joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42c8f0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x28]
push ebx
push esi
mov esi, eax
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.0042c8c0
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x28], 0x40
lea esi, [esi]
add byte [ebp - 0x28], 1
lea eax, [ebp - 0x10]
call fcn.00403d00
push 0
mov al, byte [ebp - 0x28]
lea ecx, [ebp - 0x14]
xor dx, dx
call fcn.004094b0
mov edx, dword [ebp - 0x14]
mov ecx, 0x621264
lea eax, [ebp - 0x10]
call fcn.00408cc0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x42c970
mov eax, 0x6722f0
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x42c9f0
push 0
mov eax, str.._
mov dword [ebp - 0x20], eax
mov al, byte [ebp - 0x28]
lea ecx, [ebp - 0x24]
xor dx, dx
call fcn.004094b0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov eax, 0x621288
mov dword [ebp - 0x18], eax
lea edx, [ebp - 0x20]
lea eax, [ebp - 4]
mov ecx, 2
call fcn.00408f50
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0042c430
mov ebx, eax
mov dword [ebp - 0xc], 0
cmp ebx, 0xffffffff
je 0x42c9f0
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
mov edx, ebx
mov eax, esi
call fcn.0042c550
cmp dword [ebp - 0xc], 0
jne 0x42c9f0
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.0042c770
lea esi, [esi]
cmp byte [ebp - 0x28], 0x5a
jb 0x42c938
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.0042c8c0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42cd40
Capabilities:
Get common file path
Get session user name

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x24]
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x14], 0
xor eax, eax
push fcn.0042cd20
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0
call sub.advapi32.dll_GetUserNameA
mov eax, dword [ebp - 8]
call fcn.0045fbc0
mov dword [ebp - 0xc], eax
xor eax, eax
push fcn.0042cd10
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
call sub.advapi32.dll_GetUserNameA
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x14]
call fcn.0045fbb0
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
add eax, 0x10
call fcn.00408bc0
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.0042cd10
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0x5f4f90
call sub.shell32.dll_SHGetKnownFolderPath
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x14]
xor dx, dx
call fcn.0040b430
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
add eax, 0x14
call fcn.00408bc0
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x14]
call fcn.0042cb50
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
add eax, 0x18
call fcn.00408bc0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x18], eax
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
add eax, 4
mov ecx, 2
call fcn.00408f50
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [0x5f4cc0]
call fcn.0040cf30
mov ecx, eax
mov edx, dword [0x5f4cc0]
mov eax, 0x617d90
call fcn.00423b60
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
call fcn.0042c360
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
add eax, 4
call fcn.00408bc0
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.0042cd20
mov esp, ebp
pop ebp
ret
Function at 0x433620
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x224]
push ebx
push esi
push edi
mov esi, eax
mov edi, edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x218], 0
xor eax, eax
push fcn.00433600
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
xor edx, edx
call fcn.00408bc0
mov eax, dword [edi]
cmp byte [eax + 5], 0
je 0x433686
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x2a
push 0
call sub.shell32.dll_SHGetFolderPathW
