joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403eb0
Capabilities:
Get session user name

Disassembly:
sub esp, 0xd4
mov eax, dword [0x421420]
xor eax, esp
mov dword [esp + 0xd0], eax
push ebx
push esi
push edi
push str.ALLUSERSPROFILE
call fcn.0040ad73
add esp, 4
mov edi, eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x14], 0x64
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [esp + 0x14]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x403ef5
sub eax, edx
lea edx, [esp + 0x14]
push edx
mov ebx, eax
call fcn.00401200
mov esi, eax
add esp, 4
test esi, esi
jge 0x403f17
neg esi
push 0x64
lea eax, [esp + 0x7c]
push 0
push eax
call fcn.0040fa70
push esi
lea ecx, [esp + 0x88]
push 0x41da20
push ecx
call fcn.00409c4f
lea eax, [esp + 0x2c]
add esp, 0x18
xor edx, edx
lea esi, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x403f44
sub eax, esi
je 0x403f76
cmp byte [esp + edx + 0x14], 0x80
jb 0x403f5d
mov byte [esp + edx + 0x14], 0x5f
lea eax, [esp + 0x14]
add edx, 1
lea esi, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x403f67
sub eax, esi
cmp edx, eax
jb 0x403f51
push 0x1388
call fcn.004095e0
mov ebx, eax
mov eax, edi
add esp, 4
mov byte [ebx], 0
mov esi, eax
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x403f90
mov edi, ebx
sub eax, esi
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x403fa0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, str.JWUser_
mov eax, ebx
call fcn.004015e0
lea eax, [esp + 0x78]
mov esi, eax
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x403fd0
mov edi, ebx
sub eax, esi
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x403fe0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
add edi, 0xffffffff
lea ecx, [ecx]
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x404000
mov dx, word [0x41d088]
lea eax, [esp + 0x14]
mov word [edi], dx
mov esi, eax
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x404020
mov edi, ebx
sub eax, esi
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x404030
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
mov eax, ebx
rep movsb byte es:[edi], byte [esi]
call section..text
mov esi, eax
test esi, esi
je 0x404091
mov eax, dword [esi]
or edi, 0xffffffff
cmp eax, 0xffffffff
je 0x40406a
push eax
call fcn.00409ac2
add esp, 4
mov edi, eax
mov eax, dword [esi + 0x134]
push eax
call fcn.00409503
push esi
call fcn.00409503
add esp, 8
cmp edi, 0xffffffff
jne 0x40409a
call fcn.004097b9
mov dword [eax], 9
jmp 0x40409a
push ebx
call fcn.0040a5d0
add esp, 4
mov ecx, dword [esp + 0xdc]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.004094f4
add esp, 0xd4
ret
Function at 0x407990
Capabilities:
Check mutex on windows
Create thread

Disassembly:
sub esp, 0x2c
push ebx
push esi
push edi
push 0x24
mov edi, eax
call fcn.004095e0
mov ebx, dword [sym.imp.KERNEL32.dll_CreateMutexA]
add esp, 4
push 0
push 0
push 0
mov esi, eax
call ebx
push 0
push 0
push 0
mov dword [esi], eax
call ebx
mov dword [esi + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [esi + 8], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], eax
mov dword [esi + 0xc], 0
call fcn.00407d00
push 0
push 0
push 1
push 0
mov dword [esi + 0x18], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [esi]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push ecx
mov dword [esi + 0x20], eax
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
lea edx, [esp + 0x24]
push edx
push 0
push esi
push 0x407910
push 0
push 0
call edi
mov dword [esp + 0x10], eax
lea eax, [esp + 0x28]
push eax
push 0
push esi
push 0x407650
push 0
push 0
call edi
lea ecx, [esp + 0x2c]
push ecx
push 0
push esi
push 0x407710
push 0
push 0
mov dword [esp + 0x2c], eax
call edi
lea edx, [esp + 0x30]
push edx
push 0
push esi
push 0x407810
push 0
push 0
mov dword [esp + 0x30], eax
call edi
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x34]
push eax
push 0
push esi
push 0x407890
push 0
push 0
call edi
mov ecx, dword [esi]
push ecx
mov dword [esp + 0x24], eax
mov dword [esi + 0x1c], 5
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edx, dword [esi + 0x20]
push 0xffffffffffffffff
push edx
call ebx
mov eax, dword [esi + 8]
push eax
push str._HttpDownloader__Download_Tasks_Complete___success_d__n
call fcn.0040a3e4
call fcn.00409d61
add eax, 0x20
push eax
call fcn.0040a0f5
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0xc
xor edi, edi
lea esp, [esp]
mov ecx, dword [esp + edi*4 + 0x10]
push ecx
call ebx
add edi, 1
cmp edi, 5
jl 0x407ac0
mov eax, dword [esi + 8]
pop edi
pop esi
pop ebx
add esp, 0x2c
ret

