [ebx + 0x20], edx
mov ecx, dword [ebx + 0x34]
xor dword [ebx + 0x24], ecx
mov eax, dword [ebx + 0x18]
mov dword [esi], eax
mov edx, dword [ebx + 0x1c]
mov dword [esi + 4], edx
mov ecx, dword [ebx + 0x20]
mov dword [esi + 8], ecx
mov eax, dword [ebx + 0x24]
mov dword [esi + 0xc], eax
add esi, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0xc]
jb 0x461027
lea edx, [ebx + 0x18]
mov eax, dword [ebp - 8]
call fcn.0046278c
mov ecx, dword [edi]
xor dword [ebx + 0x18], ecx
mov eax, dword [edi + 4]
xor dword [ebx + 0x1c], eax
mov edx, dword [edi + 8]
xor dword [ebx + 0x20], edx
mov ecx, dword [edi + 0xc]
xor dword [ebx + 0x24], ecx
mov eax, dword [ebx + 0x18]
mov dword [esi], eax
mov edx, dword [ebx + 0x1c]
mov dword [esi + 4], edx
mov ecx, dword [ebx + 0x20]
mov dword [esi + 8], ecx
mov eax, dword [ebx + 0x24]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
sub dword [ebp - 4], edx
add edi, eax
mov ecx, dword [ebp - 4]
add esi, eax
cmp ecx, dword [ebp - 0xc]
jae 0x460fd9
mov eax, dword [ebp - 4]
lea edx, [ebx + 0x28]
push eax
push edi
push edx
call fcn.004603a4
add esp, 0xc
mov ecx, dword [ebx + 0x38]
and ecx, 0xf0000000
add ecx, dword [ebp - 4]
mov dword [ebx + 0x38], ecx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
sub dword [eax], edx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4611ac
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov dword [esp + 4], ecx
mov dword [esp], edx
mov ecx, dword [esp + 4]
mov esi, dword [ebx + 0x38]
mov edx, 0x10
lea eax, [ebx + 0x3c]
mov dword [ecx], edx
lea edx, [ebx + 0x18]
call fcn.0046278c
xor ecx, ecx
mov eax, dword [esp]
mov edx, eax
lea eax, [ebx + 0x28]
cmp esi, ecx
jbe 0x4611ef
mov bl, byte [eax]
inc ecx
xor bl, byte [eax - 0x10]
inc eax
mov byte [edx], bl
inc edx
cmp esi, ecx
ja 0x4611e1
mov eax, dword [esp + 4]
mov dword [eax], esi
xor eax, eax
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x4615d8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, eax
push esi
push edi
mov dword [ebp - 4], ecx
lea eax, [ebx + 0x3c]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0x10
mov edi, edx
mov edx, dword [ebx + 0x38]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
add eax, dword [ebp - 4]
mov dword [edx], eax
cmp eax, dword [ebp - 0xc]
ja 0x461638
mov ecx, dword [ebp - 4]
push ecx
push edi
mov eax, dword [ebp - 0x10]
add eax, ebx
add eax, 0x28
push eax
call fcn.004603a4
add esp, 0xc
mov edx, dword [ebp - 4]
add dword [ebx + 0x38], edx
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [ecx], eax
xor eax, eax
jmp 0x46171a
cmp edi, esi
jne 0x461646
mov eax, 0x1001
jmp 0x46171a
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x10]
push ecx
push edi
mov eax, dword [ebp - 0x10]
add eax, ebx
add eax, 0x28
push eax
call fcn.004603a4
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
sub edx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x10]
add edi, edx
add esp, 0xc
sub dword [ebp - 4], ecx
lea edx, [ebx + 0x18]
mov eax, dword [ebp - 8]
call fcn.0046278c
mov ecx, dword [ebx + 0x18]
xor ecx, dword [ebx + 0x28]
mov dword [esi], ecx
mov eax, dword [ebx + 0x1c]
xor eax, dword [ebx + 0x2c]
mov dword [esi + 4], eax
mov edx, dword [ebx + 0x20]
xor edx, dword [ebx + 0x30]
mov dword [esi + 8], edx
mov ecx, dword [ebx + 0x24]
xor ecx, dword [ebx + 0x34]
mov dword [esi + 0xc], ecx
add esi, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jbe 0x4616f0
lea edx, [ebx + 0x18]
mov eax, dword [ebp - 8]
call fcn.0046278c
mov edx, dword [edi]
xor edx, dword [ebx + 0x18]
mov dword [esi], edx
mov ecx, dword [edi + 4]
xor ecx, dword [ebx + 0x1c]
mov dword [esi + 4], ecx
mov eax, dword [edi + 8]
xor eax, dword [ebx + 0x20]
mov dword [esi + 8], eax
mov edx, dword [edi + 0xc]
xor edx, dword [ebx + 0x24]
mov dword [esi + 0xc], edx