mov ebx, eax
jmp 0x43369c
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x1c
push 0
call sub.shell32.dll_SHGetFolderPathW
mov ebx, eax
test ebx, ebx
jne 0x4336bc
push 1
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x214]
xor cx, cx
mov edx, 0x104
call fcn.0040b980
lea esi, [esi]
mov eax, dword [edi]
mov eax, dword [eax + 0x2c]
cmp byte [eax + 0xb], 0
je 0x4336e8
lea eax, [ebp - 0x218]
push eax
mov ecx, edi
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00433a60
mov edx, dword [ebp - 0x218]
lea eax, [ebp - 4]
call fcn.00408bc0
cmp dword [ebp - 4], 0
jne 0x4336f8
xor bl, bl
jmp 0x4337b2
lea edx, [ebp - 8]
mov eax, esi
call fcn.00433800
mov eax, esi
lea edx, [ebp - 0x218]
call fcn.00433930
mov edx, dword [ebp - 0x218]
mov eax, dword [edi]
add eax, 0x10
call fcn.00408bc0
push 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x224], eax
mov eax, 0x622094
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x21c], eax
lea edx, [ebp - 0x224]
mov eax, dword [edi]
add eax, 0x20
mov ecx, 2
call fcn.00408f50
push 0
mov eax, dword [edi]
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x224], eax
mov eax, 0x622094
mov dword [ebp - 0x220], eax
mov eax, dword [edi]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x21c], eax
lea edx, [ebp - 0x224]
mov eax, dword [edi]
add eax, 0x1c
mov ecx, 2
call fcn.00408f50
mov eax, dword [edi]
mov eax, dword [eax + 0x20]
mov dl, 1
call fcn.004595c0
test al, al
jne 0x4337b0
mov eax, dword [edi]
mov eax, dword [eax + 0x20]
call fcn.00459420
test al, al
jne 0x4337b0
xor bl, bl
jmp 0x4337b2
mov bl, 1
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.00433600
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x433a60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x228]
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, ecx
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00408b90
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.00433a30
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 1
mov eax, 0x62119c
call fcn.0042c0a0
mov edi, eax
call fcn.0042cf50
mov ecx, dword [edi + 8]
mov edx, 1
mov eax, 0x621b18
call fcn.00432400
mov edi, eax
mov eax, dword [esi]
cmp byte [eax + 5], 0
je 0x433b25
mov eax, edi
mov edx, 1
call fcn.0042cfb0
mov esi, eax
lea ecx, [ebp - 8]
xor edx, edx
mov eax, esi
mov esi, dword [esi]
call dword [esi + 0x7c]
push 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x228], eax
mov eax, 0x622094
mov dword [ebp - 0x224], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x220], eax
lea edx, [ebp - 0x228]
lea eax, [ebp - 0xc]
mov ecx, 2
call fcn.00408f50
jmp 0x433ba1
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push 0x23
push 0
call sub.shell32.dll_SHGetFolderPathW
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x21c]
xor cx, cx
mov edx, 0x104
call fcn.0040b980
mov eax, edi
mov edx, 2
call fcn.0042cfb0
mov esi, eax
lea ecx, [ebp - 8]
mov edx, 1
mov eax, esi
mov esi, dword [esi]
call dword [esi + 0x7c]
push 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x228], eax
mov eax, 0x622094
mov dword [ebp - 0x224], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x220], eax
lea edx, [ebp - 0x228]
lea eax, [ebp - 0xc]
mov ecx, 2
call fcn.00408f50
mov eax, dword [ebp - 0xc]
mov dl, 1
call fcn.004595c0
test al, al
jne 0x433bc8
mov eax, dword [ebp - 0xc]
call fcn.00459420
test al, al
jne 0x433bc8
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.00408bc0
lea esi, [esi]
mov eax, ebx
mov edx, dword [ebp - 0xc]
call fcn.00408bc0
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00433a30
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x439430
