joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40fb3d
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x4c613b
call fcn.0048e652
xor ecx, ecx
mov byte [ebp - 0x14], cl
xor eax, eax
lea edi, [ebp - 0x13]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], 4
cmp byte [ebp - 0x14], cl
jne 0x40fbf1
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x10]
push eax
mov ebx, 0x20019
push ebx
push ecx
mov edi, str.SOFTWAREAdobeAdobe_Acrobat10.0Language
push edi
push SysReAllocString
call esi
test eax, eax
jne 0x40fbb3
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
push 0x4cf0fc
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x14], 0
jne 0x40fbf1
lea eax, [ebp - 0x10]
push eax
push ebx
push 0
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x40fbf1
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
push 0x4cf0fc
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor bl, bl
xor esi, esi
mov edi, 0x5079c4
lea eax, [ebp - 0x14]
push eax
push edi
call fcn.004910a3
pop ecx
pop ecx
test eax, eax
je 0x40fc15
inc esi
add edi, 8
cmp esi, 1
jb 0x40fbfa
jmp 0x40fc17
mov bl, 1
movzx eax, bl
neg eax
sbb eax, eax
and eax, esi
push dword [eax*8 + 0x5079c8]
lea ecx, [ebp - 0x20]
call fcn.0040fafc
xor eax, eax
push eax
push eax
push dword [ebp - 0x20]
mov dword [ebp - 4], eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.00404388
call fcn.0048e72a
ret

Function at 0x40fd08
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
lea eax, [ebp - 8]
push eax
push 0x20019
xor esi, esi
push esi
push str.SoftwareAdobeAdobe_Acrobat10.0Security
xor edi, edi
push reloc.OLEAUT32.dll_SysReAllocString
inc edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40fd6f
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push 0x4cf168
push dword [ebp - 8]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40fd66
cmp dword [ebp - 4], esi
jne 0x40fd66
xor edi, edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x410469
Capabilities:
Get common file path

Disassembly:
push 0x3c
mov eax, 0x4c61eb
call fcn.0048e652
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov eax, dword [0x50ad10]
cmp eax, ebx
jne 0x41052c
mov edi, dword [sym.imp.KERNEL32.dll_GetTempPathW]
push ebx
push ebx
call edi
mov esi, eax
cmp esi, ebx
jbe 0x410506
push 0x50d228
xor ecx, ecx
push 2
pop edx
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048eb50
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x410506
lea eax, [esi + esi + 2]
push eax
push 0
push ebx
call fcn.0048e760
add esp, 0xc
push ebx
push esi
call edi
test eax, eax
jbe 0x4104ff
cmp eax, esi
ja 0x4104ff
push ebx
lea ecx, [ebp - 0x2c]
call fcn.00401f35
xor esi, esi
lea eax, [ebp - 0x2c]
inc esi
push eax
mov dword [ebp - 4], esi
call fcn.00410144
pop ecx
push 0
push esi
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.00401626
push ebx
call fcn.0048eb45
pop ecx
mov eax, dword [0x50ad10]
xor ebx, ebx
cmp eax, ebx
jne 0x41052c
push 0x4cdc24
lea ecx, [ebp - 0x48]
call fcn.00401f35
mov dword [ebp - 4], 2
mov dword [ebp - 0x10], 1
mov ecx, dword [ebp + 8]
push eax
call fcn.00401dc2
or dword [ebp - 0x10], 2
test byte [ebp - 0x10], 1
mov dword [ebp - 4], ebx
je 0x410551
and dword [ebp - 0x10], 0xfffffffe
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.00401626
mov eax, dword [ebp + 8]
call fcn.0048e72a
ret

Function at 0x41080b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x794]
sub esp, 0x814
mov eax, dword [0x509354]