Function at 0x407ae0
Capabilities:
Delete file

Disassembly:
push edi
mov edi, dword [0x42f6dc]
cmp dword [edi], 0
jne 0x407af5
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
ret
push esi
push 0x41cf88
push eax
call fcn.0040a56d
mov esi, eax
add esp, 8
test esi, esi
je 0x407b41
mov eax, dword [edi]
test eax, eax
je 0x407b38
push esi
push eax
call fcn.0040b716
add esp, 8
cmp dword [edi + 4], 0
je 0x407b38
push esi
push 0x41f468
call fcn.0040b716
mov eax, dword [edi + 4]
push esi
push eax
call fcn.0040b716
add esp, 0x10
push esi
call fcn.0040ae69
add esp, 4
pop esi
pop edi
ret
Function at 0x407b50
Capabilities:
Initialize winhttp library

Disassembly:
sub esp, 0x2c
push ebx
push ebp
push esi
push edi
mov edi, edx
mov esi, eax
mov ebx, ecx
call fcn.00409260
mov ebp, eax
xor eax, eax
push str._Proxy__Opening_HTTP_Session_n
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call fcn.0040a3e4
call fcn.00409d61
add eax, 0x20
push eax
call fcn.0040a0f5
add esp, 8
push 0
push 0
push 0
push 1
push str.JWrapper_Proxy_Detector_1.0
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov edi, eax
test edi, edi
je 0x407cee
test ebx, ebx
mov dword [esp + 0x20], 1
je 0x407bf5
push ebx
push str._Proxy__Using_auto_config_URL:__S_n
mov dword [esp + 0x28], 3
call fcn.0040a3e4
add esp, 8
mov dword [esp + 0x28], ebx
push ebp
push str._Proxy__Attempting_to_detect_proxy_for_URL__S_n
mov dword [esp + 0x2c], 3
mov dword [esp + 0x3c], 1
call fcn.0040a3e4
call fcn.00409d61
add eax, 0x20
push eax
call fcn.0040a0f5
add esp, 0xc
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x24]
push ecx
push ebp
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpGetProxyForUrl]
test eax, eax
je 0x407cb0
push str._Proxy__Configuration_found_n
call fcn.0040a3e4
call fcn.00409d61
add eax, 0x20
push eax
call fcn.0040a0f5
add esp, 8
cmp dword [esp + 0x14], 1
jne 0x407c68
push str._Proxy__Direct_connection_used_n
call fcn.0040a3e4
add esp, 4
jmp 0x407ccb
mov edx, dword [esp + 0x18]
push edx
push str._Proxy___S_n
call fcn.0040a3e4
mov eax, dword [esp + 0x24]
push eax
push str._Proxy___S_n
call fcn.0040a3e4
call fcn.00409d61
add eax, 0x20
push eax
call fcn.0040a0f5
mov ebx, dword [esp + 0x2c]
add esp, 0x14
call fcn.004092c0
mov ebx, dword [esp + 0x1c]
mov dword [esi], eax
call fcn.004092c0
mov dword [esi + 4], eax
jmp 0x407ccb
push str._Proxy__Configuration_NOT_found_n
call fcn.0040a3e4
call fcn.00409d61
add eax, 0x20
push eax
call fcn.0040a0f5
add esp, 8
mov eax, dword [esp + 0x18]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_GlobalFree]
je 0x407cdc
push eax
call esi
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x407ce7
push eax
call esi
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
push ebp
call fcn.00409503
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
Function at 0x407ed0
Capabilities:
Create process on windows

