joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402990
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov dword [0x405130], eax
mov ecx, ebp
add ecx, 8
mov dword [0x40507c], ecx
mov dword [0x4050b0], 0x30
mov dword [0x4050b4], 2
mov dword [0x4050bc], 0
mov dword [0x4050c0], 0
mov dword [0x4050b8], 0x402f20
jmp 0x4029e3
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [0x4050c4], eax
mov dword [0x4050d0], 0xf
mov dword [0x4050d8], 0x4040ad
mov dword [0x405074], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4050c8], eax
mov dword [0x4050dc], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4050cc], eax
push 0x4050b0
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x405074]
push 0
push 0
push 0x24e
push 0x281
push 0xfffff448
push 0xffffec78
push 0x40000
push str.mini
push str.second
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x405128], eax
xor eax, eax
jmp 0x402a82
push 5
push dword [0x405128]
call dword [sym.imp.user32.dll_ShowWindow]
test eax, eax
jne 0x402ab6
push 0
push 0x24f
push 0x282
push 0xfffff447
push 0xffffec77
push dword [0x405128]
call dword [sym.imp.user32.dll_MoveWindow]
push dword [0x405128]
call dword [sym.imp.user32.dll_UpdateWindow]
push 0
push 0
push 0
push 0x4050e0
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x402aef
push 0x4050e0
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x4050e0
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x402ac2
mov eax, dword [0x4050e8]
jmp 0x402afc
call 0x40213f
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1001ff6
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x28
push 0x10013f0
call fcn.01002194
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x1002031
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002031
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1002049
cmp eax, 0x20b
je 0x1002036
mov dword [ebp - 0x1c], edi
jmp 0x100205d
cmp dword [ecx + 0x84], 0xe
jbe 0x1002031
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x1002057
cmp dword [ecx + 0x74], 0xe
jbe 0x1002031
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x1004240], 0xffffffff
or dword [0x1004244], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1003234]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1003230]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x1004248], eax
call fcn.0100218e
cmp dword [0x1003200], edi
jne 0x10020b8
push fcn.0100218e
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.0100217c
push 0x10010f0
push 0x10010ec
call sub.msvcrt.dll__initterm
mov eax, dword [0x100322c]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x1003228]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x30], eax
push 0x10010e8
push 0x10010e4
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x24]
mov ecx, dword [sym.imp.msvcrt.dll___initenv]
mov dword [ecx], eax
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.0100143e
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x34], esi
cmp dword [ebp - 0x1c], edi
jne 0x100212f
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x1002164
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.010021cd
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10001561
Capabilities:
Encode data using xor