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
sub dword [ebp - 4], edx
add edi, eax
mov ecx, dword [ebp - 4]
add esi, eax
cmp ecx, dword [ebp - 0xc]
ja 0x4616ae
mov eax, dword [ebp - 4]
lea edx, [ebx + 0x28]
push eax
push edi
push edx
call fcn.004603a4
add esp, 0xc
mov ecx, dword [ebx + 0x38]
and ecx, 0xf0000000
add ecx, dword [ebp - 4]
mov dword [ebx + 0x38], ecx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
sub dword [eax], edx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x461724
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, eax
push esi
push edi
mov dword [ebp - 4], ecx
lea eax, [ebx + 0x3c]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0x10
mov esi, edx
mov edx, dword [ebx + 0x38]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
add eax, dword [ebp - 4]
mov dword [edx], eax
cmp eax, dword [ebp - 0xc]
ja 0x461784
mov ecx, dword [ebp - 4]
push ecx
push esi
mov eax, dword [ebp - 0x10]
add eax, ebx
add eax, 0x28
push eax
call fcn.004603a4
add esp, 0xc
mov edx, dword [ebp - 4]
add dword [ebx + 0x38], edx
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [ecx], eax
xor eax, eax
jmp 0x461895
cmp esi, edi
jne 0x461792
mov eax, 0x1001
jmp 0x461895
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x10]
push ecx
push esi
mov eax, dword [ebp - 0x10]
add eax, ebx
add eax, 0x28
push eax
call fcn.004603a4
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
sub edx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x10]
add esi, edx
add esp, 0xc
sub dword [ebp - 4], ecx
lea edx, [ebx + 0x18]
mov eax, dword [ebp - 8]
call fcn.0046278c
mov ecx, dword [ebx + 0x18]
xor ecx, dword [ebx + 0x28]
mov dword [edi], ecx
mov eax, dword [ebx + 0x1c]
xor eax, dword [ebx + 0x2c]
mov dword [edi + 4], eax
mov edx, dword [ebx + 0x20]
xor edx, dword [ebx + 0x30]
mov dword [edi + 8], edx
mov ecx, dword [ebx + 0x24]
xor ecx, dword [ebx + 0x34]
mov dword [edi + 0xc], ecx
mov eax, dword [ebx + 0x28]
mov dword [ebx + 0x18], eax
mov edx, dword [ebx + 0x2c]
mov dword [ebx + 0x1c], edx
mov ecx, dword [ebx + 0x30]
mov dword [ebx + 0x20], ecx
mov eax, dword [ebx + 0x34]
mov dword [ebx + 0x24], eax
add edi, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0xc]
jbe 0x46186b
lea edx, [ebx + 0x18]
mov eax, dword [ebp - 8]
call fcn.0046278c
mov ecx, dword [ebx + 0x18]
xor ecx, dword [esi]
mov dword [edi], ecx
mov eax, dword [ebx + 0x1c]
xor eax, dword [esi + 4]
mov dword [edi + 4], eax
mov edx, dword [ebx + 0x20]
xor edx, dword [esi + 8]
mov dword [edi + 8], edx
mov ecx, dword [ebx + 0x24]
xor ecx, dword [esi + 0xc]
mov dword [edi + 0xc], ecx
mov eax, dword [esi]
mov dword [ebx + 0x18], eax
mov edx, dword [esi + 4]
mov dword [ebx + 0x1c], edx
mov ecx, dword [esi + 8]
mov dword [ebx + 0x20], ecx
mov eax, dword [esi + 0xc]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
sub dword [ebp - 4], edx
add esi, eax
mov ecx, dword [ebp - 4]
add edi, eax
cmp ecx, dword [ebp - 0xc]
ja 0x461812
mov eax, dword [ebp - 4]
lea edx, [ebx + 0x28]
push eax
push esi
push edx
call fcn.004603a4
add esp, 0xc
mov ecx, dword [ebx + 0x38]
and ecx, 0xf0000000
add ecx, dword [ebp - 4]
mov dword [ebx + 0x38], ecx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
sub dword [eax], edx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x461a3c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, eax
mov dword [esp], ecx
mov edi, edx
mov edx, dword [esp]
mov esi, dword [ebx + 0x38]
lea eax, [ebx + 0x3c]
mov dword [edx], esi
lea edx, [ebx + 0x18]
call fcn.0046278c
xor ecx, ecx
mov edx, edi
lea eax, [ebx + 0x28]
cmp esi, ecx
jbe 0x461a73
mov bl, byte [eax]
inc ecx
xor bl, byte [eax - 0x10]
inc eax
mov byte [edx], bl
inc edx
cmp esi, ecx
ja 0x461a65
mov eax, dword [esp]
mov dword [eax], esi
xor eax, eax