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
push esi
mov ebx, eax
mov esi, edx
mov dword [ebp - 4], 0
xor eax, eax
push fcn.00439420
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xc], 0
mov eax, dword [esi]
mov eax, dword [eax + 0x3c]
test eax, eax
je 0x43946a
mov eax, dword [eax - 4]
add eax, 1
test eax, eax
je 0x439478
mov byte [ebp - 8], 0
jmp 0x4394ee
mov byte [ebx + 4], 0
lea eax, [ebp - 4]
push eax
mov eax, dword [0x5f18d0]
call fcn.0040cf30
mov ecx, eax
mov edx, dword [0x5f18d0]
mov eax, 0x617d90
call fcn.00423b60
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4394a8
mov eax, 0x6722f0
push eax
push 0xffffffffffffffff
push 0
call sub.kernel32.dll_CreateMutexA
test eax, eax
jbe 0x4394e8
mov byte [ebp - 0xc], 1
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
je 0x4394cc
mov byte [ebx + 4], 1
mov esi, esi
push dword [0x5f1b00]
mov edx, 0x620948
mov eax, dword [esi]
mov ecx, dword [eax + 0x3c]
mov eax, dword [esi]
add eax, 0x3c
call fcn.0040d500
mov esi, esi
mov al, byte [ebp - 0xc]
mov byte [ebp - 8], al
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00439420
mov al, byte [ebp - 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x439960
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x44]
push ebx
push esi
push edi
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
xor eax, eax
push fcn.00439930
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x38]
mov eax, dword [edx]
mov edx, dword [eax + 0x3c]
mov ecx, dword [0x5f1be0]
mov eax, dword [ebp - 0x3c]
call fcn.00438790
test al, al
jne 0x4399c4
mov byte [ebp - 0x34], 0
jmp 0x439b5a
mov byte [ebp - 0x40], 1
mov dword [ebp - 0x28], 4
lea eax, [ebp - 0x28]
push eax
mov edx, 0x622238
lea eax, [ebp - 0x24]
mov ecx, 1
call fcn.0040d060
mov ecx, 0x622200
mov edx, dword [0x5f1ba0]
mov eax, dword [ebp - 0x24]
call fcn.0040d040
mov ecx, 0x622200
mov edx, dword [0x5f1bb0]
mov eax, dword [ebp - 0x24]
add eax, 4
call fcn.0040d040
mov ecx, 0x622200
mov edx, dword [str.g_n]
mov eax, dword [ebp - 0x24]
add eax, 8
call fcn.0040d040
mov ecx, 0x622200
mov edx, dword [str._wzo]
mov eax, dword [ebp - 0x24]
add eax, 0xc
call fcn.0040d040
mov eax, dword [ebp - 0x3c]
mov edx, dword [eax + 0xc]
mov eax, dword [edx + 0x2c]
cmp byte [eax + 0x10], 0
jne 0x439b1c
mov dword [ebp - 0x44], 0
push 0x80000000
push 0
push 0
call fcn.00554b30
mov edi, eax
test edi, edi
je 0x439b1c
mov eax, dword [ebp - 0x24]
call fcn.0040cf30
mov esi, eax
mov dword [ebp - 0x44], 0xffffffff
lea esi, [esi]
add dword [ebp - 0x44], 1
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x44]
mov eax, dword [eax + edx*4]
call fcn.0040cf30
mov ecx, eax
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x44]
mov edx, dword [eax + edx*4]
mov eax, 0x617d90
call fcn.00423b60
push 0x80000000
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x439aba
mov eax, dword [eax - 4]
mov edx, eax
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x439ac8
mov eax, 0x6722f0
lea ecx, [ebp - 0x2c]
call fcn.00441760
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x439adc
mov eax, 0x6722f0
push eax
push edi
call fcn.00554b40
mov ebx, eax
test ebx, ebx
setne al
and eax, 0xff
neg eax
je 0x439b10
lea eax, [ebp - 0x1c]
push eax
push ebx
call fcn.00554b50
test eax, eax
je 0x439b10
cmp dword [ebp - 0x18], 4
jne 0x439b19
mov byte [ebp - 0x40], 0
nop
jmp 0x439b19
cmp esi, dword [ebp - 0x44]
ja 0x439a80
lea esi, [esi]
mov al, byte [ebp - 0x40]
test al, al
je 0x439b54
mov ebx, 0x620948
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [0x5f1bf0]
mov edx, dword [0x5f1be0]
mov eax, dword [ebp - 0x3c]
call fcn.004388c0