Disassembly:
das
inc eax
inc eax
inc eax
inc esp
inc esp
inc esp
inc esp
inc esp
inc esp
inc esp
xor al, byte [ebp + 0x382b4930]
cdq
sbb byte [eax], ah
xor al, 0xe8
push eax
or byte [ebx], 0
jbe 0x100016a3
cmp eax, 0x136
jbe 0x10001593
cmp eax, 0x138
std
pop esp
inc eax
add byte [edx], dl
cmp al, byte [eax]
cmp eax, 0x3ae1
add byte [0x3ae1], bh
jbe 0x100015a6
cmp eax, 0x138
std
pop esp
inc eax
add byte [edx], dl
cmp al, byte [eax]
cmp eax, 0x3ae1
add byte [0x3ae1], bh
jbe 0x100015b9
cmp eax, 0x138
adc byte [ebx], dh
imul esi, dword [eax + ebx*2], 0xffffffe8
cmp dword [eax], eax
add byte [eax], al
add byte [edx], al
pop ecx
mov dl, byte [ebp - 8]
xor al, byte [esp + eax*2 + 0x44]
inc esp
mov dword [0x10004058], eax
add byte [eax], dl
mov eax, dword [ebp + 0x14]
push edi
mov dword [0x1000405c], eax
xor ebp, dword [ebx + 0x34]
pop eax
call 0x67145b18
jge 0x100015cb
mov edi, 0xa7000008
les edx, [esi + 0x12303b2f]
sub al, 0x42
cmp dword [0x158b8921], 0x53007900
push ebx
dec eax
les eax, [edx]
add byte [eax], al
mov esi, 0xbf193440
cmp dword [eax], eax
add byte [eax], al
add byte [ecx], bl
pop ecx
mov dl, byte [ebp - 0x7b]
mov cl, 2
add byte [eax], al
mov al, byte [0x10003440]
mov ecx, esi
test al, al
je 0x10001693
xor edx, edx
inc edx
cmp al, 0x41
jne 0x10001625
mov edi, edx
cmp al, 0x46
jne 0x1000162f
mov dword [0x1000302c], edx
cmp al, 0x43
jne 0x10001639
mov dword [0x10003844], edx
inc ecx
mov al, byte [ecx]
test byte [edi], ch
inc eax
inc eax
inc eax
pop eax
call 0x100016d2
Function at 0x4a820cdc
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push dword [ebp + 8]
xor esi, esi
xor edi, edi
call fcn.4a820480
pop ecx
push esi
push 0x10000080
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4a820d16
xor al, al
jmp 0x4a820d94
push 1
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x4a820d58
push esi
push esi
push 1
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x4a820d58
push 0xc
pop edi
push edi
lea eax, [ebp - 0xc]
push esi
push eax
call sub.MSVCR80.dll_memset
lea eax, [ebp - 0x20]
mov dword [ebp - 0xc], edi
add esp, 0xc
mov dword [ebp - 8], eax
mov dword [ebp - 4], esi
lea edi, [ebp - 0xc]
push esi
push esi
push esi
push 2
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, eax
call ebx
cmp edi, esi
je 0x4a820d12
push esi
push esi
push esi
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, esi
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
jne 0x4a820d8f
push edi
call ebx
jmp 0x4a820d12
mov dword [ecx + 0x14], edi
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4a846c49
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a8a0518]
jne 0x4a846c53
repz ret
jmp fcn.4a84745c
Function at 0x4024a9
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x427c62
call fcn.004271f0
push ecx
push ecx
mov al, byte [ebp - 0xd]
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x14], esi
mov byte [esi], al
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x10]
push edi
mov dword [ebp - 4], edi
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x20]
push edi
mov byte [ebp - 4], 1
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x30]
push edi
mov byte [ebp - 4], 2
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x40]
push edi
mov byte [ebp - 4], 3
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x50]
push edi
mov byte [ebp - 4], 4
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x60]
push edi
mov byte [ebp - 4], 5
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x70]
push edi
mov byte [ebp - 4], 6
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x80]
push edi
mov byte [ebp - 4], 7
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x90]
push edi
mov byte [ebp - 4], 8
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0xa0]
push edi
mov byte [ebp - 4], 9
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x4026c0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x427d3b
call fcn.004271f0
push ecx
push ecx
mov al, byte [ebp - 0xd]
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x14], esi
mov byte [esi], al
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov al, byte [ebp - 0xd]
mov dword [ebp - 4], edi
mov byte [esi + 0x10], al
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x20]
push edi
mov byte [ebp - 4], 1
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x30]
push edi
mov byte [ebp - 4], 2
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x40b66e
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x42959d
call fcn.004271f0
push ecx
push ecx
mov al, byte [ebp - 0xd]
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x14], esi
push edi
mov byte [esi], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x10]
push edi
mov dword [ebp - 4], edi
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x20]
push edi
mov byte [ebp - 4], 1
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x30]
push edi
mov byte [ebp - 4], 2
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x40]
push edi
mov byte [ebp - 4], 3
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x50]
push edi
mov byte [ebp - 4], 4
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x60]
push edi
mov byte [ebp - 4], 5
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x70]
push edi
mov byte [ebp - 4], 6
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov cl, byte [ebp - 0xd]
lea eax, [esi + 0x80]
mov byte [eax], cl
mov cl, byte [ebp - 0xd]
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
lea eax, [esi + 0x90]
mov byte [eax], cl
mov ecx, dword [ebp - 0xc]
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x413989
Capabilities:
Get http content length

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 8]
push esi
push esi
push esi
push esi
push dword [edi]
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], 8
call dword [sym.imp.WININET.dll_HttpSendRequestW]
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp - 0xc]
push eax
push 0x20000005
push dword [edi]
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
pop edi
pop esi
leave
ret
Function at 0x417da4
Capabilities:
Get process heap force flags