Disassembly:
mov eax, 0xc3b8
call fcn.004180a0
mov eax, dword [0x421420]
xor eax, esp
mov dword [esp + 0xc3b0], eax
push ebp
push esi
push edi
push str._Spawner__Constructing_command_line..._n
call fcn.0040a3e4
call fcn.00409d61
add eax, 0x20
push eax
call fcn.0040a0f5
mov eax, dword [ebx]
add esp, 8
xor ebp, ebp
test eax, eax
mov byte [esp + 0x68], 0
je 0x407f9a
jmp 0x407f20
lea edi, [esp + 0x68]
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x407f27
mov cx, word [0x41d0cc]
mov word [edi], cx
mov ecx, eax
lea ecx, [ecx]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x407f40
lea edi, [esp + 0x68]
sub eax, ecx
mov esi, ecx
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x407f54
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x68]
rep movsb byte es:[edi], byte [esi]
add eax, 0xffffffff
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x407f73
mov dx, word [0x41f6b8]
mov cl, byte [0x41f6ba]
mov word [eax], dx
add ebp, 1
mov byte [eax + 2], cl
mov eax, dword [ebx + ebp*4]
test eax, eax
jne 0x407f20
lea edx, [esp + 0x68]
push edx
push str._Spawner__Creating_command_line__s_n
call fcn.0040a3e4
call fcn.00409d61
add eax, 0x20
push eax
call fcn.0040a0f5
push 0x44
lea eax, [esp + 0x30]
push 0
push eax
call fcn.0040fa70
add esp, 0x18
xor eax, eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x24]
push edx
push eax
push eax
push eax
push 1
push eax
push eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x88]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40803c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateProcess_failed___d_._n
call fcn.0040a3e4
call fcn.00409d61
add eax, 0x20
push eax
call fcn.0040a0f5
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0xc3b0]
xor ecx, esp
call fcn.004094f4
add esp, 0xc3b8
ret
mov ecx, dword [esp + 0x10]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0x14]
push edx
call esi
mov eax, dword [esp + 0xc]
push eax
push str._Spawner__runSpawnerAndWait_returned__d_n
call fcn.0040a3e4
mov ecx, dword [esp + 0xc3c4]
mov eax, dword [esp + 0x14]
add esp, 8
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.004094f4
add esp, 0xc3b8
ret
Function at 0x4080a0
Capabilities:
Create process on windows

Disassembly:
mov eax, 0xc3b8
call fcn.004180a0
mov eax, dword [0x421420]
xor eax, esp
mov dword [esp + 0xc3b0], eax
push ebp
push esi
push edi
push str._Spawner__Constructing_command..._n
mov byte [esp + 0x6c], 0
call fcn.0040a3e4
call fcn.00409d61
add eax, 0x20
push eax
call fcn.0040a0f5
mov eax, dword [ebx]
add esp, 8
xor ebp, ebp
test eax, eax
je 0x40816a
jmp 0x4080f0
lea edi, [esp + 0x68]
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x4080f7
mov cx, word [0x41d0cc]
mov word [edi], cx
mov ecx, eax
lea ecx, [ecx]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x408110
lea edi, [esp + 0x68]
sub eax, ecx
mov esi, ecx
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x408124
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x68]
rep movsb byte es:[edi], byte [esi]
add eax, 0xffffffff
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x408143
mov dx, word [0x41f6b8]
mov cl, byte [0x41f6ba]
mov word [eax], dx
add ebp, 1
mov byte [eax + 2], cl
mov eax, dword [ebx + ebp*4]
test eax, eax
jne 0x4080f0
lea edx, [esp + 0x68]
push edx
push str._Spawner__Executing_command__s_n
call fcn.0040a3e4
call fcn.00409d61
add eax, 0x20
push eax
call fcn.0040a0f5
push 0x44
lea eax, [esp + 0x30]
push 0
push eax
call fcn.0040fa70
add esp, 0x18
xor eax, eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x24]
push edx
push eax
push eax
push eax
push 1
push eax
push eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x88]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40820c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateProcess_failed___d_._n
call fcn.0040a3e4
call fcn.00409d61
add eax, 0x20
push eax
call fcn.0040a0f5
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0xc3b0]
xor ecx, esp
call fcn.004094f4
add esp, 0xc3b8
ret
push str._Spawner__Create_process_seems_to_have_worked_n
call fcn.0040a3e4
call fcn.00409d61
add eax, 0x20
push eax
call fcn.0040a0f5
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 8
push ecx
call esi
mov edx, dword [esp + 0x14]
push edx
call esi
mov ecx, dword [esp + 0xc3bc]
pop edi
pop esi
pop ebp
xor ecx, esp
xor eax, eax
call fcn.004094f4
add esp, 0xc3b8
ret