xor eax, ebp
mov dword [ebp + 0x790], eax
call fcn.00446560
cmp eax, 2
jge 0x410837
xor al, al
jmp 0x4108d7
cmp eax, 4
jge 0x410830
push ebx
push esi
mov bl, 1
mov esi, str.Acrobat_Reader
call fcn.004107f3
test al, al
je 0x410853
mov esi, str.Adobe_Acrobat
push str.10.0
push esi
push str.SoftwarePoliciesAdobe_s_sFeatureLockDown
lea eax, [ebp - 0x70]
push 0x400
push eax
call fcn.00401305
add esp, 0x14
test eax, eax
jl 0x4108d3
lea eax, [ebp - 0x74]
push eax
push 1
xor esi, esi
push esi
lea eax, [ebp - 0x70]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x74], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4108d3
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x7c]
push eax
push esi
push str.bEnableAlternateLaunchDesktop
push dword [ebp - 0x74]
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x80], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4108ca
cmp dword [ebp - 0x7c], 4
jne 0x4108ca
cmp dword [ebp - 0x78], esi
setne bl
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov al, bl
pop ebx
mov ecx, dword [ebp + 0x790]
xor ecx, ebp
call fcn.0048e25d
add ebp, 0x794
leave
ret
Function at 0x41f5b0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push esi
push edi
mov edi, dword [ebp + 0x10]
push 0
mov esi, ecx
lea ecx, [edi + eax]
push ecx
push 0
push 0x8000004
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 0x14], eax
test eax, eax
jne 0x41f5e7
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebp
ret 0x10
mov ecx, dword [esi]
push 0
push 0
push 6
lea edx, [ebp + 0x10]
push edx
push ecx
push eax
mov dword [ebp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x41f5db
mov edx, dword [esi + 0x14]
push ebx
push 0
push 0
push 0
push 6
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
test ebx, ebx
je 0x41f6bd
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
lea eax, [ebx + edi]
push eax
push ecx
push edx
call fcn.0041f480
mov eax, dword [ebp + 0x10]
add esp, 0xc
push 4
push 0x50bcfc
push str.g_shared_section
mov ecx, esi
mov dword [0x50bcfc], eax
call fcn.0041f560
mov dword [0x50bcfc], 0
test eax, eax
jne 0x41f6b8
push 4
push 0x50bd60
push str.g_shared_IPC_size
mov ecx, esi
mov dword [0x50bd60], edi
call fcn.0041f560
mov dword [0x50bd60], 0
test eax, eax
jne 0x41f6b8
mov ecx, dword [ebp + 0x14]
push 4
push 0x50bd64
mov dword [0x50bd64], ecx
push str.g_shared_policy_size
mov ecx, esi
call fcn.0041f560
mov dword [0x50bd64], 0
test eax, eax
je 0x41f6d6
cmp eax, 1
jne 0x41f6ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebx
pop edi
pop esi
pop ebp
ret 0x10
pop ebx
pop edi
mov eax, 1
pop esi
pop ebp
ret 0x10
push 0x24
call fcn.0048e1ac
add esp, 4
test eax, eax
je 0x41f700
mov edx, dword [ebp + 8]
mov ecx, dword [esi + 0x20]
push edx
mov edx, dword [esi + 0x18]
push ecx
mov ecx, dword [esi + 8]
push edx
mov edx, dword [esi]
push ecx
push edx
mov ecx, eax
call fcn.00423180
jmp 0x41f702
xor eax, eax
push 0x20000
push edi
push ebx
mov ecx, eax
mov dword [esi + 0x1c], eax
call fcn.00423a00
test al, al
jne 0x41f723
pop ebx
pop edi
mov eax, 8
pop esi
pop ebp
ret 0x10
pop ebx
pop edi
mov dword [esi + 4], 0
xor eax, eax
pop esi
pop ebp
ret 0x10
Function at 0x422540
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], ebx
cmp byte [0x50c21c], bl
je 0x42258f
cmp byte [esi + 0x38], bl
jne 0x42258f
push 3
push 0xbf
push str.._src_restricted_token.cc
lea ecx, [ebp - 0xe4]
mov ebx, 1
call fcn.004440f0
add eax, 4
push str.Check_failed:_init_.