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
lea eax, [ecx + 0x3c]
mov ecx, ebx
call fcn.0040d040
mov esi, esi
mov al, byte [ebp - 0x40]
mov byte [ebp - 0x34], al
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.00439930
mov al, byte [ebp - 0x34]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x439bb0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x24]
push ebx
push esi
push edi
mov esi, eax
mov edi, edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
xor eax, eax
push fcn.00439b80
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [edi]
mov edx, dword [eax + 0x3c]
mov ecx, dword [0x5f1c10]
mov eax, esi
call fcn.00438790
test al, al
jne 0x439c0c
mov byte [ebp - 0x20], 0
jmp 0x439d33
mov eax, dword [esi + 0xc]
mov eax, dword [eax + 0x2c]
cmp byte [eax + 0x10], 0
jne 0x439d04
lea eax, [ebp - 8]
push eax
mov eax, dword [0x5f18e0]
call fcn.0040cf30
mov ecx, eax
mov edx, dword [0x5f18e0]
mov eax, 0x617d90
call fcn.00423b60
call sub.kernel32.dll_GetCommandLineW
lea ecx, [ebp - 4]
xor dx, dx
call fcn.0040b430
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov ecx, 1
call fcn.00409a90
mov ebx, eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [0x5f1c00]
call fcn.0040cf30
mov ecx, eax
mov edx, dword [0x5f1c00]
mov eax, 0x617d90
call fcn.00423b60
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 4]
mov ecx, 1
call fcn.00409a90
add ebx, eax
test ebx, ebx
jbe 0x439c9d
mov eax, dword [esi + 0xc]
mov byte [eax + 5], 1
jmp 0x439d04
xor bl, bl
mov byte [ebp - 0x24], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
or eax, eax
je 0x439cf4
mov dword [ebp - 0x14], 4
lea eax, [ebp - 0x14]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
push 0x14
push dword [ebp - 0xc]
call sub.advapi32.dll_GetTokenInformation
or eax, eax
setne al
mov byte [ebp - 0x24], al
test al, al
je 0x439cf4
mov eax, dword [esi + 0xc]
cmp dword [ebp - 0x10], 0
seta byte [eax + 5]
lea esi, [esi]
cmp dword [ebp - 0xc], 0
jbe 0x439d04
push dword [ebp - 0xc]
call sub.kernel32.dll_CloseHandle
mov esi, esi
mov ebx, 0x620948
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [0x5f1c20]
mov edx, dword [0x5f1c10]
mov eax, esi
call fcn.004388c0
mov edx, dword [ebp - 0x1c]
mov eax, dword [edi]
add eax, 0x3c
mov ecx, ebx
call fcn.0040d040
mov byte [ebp - 0x20], 1
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.00439b80
mov al, byte [ebp - 0x20]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43a600
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xb0]
push ebx
push esi
push edi
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xa4], 0
xor eax, eax
push fcn.0043a5b0
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov dword [ebp - 0x9c], pe_nt_image_headers32
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x80]
push eax
call sub.advapi32.dll_GetUserNameA
lea eax, [ebp - 0xa4]
call fcn.00403d00
push 0
push 1
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x80]
xor cx, cx
mov edx, 0x7f
call fcn.004095b0
mov esi, dword [ebp - 0xa8]
lea eax, [ebp - 0xac]
push eax
mov eax, dword [0x5f1670]
call fcn.0040cf30
mov ecx, eax
mov edx, dword [0x5f1670]
mov eax, 0x617d90
call fcn.00423b60
mov edx, dword [ebp - 0xac]
lea eax, [ebp - 0xa4]
mov ecx, esi
call fcn.00408cc0
mov edx, dword [ebp - 0xa4]
lea ecx, [ebp - 0x98]
mov eax, 0x620a18
call fcn.004282c0
lea ecx, [ebp - 0x84]
lea edx, [ebp - 0x98]
mov eax, 0x620a18
call fcn.00428240
mov dword [ebp - 0xb0], 5
lea eax, [ebp - 0xb0]
push eax
mov edx, 0x6222a8
lea eax, [ebp - 0xa0]
mov ecx, 1
call fcn.0040d060
lea eax, [ebp - 0xac]
push eax
mov eax, dword [0x5f1cd0]
call fcn.0040cf30
mov ecx, eax
mov edx, dword [0x5f1cd0]