Function at 0x408440
Capabilities:
Create thread

Disassembly:
cmp dword [0x422800], 0
push 0
jne 0x4084a4
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0x422804
push 0
push 0x422800
push 0x408550
push 0
push 0
mov dword [0x422808], eax
call fcn.0040bc67
add esp, 0x18
mov dword [0x422800], eax
mov eax, dword [0x422808]
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4084b5
push str.Error_starting_SplashThread_n
call fcn.0040a3e4
add esp, 4
ret
mov ecx, dword [0x422804]
push 2
push 6
push ecx
call dword [sym.imp.USER32.dll_PostThreadMessageA]
ret
Function at 0x4084e0
Capabilities:
Terminate thread

Disassembly:
cmp dword [0x422800], 0
je 0x40853f
mov eax, dword [0x422804]
push 0
push 0
push 0x12
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageA]
mov ecx, dword [0x422800]
push 0x2328
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x408526
mov edx, dword [0x422800]
push 0x8ae
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [0x422800]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [0x422808]
push ecx
call esi
pop esi
mov dword [0x422800], 0
ret

Function at 0x4094f4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x421420]
jne 0x4094fe
repz ret
jmp fcn.0040bf3a

Function at 0x409edc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x409f09
call fcn.004097cc
mov dword [eax], esi
call fcn.004097b9
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0040d871
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x409ee5
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x409f38
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004097df
pop ecx
call fcn.004097b9
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x409f5f
test al, 1
je 0x409f5f
test byte [esp + 0xc], 2
je 0x409f5f
call fcn.004097cc
mov dword [eax], 5
call fcn.004097b9
mov dword [eax], 0xd
jmp 0x409f2f
xor eax, eax
pop esi
ret
Function at 0x412b75
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0040d1fe
xor ebx, ebx
cmp dword [0x423264], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x412c4a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x412bb5
xor eax, eax
jmp 0x412d0e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x412bae
push eax
call fcn.0040d19b
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x423264], eax
call esi
push eax
call fcn.0040d19b
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x423268], eax
call esi
push eax
call fcn.0040d19b
mov dword [0x42326c], eax
lea eax, [ebp - 8]
push eax
call fcn.0040afca
test eax, eax
pop ecx
pop ecx
je 0x412c18
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040d775
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x412c4a
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0040d19b
cmp eax, ebx
pop ecx
mov dword [0x423274], eax
je 0x412c4a
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040d19b
pop ecx
mov dword [0x423270], eax
mov eax, dword [0x423270]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x412cc3
cmp dword [0x423274], esi
je 0x412cc3
push eax
call fcn.0040d207
pop ecx
call eax
cmp eax, ebx
je 0x412c90
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x423274]
call fcn.0040d207
pop ecx
call eax
test eax, eax
je 0x412c90
test byte [ebp - 0x18], 1
jne 0x412cc3
lea eax, [ebp - 0xc]
push eax
call fcn.0040b001
test eax, eax
pop ecx
je 0x412cab
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040d775
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x412cba
or dword [ebp + 0x10], 0x200000
jmp 0x412cf4
or dword [ebp + 0x10], 0x40000
jmp 0x412cf4
mov eax, dword [0x423268]
cmp eax, esi
je 0x412cf4
push eax
call fcn.0040d207
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x412cf4
mov eax, dword [0x42326c]
cmp eax, esi
je 0x412cf4
push dword [ebp - 4]
push eax
call fcn.0040d207
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x423264]
call fcn.0040d207
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403711
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41ba40]
jne 0x40371b
repz ret
jmp fcn.004086eb