push eax
call fcn.0040afde
add esp, 8
test bl, 1
je 0x42259f
lea ecx, [ebp - 0xe4]
call fcn.00443d90
cmp byte [esi + 0x38], 0
jne 0x4225b2
pop esi
mov eax, 0x3f0
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esi + 0x30]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 8]
push eax
push 0
push 0
push 2
push ecx
mov dword [ebp - 8], 0
call edi
mov eax, dword [ebp - 8]
test eax, eax
je 0x422606
push eax
call fcn.0048d83c
mov ecx, dword [ebp - 0x14]
add esp, 4
mov esi, eax
mov eax, dword [ebp - 8]
lea edx, [ebp - 8]
push edx
mov edx, dword [ecx + 0x30]
push eax
push esi
push 2
push edx
mov dword [ebp - 0xc], esi
call edi
test eax, eax
jne 0x422615
push esi
call fcn.0048eb45
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [esi], 0
mov dword [ebp - 0x10], 0
jbe 0x4226e5
mov edi, dword [ebp + 8]
lea eax, [esi + 4]
mov dword [ebp - 4], eax
mov edi, edi
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 4]
test al, 0x20
jne 0x4226d2
test eax, 0xc0000000
jne 0x4226d2
test edi, edi
je 0x4226b0
mov esi, dword [edi + 4]
mov ecx, dword [edi + 8]
sub ecx, esi
mov eax, 0x78787879
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
xor ebx, ebx
add eax, edx
je 0x4226ad
mov dword [ebp + 8], ebx
lea ecx, [ecx]
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
add ecx, esi
push eax
call fcn.00422dd0
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x4226cf
mov esi, dword [edi + 4]
mov ecx, dword [edi + 8]
add dword [ebp + 8], 0x44
sub ecx, esi
mov eax, 0x78787879
imul ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
inc ebx
add ecx, edx
cmp ebx, ecx
jb 0x422670
mov esi, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
lea ecx, [ebp - 0x58]
call fcn.00422db0
lea ecx, [ebp - 0x58]
push ecx
mov ecx, dword [ebp - 0x14]
add ecx, 0x20
call fcn.0041ebc0
jmp 0x4226d2
mov esi, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
add dword [ebp - 4], 8
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [esi]
jb 0x422630
push esi
call fcn.0048eb45
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x422800
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
push ebx
push edi
xor edi, edi
cmp byte [0x50c21c], 0
mov ebx, ecx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], edi
je 0x422853
cmp byte [ebx + 0x38], 0
jne 0x422853
push 3
push 0x116
push str.._src_restricted_token.cc
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 1
call fcn.004440f0
add eax, 4
push str.Check_failed:_init_.
push eax
call fcn.0040afde
add esp, 8
test byte [ebp - 4], 1
je 0x422864
lea ecx, [ebp - 0xa8]
call fcn.00443d90
cmp byte [ebx + 0x38], 0
jne 0x422877
pop edi
mov eax, 0x3f0
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebx + 0x30]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 8]
push eax
push edi
push edi
push 3
push ecx
mov dword [ebp - 8], edi
call esi
mov eax, dword [ebp - 8]
cmp eax, edi
je 0x4228c2
push eax
call fcn.0048d83c
mov ecx, dword [ebx + 0x30]
add esp, 4
mov edi, eax
mov eax, dword [ebp - 8]
lea edx, [ebp - 8]
push edx
push eax
push edi
push 3
push ecx
mov dword [ebp - 0x10], edi
call esi
test eax, eax
jne 0x4228d1
push edi
call fcn.0048eb45
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [edi], 0
mov dword [ebp - 0xc], 0
jbe 0x4229a7
mov ebx, dword [ebp + 8]
lea edx, [edi + 4]
mov dword [ebp - 4], edx
lea ebx, [ebx]
test ebx, ebx
je 0x422980
mov esi, dword [ebx + 4]
mov ecx, dword [ebx + 8]
sub ecx, esi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp + 8], 0
je 0x422980
xor edi, edi
mov edi, edi
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
cmp dword [edi + esi + 0x18], 8
jb 0x422935
mov esi, dword [edi + esi + 4]
jmp 0x422939
lea esi, [edi + esi + 4]
lea ecx, [ebp - 0x18]
push ecx
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
cmp edx, dword [ebp - 0x14]
jne 0x422957
mov eax, dword [eax]
cmp eax, dword [ebp - 0x18]
je 0x422991
mov esi, dword [ebx + 4]
mov ecx, dword [ebx + 8]
inc dword [ebp + 8]
sub ecx, esi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
add edi, 0x1c
cmp dword [ebp + 8], ecx
jb 0x422920
mov edi, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
push edx
add ecx, 0x10
call fcn.00421fe0
jmp 0x422994
mov edi, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
add dword [ebp - 4], 0xc
inc eax
mov dword [ebp - 0xc], eax
cmp eax, dword [edi]
jb 0x4228f0
push edi
call fcn.0048eb45
add esp, 4
pop esi
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x422e70
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18c
