joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401a40
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
xor ebx, ebx
push esi
xor esi, esi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], esi
cmp ebp, ebx
je 0x401b72
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x401a67
sub eax, edx
je 0x401b72
mov eax, dword [0x46d3bc]
push edi
push eax
call fcn.0040993e
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x401b7b
mov ecx, dword [0x46d3bc]
push ecx
push 0x46d3c4
push edi
call fcn.00409b60
mov eax, dword [0x46d3c0]
mov ebx, dword [0x46d3bc]
call fcn.00404440
mov eax, dword [0x46d3b8]
push eax
mov dword [esp + 0x30], eax
call fcn.0040993e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x401b50
mov edx, dword [0x46d3bc]
push edx
push edi
lea eax, [esp + 0x28]
push eax
push esi
call fcn.00406130
add esp, 0x10
test eax, eax
jne 0x401b50
push edi
call fcn.0040954d
add esp, 4
push 0
push 0
push 2
push 0
push 1
push 0xc0000000
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x401b59
mov edx, dword [esp + 0x20]
push 0
lea ecx, [esp + 0x18]
push ecx
push edx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x401b4b
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x20]
jne 0x401b4b
push esi
call fcn.0040954d
add esp, 4
push edi
xor esi, esi
call ebx
mov dword [esp + 0x10], 1
push edi
call ebx
jmp 0x401b59
push edi
call fcn.0040954d
add esp, 4
test esi, esi
je 0x401b66
push esi
call fcn.0040954d
add esp, 4
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x401f10
Capabilities:
Write file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push 0x41cc84
push eax
mov edi, ecx
xor esi, esi
call fcn.0040935f
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x401f37
push 1
call fcn.00408e60
test edi, edi
jbe 0x401f81
jmp 0x401f40
mov ecx, edi
sub ecx, esi
cmp ecx, 0x100
jb 0x401f70
cmp esi, edi
jae 0x401f81
push ebx
push 0x100
lea edx, [esi + ebp]
push 1
push edx
call fcn.004096ba
add esi, 0x100
add esp, 0x10
cmp edi, esi
ja 0x401f40
jmp 0x401f81
push ebx
sub edi, esi
push edi
push 1
add esi, ebp
push esi
call fcn.004096ba
add esp, 0x10
push ebx
call fcn.0040921e
push ebx
call fcn.00409858
add esp, 8
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x402810
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub esp, 0x174
mov eax, dword [0x41f050]
xor eax, esp
mov dword [esp + 0x16c], eax
push esi
push edi
push 0x104
lea eax, [esp + 0x6d]
push 0
push eax
mov byte [esp + 0x74], 0
call fcn.004100c0
add esp, 0xc
mov ecx, 0x44
lea eax, [esp + 0x20]
mov byte [eax], 0
inc eax
sub ecx, 1
jne 0x402848
mov ecx, 5
mov word [esp + 0x50], cx
mov dword [esp + 0x20], 0x44
mov dword [esp + 0x4c], 1
mov ecx, 0x10
lea eax, [esp + 0x10]
mov byte [eax], 0
inc eax
sub ecx, 1
jne 0x402874
lea edx, [esp + 0x68]
push edx
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jbe 0x40291b
lea eax, [esp + 0x68]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4028a0
sub eax, edx
je 0x40291b
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [esp + 0x68]
lea esi, [esp + 0x68]
push eax
dec esi
call edi
cmp byte [eax + esi], 0x5c
jne 0x40291b
lea ecx, [esp + 0x68]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
mov byte [eax + esi], 0
lea eax, [esp + 0x24]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x8c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
cmp eax, 5
setne dl
mov eax, edx
pop edi
pop esi
mov ecx, dword [esp + 0x16c]
xor ecx, esp
call fcn.004089ca
add esp, 0x174
ret
mov ecx, dword [esp + 0x174]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.004089ca
add esp, 0x174
ret
Function at 0x402b80
Capabilities:
Get hostname
Get session user name