Function at 0x40cf6c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00409698
and dword [ebp - 4], 0
cmp dword [0x46f878], 0
mov ebx, eax
jne 0x40d01d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40d0ce
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x415234
push edi
call esi
test eax, eax
je 0x40d0ce
push eax
call fcn.00409626
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x46f878], eax
call esi
push eax
call fcn.00409626
mov dword [esp], 0x415210
push edi
mov dword [0x46f87c], eax
call esi
push eax
call fcn.00409626
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x46f880], eax
call esi
push eax
call fcn.00409626
pop ecx
mov dword [0x46f888], eax
test eax, eax
je 0x40d01d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00409626
pop ecx
mov dword [0x46f884], eax
mov eax, dword [0x46f884]
cmp eax, ebx
je 0x40d075
cmp dword [0x46f888], ebx
je 0x40d075
push eax
call fcn.004096a1
push dword [0x46f888]
mov esi, eax
call fcn.004096a1
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40d075
test edi, edi
je 0x40d075
call esi
test eax, eax
je 0x40d06c
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40d06c
test byte [ebp - 0xc], 1
jne 0x40d075
or dword [ebp + 0x10], 0x200000
jmp 0x40d0ae
mov eax, dword [0x46f87c]
cmp eax, ebx
je 0x40d0ae
push eax
call fcn.004096a1
pop ecx
test eax, eax
je 0x40d0ae
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40d0ae
mov eax, dword [0x46f880]
cmp eax, ebx
je 0x40d0ae
push eax
call fcn.004096a1
pop ecx
test eax, eax
je 0x40d0ae
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x46f878]
call fcn.004096a1
pop ecx
test eax, eax
je 0x40d0ce
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40d0d0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1feb46c0
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword [esp + 8]
cmp eax, 1
jne 0x1feb47af
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp dword [0x1feb8040], 0
mov dword [0x1feb8050], eax
jne 0x1feb471f
cmp al, 3
jne 0x1feb46f6
test eax, 0x80000000
je 0x1feb46f6
push 2
call fcn.1feb5480
add esp, 4
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x1feb471f
push str.IsTNT
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1feb471f
push 1
call fcn.1feb5480
add esp, 4
call fcn.1feb4a20
test eax, eax
jne 0x1feb472d
xor eax, eax
ret 0xc
xor edx, edx
mov ecx, dword [0x1feb8050]
mov dl, ch
mov eax, ecx
shr ecx, 0x10
and eax, 0xff
mov dword [0x1feb805c], edx
mov dword [0x1feb8058], eax
shl eax, 8
mov dword [0x1feb8050], ecx
add eax, edx
mov dword [0x1feb8054], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x1feb8e14], eax
call fcn.1feb52f0
cmp dword [0x1feb8e14], 0
mov dword [0x1feb8030], eax
je 0x1feb47a5
test eax, eax
je 0x1feb47a5
call fcn.1feb4aa0
call fcn.1feb52e0
call fcn.1feb4da0
call fcn.1feb4cb0
call fcn.1feb48f0
inc dword [0x1feb802c]
mov eax, 1
ret 0xc
call fcn.1feb4a60
xor eax, eax
ret 0xc
test eax, eax
jne 0x1feb479d
mov eax, dword [0x1feb802c]
test eax, eax
jle 0x1feb47e2
dec eax
cmp dword [0x1feb8088], 0
mov dword [0x1feb802c], eax
jne 0x1feb47d0
call fcn.1feb4940
call fcn.1feb4c80
call fcn.1feb4a60
mov eax, 1
ret 0xc
xor eax, eax
ret 0xc

Function at 0x1feb4950
Capabilities:
Terminate process

Disassembly:
cmp dword [0x1feb808c], 1
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
jne 0x1feb496e
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x1feb8088], 1
cmp dword [esp + 0x14], 0
mov ebx, dword [esp + 0x18]
mov byte [0x1feb8084], bl
jne 0x1feb49c8
cmp dword [0x1feb8e0c], 0
je 0x1feb49b6
mov edi, dword [0x1feb8e08]
sub edi, 4
cmp edi, dword [0x1feb8e0c]
jb 0x1feb49b6
mov eax, dword [edi]
test eax, eax
je 0x1feb49ab
call eax
sub edi, 4
cmp edi, dword [0x1feb8e0c]
jae 0x1feb49a3
push 0x1feb8014
push 0x1feb8010
call fcn.1feb4a00
add esp, 8
push 0x1feb801c
push 0x1feb8018
call fcn.1feb4a00
add esp, 8
test ebx, ebx
jne 0x1feb49ef
mov dword [0x1feb808c], 1
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
pop ebx
ret