mov eax, dword [0x509354]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
cmp dword [esi], 0
je 0x422ea4
mov eax, 0x4df
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048e25d
mov esp, ebp
pop ebp
ret 0xc
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
mov dword [esi], eax
test eax, eax
jne 0x422eca
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048e25d
mov esp, ebp
pop ebp
ret 0xc
push 0x6c
lea eax, [ebp - 0x188]
push 0
push eax
mov dword [ebp - 0x18c], 0
call fcn.0048e760
mov ecx, dword [ebp + 8]
xor eax, eax
add esp, 0xc
mov dword [ebp - 0x11c], eax
cmp ecx, 4
ja case.default.0x422efb
jmp dword [ecx*4 + 0x42300c]
or dword [ebp - 0x17c], 0x400
mov eax, 0x27
or eax, 0x10
or dword [ebp - 0x17c], 8
mov dword [ebp - 0x170], 1
or eax, 0xc8
mov dword [ebp - 0x11c], eax
push 0x110
lea ecx, [ebp - 0x114]
push 0
push ecx
call fcn.0048e760
add esp, 0xc
lea edx, [ebp - 0x118]
push edx
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 5
jne 0x422f6f
cmp dword [ebp - 0x110], 0
je 0x422f79
or dword [ebp - 0x17c], 0x2000
mov ecx, dword [esi]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetInformationJobObject]
push 0x70
lea eax, [ebp - 0x18c]
push eax
push 9
push ecx
call edi
test eax, eax
je 0x422fb3
mov edx, dword [ebp + 0x10]
mov ecx, dword [esi]
push 4
lea eax, [ebp - 0x11c]
push eax
push 4
not edx
and dword [ebp - 0x11c], edx
push ecx
call edi
test eax, eax
jne 0x422fcb
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048e25d
mov esp, ebp
pop ebp
ret 0xc
test byte [ebp - 0x11c], 1
je 0x422fe1
push esi
call fcn.0046fcb0
add esp, 4
test eax, eax
jne 0x422fb9
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048e25d
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0xa0
pop esi
call fcn.0048e25d
mov esp, ebp
pop ebp
ret 0xc
Function at 0x422f02
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18c
mov eax, dword [0x509354]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
cmp dword [esi], 0
je 0x422ea4
mov eax, 0x4df
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048e25d
mov esp, ebp
pop ebp
ret 0xc
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
mov dword [esi], eax
test eax, eax
jne 0x422eca
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048e25d
mov esp, ebp
pop ebp
ret 0xc
push 0x6c
lea eax, [ebp - 0x188]
push 0
push eax
mov dword [ebp - 0x18c], 0
call fcn.0048e760
mov ecx, dword [ebp + 8]
xor eax, eax
add esp, 0xc
mov dword [ebp - 0x11c], eax
cmp ecx, 4
ja case.default.0x422efb
jmp dword [ecx*4 + 0x42300c]
or dword [ebp - 0x17c], 0x400
mov eax, 0x27
or eax, 0x10
or dword [ebp - 0x17c], 8
mov dword [ebp - 0x170], 1
or eax, 0xc8
mov dword [ebp - 0x11c], eax
push 0x110
lea ecx, [ebp - 0x114]
push 0
push ecx
call fcn.0048e760
add esp, 0xc
lea edx, [ebp - 0x118]
push edx
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 5
jne 0x422f6f
cmp dword [ebp - 0x110], 0
je 0x422f79
or dword [ebp - 0x17c], 0x2000
mov ecx, dword [esi]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetInformationJobObject]
push 0x70
lea eax, [ebp - 0x18c]
push eax
push 9
push ecx
call edi
test eax, eax
je 0x422fb3
mov edx, dword [ebp + 0x10]
mov ecx, dword [esi]
push 4
lea eax, [ebp - 0x11c]
push eax
push 4
not edx
and dword [ebp - 0x11c], edx
push ecx
call edi
test eax, eax
jne 0x422fcb
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048e25d
mov esp, ebp
pop ebp
ret 0xc
test byte [ebp - 0x11c], 1
je 0x422fe1
push esi
call fcn.0046fcb0
add esp, 4
test eax, eax
jne 0x422fb9
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048e25d
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0xa0
pop esi
call fcn.0048e25d
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4275d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x509354]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [ebp + 8], 0
push edi
mov edi, ecx
jne 0x427602
cmp dword [edi + 0xc], 0
jne 0x427634
mov al, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048e25d
mov esp, ebp
pop ebp
ret 4
push 0
push 0x436f90
push 1
push str.NtMapViewOfSection
push 0x4d1e48
call fcn.00426960
push 1
push 0x4370e0
push 1
push str.NtUnmapViewOfSection
push 0x4d1e48
mov ecx, edi
call fcn.00426960
mov eax, dword [edi]
push ebx
mov ebx, dword [eax]
push esi
mov esi, dword [edi + 0xc]
push 0x40
push 0x1000
shl esi, 6
add esi, 0x50
push esi
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 0x430
push 0
push 0x50bd98
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x50], 0x10
call fcn.0048e760