Disassembly:
sub esp, 0x41c
mov eax, dword [0x41f050]
xor eax, esp
mov dword [esp + 0x418], eax
push ebx
push ebp
xor eax, eax
push edi
xor ebx, ebx
push 0x1ff
mov dword [esp + 0x19], eax
mov dword [esp + 0x1d], eax
mov dword [esp + 0x21], eax
mov word [esp + 0x25], ax
mov byte [esp + 0x27], al
lea eax, [esp + 0x29]
push ebx
push eax
xor edi, edi
mov byte [esp + 0x20], bl
mov byte [esp + 0x30], bl
call fcn.004100c0
push 0x1ff
lea ecx, [esp + 0x235]
push ebx
push ecx
mov byte [esp + 0x23c], bl
call fcn.004100c0
mov ecx, dword [esp + 0x444]
lea edx, [esp + 0x23c]
push edx
lea eax, [esp + 0x40]
push eax
push ecx
mov dword [esp + 0x30], ebx
xor ebp, ebp
call fcn.00402a40
add esp, 0x24
test eax, eax
jne 0x402c23
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x418]
xor ecx, esp
call fcn.004089ca
add esp, 0x41c
ret
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea edx, [esp + 0x10]
push edx
push ebx
mov dword [esp + 0x18], ebx
call esi
test eax, eax
jne 0x402c6c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x402d08
mov eax, dword [esp + 0x10]
push eax
call fcn.0040993e
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x402c6c
lea ecx, [esp + 0x10]
push ecx
push edi
call esi
test eax, eax
je 0x402cfb
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x18], 0x10
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x402cfb
lea eax, [esp + 0x28]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x402c90
sub eax, edx
je 0x402cfb
mov ecx, edi
lea eax, [esp + 0x28]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x402cc1
cmp dl, bl
je 0x402cbd
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x402cc1
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x402ca1
xor eax, eax
jmp 0x402cc6
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x402cfb
lea eax, [esp + 0x228]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x402cd4
sub eax, edx
je 0x402cfb
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x22c]
push edx
call fcn.00408b6e
add esp, 8
test eax, eax
jne 0x402cfb
lea ebp, [eax + 1]
cmp edi, ebx
je 0x402d08
push edi
call fcn.0040954d
add esp, 4
mov ecx, dword [esp + 0x428]
pop esi
pop edi
mov eax, ebp
pop ebp
pop ebx
xor ecx, esp
call fcn.004089ca
add esp, 0x41c
ret
Function at 0x403100
Capabilities:
Enumerate process modules

Disassembly:
sub esp, 0x22c
mov eax, dword [0x41f050]
xor eax, esp
mov dword [esp + 0x228], eax
push ebp
xor ebp, ebp
test edi, edi
je 0x4031f2
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403124
sub eax, edx
je 0x4031f2
push ebx
push 0
push 0x18
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40315d
pop ebx
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.004089ca
add esp, 0x22c
ret
mov ecx, 0x224
lea eax, [esp + 0xc]
mov byte [eax], 0
inc eax
sub ecx, 1
jne 0x403166
lea eax, [esp + 0xc]
push eax
push ebx
mov dword [esp + 0x14], 0x224
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x4031d2
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ecx]
mov ecx, dword [esp + 0x2c]
push edi
push ecx
call esi
test eax, eax
jne 0x4031cc
lea edx, [esp + 0x10]
push edx
push ebx
call sub.KERNEL32.dll_Module32Next
test eax, eax
jne 0x403190
pop esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov eax, ebp
pop ebp
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.004089ca
add esp, 0x22c
ret
mov ebp, 1
pop esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov eax, ebp
pop ebp
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.004089ca
add esp, 0x22c
ret
mov ecx, dword [esp + 0x22c]
pop ebp
xor ecx, esp
xor eax, eax
call fcn.004089ca
add esp, 0x22c
ret
Function at 0x403210
Capabilities:
Get common file path