mov eax, 0x617d90
call fcn.00423b60
mov edx, dword [ebp - 0xac]
mov eax, dword [ebp - 0xa0]
call fcn.00408bc0
lea eax, [ebp - 0xac]
push eax
mov eax, dword [0x5f1ce0]
call fcn.0040cf30
mov ecx, eax
mov edx, dword [0x5f1ce0]
mov eax, 0x617d90
call fcn.00423b60
mov edx, dword [ebp - 0xac]
mov eax, dword [ebp - 0xa0]
add eax, 4
call fcn.00408bc0
lea eax, [ebp - 0xac]
push eax
mov eax, dword [0x5f1cf0]
call fcn.0040cf30
mov ecx, eax
mov edx, dword [0x5f1cf0]
mov eax, 0x617d90
call fcn.00423b60
mov edx, dword [ebp - 0xac]
mov eax, dword [ebp - 0xa0]
add eax, 8
call fcn.00408bc0
lea eax, [ebp - 0xac]
push eax
mov eax, dword [0x5f1d00]
call fcn.0040cf30
mov ecx, eax
mov edx, dword [0x5f1d00]
mov eax, 0x617d90
call fcn.00423b60
mov edx, dword [ebp - 0xac]
mov eax, dword [ebp - 0xa0]
add eax, 0xc
call fcn.00408bc0
lea eax, [ebp - 0xac]
push eax
mov eax, dword [0x5f1d10]
call fcn.0040cf30
mov ecx, eax
mov edx, dword [0x5f1d10]
mov eax, 0x617d90
call fcn.00423b60
mov edx, dword [ebp - 0xac]
mov eax, dword [ebp - 0xa0]
add eax, 0x10
call fcn.00408bc0
lea eax, [ebp - 0x88]
xor edx, edx
call fcn.00408bc0
mov eax, dword [ebp - 0xa0]
call fcn.0040cf30
mov esi, eax
mov edi, 0xffffffff
lea esi, [esi]
nop
add edi, 1
mov eax, dword [ebp - 0xa0]
mov edx, dword [eax + edi*4]
mov eax, dword [ebp - 0x84]
call fcn.00409780
test eax, eax
jne 0x43a888
mov eax, dword [0x5f5130]
or eax, ebx
mov ebx, eax
jmp 0x43a88c
cmp esi, edi
ja 0x43a860
test ebx, ebx
sete bl
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.0043a5b0
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43b030
Capabilities:
Create process on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x234]
push ebx
push esi
push edi
mov esi, eax
mov edi, edx
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0
xor eax, eax
push fcn.0043afd0
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x234], 0
push 0x104
lea eax, [ebp - 0x208]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ebx, eax
test ebx, ebx
jbe 0x43b2b8
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x208]
mov cl, 1
mov edx, 0x103
call fcn.0040b930
mov eax, dword [ebp - 0x220]
mov ecx, ebx
xor edx, edx
call fcn.0040bd70
mov eax, dword [ebp - 0x21c]
lea edx, [ebp - 0x210]
call fcn.0040b370
mov edx, dword [ebp - 0x210]
lea eax, [ebp - 0x214]
call fcn.0040a690
mov ecx, dword [ebp - 0x214]
mov eax, esi
mov edx, 0x6220c4
call fcn.0043af20
mov esi, eax
test esi, esi
jbe 0x43b20c
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x224], eax
lea edx, [esi + 2]
cmp word [eax + edx*2 - 2], 0x78
jne 0x43b163
mov eax, dword [ebp - 0x224]
lea edx, [esi + 3]
cmp word [eax + edx*2 - 2], 0x65
je 0x43b20c
lea eax, [ebp - 0x22c]
push eax
mov eax, dword [0x5f1920]
call fcn.0040cf30
mov ecx, eax
mov edx, dword [0x5f1920]
mov eax, 0x617d90
call fcn.00423b60
mov eax, dword [ebp - 0x22c]
lea edx, [ebp - 0x228]
call fcn.0040a5c0
mov ebx, dword [ebp - 0x228]
lea eax, [ebp - 0x230]
push eax
lea ecx, [esi - 1]
mov eax, dword [ebp - 0x214]
xor edx, edx
call fcn.0040ab80
mov edx, dword [ebp - 0x230]
lea eax, [ebp - 0x214]
mov ecx, ebx
call fcn.0040a710
mov eax, dword [ebp - 0x214]
lea edx, [ebp - 0x220]
call fcn.0040b3a0
mov ebx, dword [ebp - 0x220]
mov eax, dword [ebp - 0x210]
lea edx, [ebp - 0x21c]
call fcn.0040b3a0
mov eax, dword [ebp - 0x21c]
mov edx, ebx
call fcn.004638d0
mov eax, dword [edi]
add eax, 0x24
mov edx, dword [ebp - 0x214]
call fcn.0040a690
lea eax, [ebp - 0x20c]
push eax
push 0
mov eax, edi
push eax
mov eax, 0x433280
push eax
push 0
push 0
call sub.kernel32.dll_CreateThread
mov edx, 1
mov eax, 0x620f30
call fcn.0042a7e0
mov ebx, eax
lea eax, [ebp - 0x22c]