mov edx, dword [ebp - 0x58]
add esp, 0xc
lea ecx, [ebp - 0x54]
push ecx
push esi
push edx
mov ecx, edi
call fcn.00426f50
test al, al
je 0x4276ef
mov edx, dword [ebp - 0x58]
lea eax, [ebp - 0x5c]
push eax
push 0x10
lea ecx, [ebp - 0x54]
push ecx
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x4276ef
cmp dword [ebp - 0x5c], 0x10
jne 0x4276ef
mov ecx, dword [ebp - 0x58]
lea eax, [ebp - 0x60]
push eax
push 0x20
push esi
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov ecx, dword [edi]
push 0x430
push 0x50bd98
push str.g_originals
call fcn.0041f560
pop esi
test eax, eax
pop ebx
sete al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048e25d
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
pop esi
pop ebx
xor ecx, ebp
xor al, al
pop edi
call fcn.0048e25d
mov esp, ebp
pop ebp
ret 4
Function at 0x42ab50
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x509354]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x3c]
push str.ReaderLogTransport2.exe
push eax
xor bl, bl
call fcn.004704a0
add esp, 8
cmp dword [ebp - 0x28], 0
je 0x42ac49
cmp dword [ebp - 0x24], 8
mov eax, dword [ebp - 0x38]
jae 0x42ab92
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42ac49
lea ecx, [ebp - 0x3c]
push ecx
push edi
call fcn.00437f00
add esp, 8
test al, al
jne 0x42abc5
cmp dword [ebp - 0x24], 8
jb 0x42ac5b
mov edx, dword [ebp - 0x38]
push edx
jmp 0x42ac53
push 1
xor eax, eax
mov edi, 7
push 0x4d2510
lea ecx, [ebp - 0x20]
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], 0
mov word [ebp - 0x1c], ax
call fcn.004027ed
push 0xffffffffffffffff
push 0
lea ecx, [ebp - 0x3c]
push ecx
lea ecx, [ebp - 0x20]
call fcn.00402744
push 1
push 0x4d2510
lea ecx, [ebp - 0x20]
call fcn.004027ed
lea edx, [ebp - 0x20]
push edx
push esi
call fcn.00437f00
add esp, 8
lea esi, [edi + 1]
test al, al
jne 0x42ac45
cmp dword [ebp - 8], esi
jb 0x42ac2d
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0048e006
add esp, 4
xor ecx, ecx
cmp dword [ebp - 0x24], esi
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], 0
mov word [ebp - 0x1c], cx
jmp 0x42abb6
mov bl, 1
jmp 0x42ac1c
cmp dword [ebp - 0x24], 8
jb 0x42ac5b
mov eax, dword [ebp - 0x38]
push eax
call fcn.0048e006
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0048e25d
mov esp, ebp
pop ebp
ret
Function at 0x42af00
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x509354]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 0
push edi
mov edi, dword [ebp + 0xc]
je 0x42afa0
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0048e760
add esp, 0xc
cmp dword [esi + 0x18], 8
jb 0x42af42
mov esi, dword [esi + 4]
jmp 0x42af45
add esi, 4
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x42afa0
cmp eax, 0x104
ja 0x42afa0
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42af70
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x20c]
push edx
mov ecx, edi
call fcn.00401cd6
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048e25d
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor al, al
pop esi
call fcn.0048e25d
mov esp, ebp
pop ebp
ret
Function at 0x42c3b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x509354]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
xor al, al
cmp dword [esi + 0x14], 0
push edi
mov edi, dword [ebp + 0xc]
je 0x42c4a0
mov ecx, esi
call fcn.00402721
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42c4b1
mov ecx, esi
call fcn.00402721
push eax
call dword [sym.imp.SHELL32.dll_PathIsExe]
test eax, eax
je 0x42c4b1
push 0
push str.ime_shared
lea eax, [ebp - 0x3c]
push 0x25
push eax
call fcn.004703a0
push 0
push str.ime_shared
lea ecx, [ebp - 0x20]
push 0x24
push ecx
call fcn.004703a0
push ebx
push edi
lea edx, [ebp - 0x3c]
push esi
push edx
call fcn.0042c070
add esp, 0x30
test al, al
jne 0x42c461
push ebx
push edi
lea eax, [ebp - 0x20]
push esi
push eax
call fcn.0042c070
add esp, 0x10
test al, al
jne 0x42c461
push ebx
push edi
push esi
call fcn.0042c2c0
add esp, 0xc
test al, al
jne 0x42c461
xor bl, bl
jmp 0x42c463
mov bl, 1
mov esi, 8
cmp dword [ebp - 8], esi
jb 0x42c479
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.0048e006
add esp, 4
xor edx, edx
mov dword [ebp - 8], 7
mov dword [ebp - 0xc], 0
mov word [ebp - 0x1c], dx
cmp dword [ebp - 0x24], esi
jb 0x42c49e
mov eax, dword [ebp - 0x38]
push eax
call fcn.0048e006
add esp, 4
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048e25d
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor al, al
pop ebx
call fcn.0048e25d
mov esp, ebp
pop ebp
ret