Disassembly:
mov eax, 0x42af01
call fcn.004271f0
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
and dword [ebp - 4], 0
mov edi, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push esi
call edi
lea eax, [esi + 0x18]
push eax
call edi
lea eax, [esi + 0x30]
push eax
call edi
lea eax, [esi + 0x48]
push eax
call edi
lea eax, [esi + 0x60]
push eax
call edi
lea eax, [esi + 0x78]
push eax
call edi
lea eax, [esi + 0x90]
push eax
call edi
lea eax, [esi + 0xa8]
push eax
call edi
lea eax, [esi + 0xc0]
push eax
call edi
lea eax, [esi + 0xd8]
push eax
call edi
lea edi, [esi + 0x468]
mov dword [ebp - 0x14], edi
push 1
lea ecx, [edi + 0x10]
pop ebx
mov byte [ebp - 4], 9
push ebx
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
push ebx
mov ecx, edi
mov byte [ebp - 4], 8
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
lea ecx, [esi + 0x438]
mov byte [ebp - 4], 7
call fcn.00402e9d
lea edi, [esi + 0x418]
mov dword [ebp - 0x14], edi
push ebx
lea ecx, [edi + 0x10]
mov byte [ebp - 4], 0xa
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
push ebx
mov ecx, edi
mov byte [ebp - 4], 6
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
lea ecx, [esi + 0x3c8]
mov byte [ebp - 4], 5
call fcn.004043f3
lea edi, [esi + 0x3a8]
mov dword [ebp - 0x14], edi
mov byte [ebp - 4], 0xb
push ebx
lea ecx, [edi + 0x10]
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
push ebx
mov ecx, edi
mov byte [ebp - 4], 4
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
lea ecx, [esi + 0x348]
mov byte [ebp - 4], 3
call fcn.0040284f
lea ecx, [esi + 0x308]
mov byte [ebp - 4], 2
call fcn.0040272b
lea ecx, [esi + 0x2c8]
mov byte [ebp - 4], bl
call fcn.00402667
and byte [ebp - 4], 0
lea ecx, [esi + 0x218]
call fcn.004025a2
or dword [ebp - 4], 0xffffffff
lea ecx, [esi + 0xf0]
call fcn.004013a1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x419621
Capabilities:
Accept command line arguments

Disassembly:
mov eax, 0x42b12b
call fcn.004271f0
sub esp, 0x7d0
push ebx
lea eax, [ebp - 0x18]
push esi
xor ebx, ebx
push eax
mov byte [ebp - 0x14], bl
mov byte [ebp - 0x13], bl
mov byte [ebp - 0x12], bl
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x18]
push esi
call fcn.0041979f
add esp, 0xc
cmp byte [ebp - 0x14], bl
je 0x41966b
call fcn.00419815
push dword [ebp - 0x12]
lea ecx, [ebp - 0x7dc]
push dword [ebp + 8]
call fcn.0040150a
cmp byte [ebp - 0x13], bl
mov dword [ebp - 4], ebx
jne 0x4196c5
call fcn.00419978
test al, al
jne 0x4196c5
push dword [ebp - 0x18]
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.004199e4
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
push ebx
call fcn.004198ff
add esp, 0x14
mov byte [ebp - 4], bl
test al, al
push 1
lea ecx, [ebp - 0x28]
je 0x4196bf
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Tidy_bool_]
jmp 0x41971f
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Tidy_bool_]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push ebx
push ebx
call fcn.0041950f
push ebx
push ebx
push ebx
push 4
push 6
push ebx
push ebx
push 0xffffffffffffffff
push ebx
call fcn.00419545
add esp, 0x2c
lea eax, [ebp - 0x7dc]
lea ecx, [ebp - 0x264]
push eax
call fcn.00426884
push dword [ebp + 8]
mov byte [ebp - 4], 2
call fcn.00419740
pop ecx
call dword [sym.imp.ole32.dll_CoUninitialize]
call fcn.0041b933
lea ecx, [ebp - 0x264]
mov byte [ebp - 4], bl
call fcn.004268d5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7dc]
call fcn.0040165d
mov ecx, dword [ebp - 0xc]
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10
Function at 0x419815
Capabilities:
Terminate process

Disassembly:
mov eax, 0x42b153
call fcn.004271f0
sub esp, 0x23c
push esi
lea eax, [ebp - 0x248]
push 0x104
xor esi, esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov al, byte [ebp - 0xd]
push esi
lea ecx, [ebp - 0x20]
mov byte [ebp - 0x20], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Tidy_bool_]
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.MSVCRT.dll_wcslen]
pop ecx
push eax
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x20]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int______thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::assign_unsigned_short_int_const___unsigned_int_]
lea eax, [ebp - 0x20]
mov dword [ebp - 4], esi
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.0041b512
push str._test
push eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 1
push eax
call sub.MSVCP60.dll_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int_____cdecl_std::operator_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int___const___unsigned_short_int_const__
add esp, 0x14
push 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 4
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Tidy_bool_]
push 1
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 3
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Tidy_bool_]
mov eax, dword [ebp - 0x2c]
cmp eax, esi
jne 0x4198ba
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
push esi
push 0x80
push 2
push esi
push esi
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, esi
pop esi
je 0x4198dc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xfffffffffffffffb
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4198ff
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
lea eax, [ebp - 0x244]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x419974
push edi
push 0xf
pop ecx
xor eax, eax
lea edi, [ebp - 0x3c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x244]
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], str.runas
mov dword [ebp - 0x20], 1
mov eax, dword [eax + 4]
pop edi
test eax, eax
jne 0x41995f
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
neg eax
sbb eax, eax
neg eax
leave
ret
xor al, al
leave
ret