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x468a84
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x468b0d
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, ebx
mov edx, dword [ebp - 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
cmp byte [esi + 0x30], 0
jne 0x468acb
lea edx, [ebp - 8]
mov eax, dword [ebx]
call fcn.00408c6c
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00404a90
lea edx, [ebp - 0xc]
mov eax, dword [esi + 0x34]
call fcn.00408f68
mov eax, dword [ebp - 0xc]
mov edx, dword [ebx]
call fcn.00405050
mov esi, eax
push ebx
mov ecx, esi
dec ecx
mov eax, dword [ebx]
mov edx, 1
call fcn.00404f6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x468b14
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404a60
ret
Function at 0x46c5c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, dword [ebp + 8]
mov eax, ebx
call fcn.00404a3c
lea eax, [ebp - 0x105]
xor ecx, ecx
mov edx, 0x105
call fcn.0040358c
push 0
push edi
lea eax, [ebp - 0x105]
push eax
push esi
call sub.shell32.dll_SHGetSpecialFolderPathA
mov edx, ebx
lea eax, [ebp - 0x105]
call fcn.00409c54
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x46d384
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push esi
push edi
test dl, dl
je 0x46d393
add esp, 0xfffffff0
call fcn.00403fc8
mov ebx, edx
mov edi, eax
xor edx, edx
mov eax, edi
call fcn.0046cac0
push 0x46d538
call sub.kernel32.dll_LoadLibraryA
mov esi, eax
mov dword [edi + 0x8c], esi
test esi, esi
jne 0x46d3cc
mov ecx, 0x46d54c
mov dl, 1
mov eax, dword [0x407f80]
call fcn.0040d238
call fcn.00404430
push 0x46d564
mov eax, dword [edi + 0x8c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0x94], eax
push 0x46d574
mov eax, dword [edi + 0x8c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0x98], eax
push 0x46d588
mov eax, dword [edi + 0x8c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0x9c], eax
push 0x46d590
mov eax, dword [edi + 0x8c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0xa0], eax
push 0x46d5a0
mov eax, dword [edi + 0x8c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0xa4], eax
push 0x46d5ac
mov eax, dword [edi + 0x8c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0xa8], eax
cmp dword [edi + 0x94], 0
jne 0x46d475
mov ecx, 0x46d5c4
mov dl, 1
mov eax, dword [0x407f80]
call fcn.0040d238
call fcn.00404430
cmp dword [edi + 0x98], 0
jne 0x46d494
mov ecx, 0x46d5c4
mov dl, 1
mov eax, dword [0x407f80]
call fcn.0040d238
call fcn.00404430
cmp dword [edi + 0x9c], 0
jne 0x46d4b3
mov ecx, 0x46d5c4
mov dl, 1
mov eax, dword [0x407f80]
call fcn.0040d238
call fcn.00404430
cmp dword [edi + 0xa0], 0
jne 0x46d4d2
mov ecx, 0x46d5c4
mov dl, 1
mov eax, dword [0x407f80]
call fcn.0040d238
call fcn.00404430
cmp dword [edi + 0xa4], 0
jne 0x46d4f1
mov ecx, 0x46d5c4
mov dl, 1
mov eax, dword [0x407f80]
call fcn.0040d238
call fcn.00404430
cmp dword [edi + 0xa8], 0
jne 0x46d510
mov ecx, 0x46d5c4
mov dl, 1
mov eax, dword [0x407f80]
call fcn.0040d238
call fcn.00404430
call dword [edi + 0x94]
mov dword [edi + 0x90], eax
mov eax, edi
test bl, bl
je 0x46d531
call fcn.00404020
pop dword fs:[0]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x46d74c
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push esi
push edi
test dl, dl
je 0x46d75b
add esp, 0xfffffff0
call fcn.00403fc8
mov ebx, edx
mov edi, eax
mov dl, 1
mov eax, dword [0x46d32c]
call fcn.0046d384
mov dword [edi + 0x28], eax
mov eax, dword [0x4841a0]
call fcn.00404f0c
push eax
call sub.kernel32.dll_LoadLibraryA
mov esi, eax
mov dword [edi + 4], esi
test esi, esi
jne 0x46d79d
mov ecx, 0x46d888
mov dl, 1
mov eax, dword [0x407f80]
call fcn.0040d238
call fcn.00404430
push 0x46d890
mov eax, dword [edi + 4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0x4c], eax
push 0x46d8a0