push eax
mov eax, dword [0x5f1ca0]
call fcn.0040cf30
mov ecx, eax
mov edx, dword [0x5f1ca0]
mov eax, 0x617d90
call fcn.00423b60
mov eax, dword [ebp - 0x22c]
lea edx, [ebp - 0x218]
call fcn.0040a5c0
push 1
push 0
mov edx, dword [edi]
mov eax, ebx
call fcn.0042a8e0
push eax
mov eax, dword [ebp - 0x214]
test eax, eax
jne 0x43b289
mov eax, 0x6722f0
push eax
mov eax, dword [ebp - 0x218]
test eax, eax
jne 0x43b299
mov eax, 0x6722f0
push eax
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
jbe 0x43b2b8
mov byte [ebp - 0x234], 1
mov eax, dword [edi]
push dword [eax + 0x34]
call sub.kernel32.dll_CloseHandle
nop
mov bl, byte [ebp - 0x234]
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.0043afd0
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43b6f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10c]
push ebx
push esi
push edi
mov dword [ebp - 0x104], eax
mov esi, edx
mov eax, ecx
lea edi, [ebp - 0xfc]
mov ecx, 0x3e
rep movsd dword es:[edi], dword [esi]
mov ebx, eax
push dword [ebx]
call fcn.0043b680
mov dword [ebp - 4], eax
mov eax, dword [ebx]
movzx eax, word [eax + 6]
mov dword [ebp - 0x100], eax
lea eax, [ebp - 0x100]
push eax
mov edx, 0x622648
mov eax, 0x673610
mov ecx, 1
call fcn.0040d060
mov dword [ebp - 0x108], ebx
mov eax, ebx
mov edx, dword [eax]
movzx eax, word [edx + 6]
sub eax, 1
mov dword [ebp - 0x10c], eax
test eax, eax
jl 0x43b868
mov ebx, 0xffffffff
lea esi, [esi]
nop
add ebx, 1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
jne 0x43b7de
mov edi, dword [ebp - 0xc4]
test edi, edi
jle 0x43b7d0
push 0x40
push 0x1000
push edi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
xor edx, edx
push edx
push eax
mov edx, dword [ebp - 0x108]
mov eax, dword [edx + 4]
call fcn.0043b550
push eax
call sub.kernel32.dll_VirtualAlloc
mov esi, eax
mov eax, dword [0x673610]
mov dword [eax + ebx*8], esi
mov eax, dword [0x673610]
mov dword [eax + ebx*8 + 4], edi
mov edx, dword [ebp - 4]
mov eax, esi
xor ecx, ecx
mov dword [edx + 8], eax
push edi
push esi
call fcn.00446a00
push 0
push 0x28
lea eax, [ebp - 4]
call fcn.0043b510
jmp 0x43b85b
push 0x40
push 0x1000
mov eax, dword [ebp - 4]
push dword [eax + 0x10]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
xor eax, eax
push eax
push edx
mov edx, dword [ebp - 0x108]
mov eax, dword [edx + 4]
call fcn.0043b550
push eax
call sub.kernel32.dll_VirtualAlloc
mov esi, eax
mov eax, dword [0x673610]
mov dword [eax + ebx*8], esi
mov edx, dword [0x673610]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov dword [edx + ebx*8 + 4], eax
mov eax, dword [ebp - 4]
push dword [eax + 0x10]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x14]
xor eax, eax
push eax
push edx
mov eax, dword [ebp - 0x104]
call fcn.0043b550
push eax
push esi
call fcn.004469e0
mov edx, dword [ebp - 4]
mov eax, esi
xor ecx, ecx
mov dword [edx + 8], eax
push 0
push 0x28
lea eax, [ebp - 4]
call fcn.0043b510
cmp dword [ebp - 0x10c], ebx
jg 0x43b770
nop
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43bcd0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor eax, eax
mov edx, ecx
and edx, 0x4000000
je 0x43bce8
or eax, 0x200
nop
mov edx, ecx
and edx, 0x20000000
je 0x43bd26
mov edx, ecx
and edx, 0x40000000
je 0x43bd10
mov edx, ecx
and edx, 0x80000000
je 0x43bd0b
or eax, 0x40
jmp 0x43bd54
or eax, 0x20
jmp 0x43bd54
mov edx, ecx
and edx, 0x80000000
je 0x43bd21
or eax, 0x80
jmp 0x43bd54
or eax, 0x10
jmp 0x43bd54
mov edx, ecx
and edx, 0x40000000
je 0x43bd44
mov edx, ecx
and edx, 0x80000000
je 0x43bd3f
or eax, 4
jmp 0x43bd54
or eax, 2
jmp 0x43bd54
and ecx, 0x80000000
je 0x43bd51
or eax, 8
jmp 0x43bd54
or eax, 1
mov esp, ebp
pop ebp
ret 4