mov eax, dword [edi + 4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0x50], eax
push 0x46d8bc
mov eax, dword [edi + 4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0x54], eax
push 0x46d8d4
mov eax, dword [edi + 4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0x58], eax
push 0x46d8ec
mov eax, dword [edi + 4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0x5c], eax
cmp dword [edi + 0x4c], 0
jne 0x46d80e
mov ecx, 0x46d908
mov dl, 1
mov eax, dword [0x407f80]
call fcn.0040d238
call fcn.00404430
cmp dword [edi + 0x50], 0
jne 0x46d82a
mov ecx, 0x46d908
mov dl, 1
mov eax, dword [0x407f80]
call fcn.0040d238
call fcn.00404430
cmp dword [edi + 0x54], 0
jne 0x46d846
mov ecx, 0x46d908
mov dl, 1
mov eax, dword [0x407f80]
call fcn.0040d238
call fcn.00404430
cmp dword [edi + 0x5c], 0
jne 0x46d862
mov ecx, 0x46d908
mov dl, 1
mov eax, dword [0x407f80]
call fcn.0040d238
call fcn.00404430
mov eax, edi
test bl, bl
je 0x46d877
call fcn.00404020
pop dword fs:[0]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x46dde0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x4166b4]
call fcn.004053dc
xor eax, eax
push ebp
push 0x46df24
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4841a4], 0
jne 0x46de33
mov ecx, dword [0x484320]
mov dl, 1
mov eax, dword [0x407f80]
call fcn.0040d2f4
call fcn.00404430
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.0040358c
mov eax, ebx
call fcn.00405288
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x46df34
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.004065ac
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00405298
test eax, eax
jle 0x46decb
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x46dec4
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404cd4
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404cbc
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408e74
test eax, eax
jne 0x46dec4
mov ebx, 0x15
jmp 0x46ded0
mov ebx, 0x10
jmp 0x46ded0
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x4841a4]
call fcn.0046dd38
mov eax, dword [ebp - 8]
call fcn.0046dd38
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.004065c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46df2b
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404a60
lea eax, [ebp - 0x10]
mov edx, dword [0x4166b4]
call fcn.004054ac
ret
Function at 0x401d10
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [esp + 0x24]
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.00401d70
Function at 0x402710
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x402748
xor edx, edx
nop
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
ja 0x40273e
add ecx, dword [eax + 8]
cmp ebx, ecx
jb 0x40274a
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x402730
xor eax, eax
pop ebx
pop esi
ret
Function at 0x40901b8a
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
lea eax, [ebp - 8]
push edi
xor ebx, ebx
push eax
push ebx
push 8
mov byte [ebp - 0x18], bl
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], bl
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], bl
mov byte [ebp - 0x13], 5
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40901be6
call esi
cmp eax, 0x3f0
jne 0x40901c4b
lea eax, [ebp - 8]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40901c4b
lea eax, [ebp - 4]
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push eax
push ebx
push ebx
push 2
push dword [ebp - 8]
call edi
test eax, eax
jne 0x40901c4b
call esi
cmp eax, 0x7a
jne 0x40901c4b
mov eax, dword [ebp - 4]
add eax, 3
and al, 0xfc
call fcn.40905890
mov esi, esp
cmp esi, ebx
je 0x40901c4b
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push esi
push 2
push dword [ebp - 8]
call edi
test eax, eax
je 0x40901c4b
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
lea eax, [ebp - 0x18]
push 2
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x40901c4f
xor eax, eax
jmp 0x40901c87
xor edi, edi
cmp dword [esi], ebx
mov dword [ebp - 0x10], ebx
jbe 0x40901c7b
lea ebx, [esi + 4]
push dword [ebp - 0xc]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x40901c74
inc edi
add ebx, 8
cmp edi, dword [esi]
jb 0x40901c5b
jmp 0x40901c7b
mov dword [ebp - 0x10], 1
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x10]
lea esp, [ebp - 0x24]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40901c8f
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x324
push esi
push edi
lea eax, [ebp - 0x114]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esi, 0x409011f8
mov edi, dword [sym.imp.MSVCRT.dll_sprintf]
push esi
lea eax, [ebp - 0x324]
push dword [ebp + 8]
push 0x409011f0
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x114]
push esi
push eax
lea eax, [ebp - 0x21c]
push 0x409011e8
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x21c]
push 0
push eax
lea eax, [ebp - 0x324]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x40901d20
xor eax, eax
lea edi, [ebp + 0xa]
and dword [ebp - 8], eax
mov dword [ebp - 0xc], 0x409011d0
stosw word es:[edi], ax
lea eax, [ebp - 0xc]
mov dword [ebp - 4], esi
push eax
push 2
push 0
call sub.WINSPOOL.DRV_AddMonitorA
pop edi
pop esi
leave
ret 4
Function at 0x40901fc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 4], 1
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
jne 0x40901fdb
push 6
pop eax
jmp 0x40901ff3
lea ecx, [ebp - 4]
push ecx
push dword [ebp + 8]
push 0
push 0
push dword [esi + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [esi + 0xc], eax
pop esi
leave
ret 4

Function at 0x40901ff8
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], 1
call sym.LEXINST.dll_protected:_long_int___thiscall_CRegistry::createKey_void_
test eax, eax
mov dword [esi + 0xc], eax
jne 0x4090204e
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push edi
push 0
push 0
push dword [esi + 4]
push dword [esi + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov dword [esi + 0xc], eax
je 0x4090204e
push dword [ebp - 4]
mov al, byte [ebp + 0xc]
mov byte [edi], al
push edi
push 3
push 0
push dword [esi + 4]
push dword [esi + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
pop edi
pop esi
leave
ret 8

Function at 0x40902057
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 8]
push esi
mov esi, ecx
mov byte [ebp + 8], al
call sym.LEXINST.dll_protected:_long_int___thiscall_CRegistry::createKey_void_
test eax, eax
mov dword [esi + 0xc], eax
jne 0x40902088
lea eax, [ebp + 8]
push 1
push eax
push 3
push 0
push dword [esi + 4]
push dword [esi + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
pop esi
pop ebp
ret 4

Function at 0x409020f9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 4], 4
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
jne 0x40902114
push 6
pop eax
jmp 0x4090212c
lea ecx, [ebp - 4]
push ecx
push dword [ebp + 8]
push 0
push 0
push dword [esi + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [esi + 0xc], eax
pop esi
leave
ret 4

Function at 0x40902131
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], 4
call sym.LEXINST.dll_protected:_long_int___thiscall_CRegistry::createKey_void_
test eax, eax
mov dword [esi + 0xc], eax
jne 0x40902187
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push edi
push 0
push 0
push dword [esi + 4]
push dword [esi + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov dword [esi + 0xc], eax
je 0x40902187
push dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [edi], eax
push edi
push 4
push 0
push dword [esi + 4]
push dword [esi + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
pop edi
pop esi
leave
ret 8