Disassembly:
sub esp, 0x52c
mov eax, dword [0x41f050]
xor eax, esp
mov dword [esp + 0x528], eax
push ebx
push esi
xor ebx, ebx
push 0x104
lea eax, [esp + 0x21d]
push ebx
push eax
mov byte [esp + 0x224], bl
call fcn.004100c0
push 0x104
lea ecx, [esp + 0x439]
push ebx
push ecx
mov byte [esp + 0x440], bl
call fcn.004100c0
push 0x104
lea edx, [esp + 0x33d]
push ebx
push edx
mov byte [esp + 0x344], bl
call fcn.004100c0
push 0x104
lea eax, [esp + 0x139]
push ebx
push eax
mov byte [esp + 0x140], bl
call fcn.004100c0
push 0x104
lea ecx, [esp + 0x3d]
push ebx
push ecx
mov byte [esp + 0x44], bl
call fcn.004100c0
push 0x41c7f8
lea ecx, [esp + 0x258]
call fcn.00404480
add esp, 0x40
push 0x41c804
lea ecx, [esp + 0x42c]
call fcn.00404480
push str._v5_8
lea ecx, [esp + 0x328]
call fcn.00404480
push 0x41c834
lea ecx, [esp + 0x11c]
call fcn.00404480
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
add esp, 0xc
push ebx
push ebx
push 3
push ebx
push ebx
push ebx
lea edx, [esp + 0x338]
push edx
call esi
cmp eax, 0xffffffff
jne 0x4033d1
push 0x105
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x403339
pop esi
pop ebx
mov ecx, dword [esp + 0x528]
xor ecx, esp
call fcn.004089ca
add esp, 0x52c
ret
lea ecx, [esp + 0x110]
push ecx
lea edx, [esp + 0xc]
push 0x105
push edx
mov byte [esp + 0x17], bl
call fcn.0040976d
add esp, 0xc
push ebx
push 0x2000000
push 3
push ebx
push ebx
push ebx
lea eax, [esp + 0x20]
push eax
call esi
cmp eax, 0xffffffff
jne 0x4033d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x4033d8
push edi
lea edi, [esp + 0x21c]
call fcn.00403100
test eax, eax
je 0x4033b7
lea edi, [esp + 0x42c]
call fcn.00403100
test eax, eax
je 0x4033b7
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x528]
xor ecx, esp
call fcn.004089ca
add esp, 0x52c
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x528]
xor ecx, esp
call fcn.004089ca
add esp, 0x52c
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x530]
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.004089ca
add esp, 0x52c
ret
Function at 0x4038a0
Capabilities:
Get hostname
Get session user name

Disassembly:
sub esp, 0x120
mov eax, dword [0x41f050]
xor eax, esp
mov dword [esp + 0x11c], eax
mov dword [esp + 4], 0
mov dword [esp], 0
mov ecx, 0x111
lea eax, [esp + 8]
lea esp, [esp]
mov byte [eax], 0
inc eax
sub ecx, 1
jne 0x4038d0
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0xc], 0x10
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
jne 0x40390c
xor eax, eax
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.004089ca
add esp, 0x120
ret
lea edx, [esp]
push edx
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 8], 0x101
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x4038f5
push esi
lea ecx, [esp + 0xc]
push edi
push ecx
call fcn.00404480
lea edx, [esp + 0x24]
push edx
mov ecx, edx
call fcn.00404480
add esp, 8
mov esi, 0x420ae8
xor edi, edi
lea esp, [esp]
lea ecx, [esi - 0x10]
lea eax, [esp + 0x10]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x403977
test dl, dl
je 0x403973
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x403977
add eax, 2
add ecx, 2
test dl, dl
jne 0x403957
xor eax, eax
jmp 0x40397c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4039af
mov ecx, esi
lea eax, [esp + 0x20]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4039a6
test dl, dl
je 0x4039a2
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4039a6
add eax, 2
add ecx, 2
test dl, dl
jne 0x403986
xor eax, eax
jmp 0x4039ab
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4039dc
add edi, 0x111
add esi, 0x111
cmp edi, 0xfff
jb 0x403950
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.004089ca
add esp, 0x120
ret
mov ecx, dword [esp + 0x124]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.004089ca
add esp, 0x120
ret

Function at 0x403ba0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test edx, edx
jne 0x403ba7
xor eax, eax
ret
test ecx, ecx
jbe 0x403ba4
not eax
push esi
mov edi, edi
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x420098]
dec ecx
inc edx
test ecx, ecx
jne 0x403bb0
pop esi
not eax
ret
Function at 0x403bd0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 4]
xor eax, eax
push ebp
mov ebp, dword [esp + 0x10]
test edx, edx
jne 0x403be1
pop ebp
ret
push edi
mov edi, dword [esp + 0x10]
test edi, edi
jbe 0x403bfb
test ebp, ebp
je 0x403bfb
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x403bfb
cmp dword [ecx], 4
jae 0x403c00
pop edi
xor eax, eax
pop ebp
ret
push ebx
push esi
mov esi, edi
shr esi, 0xf
mov ebx, esi
shl ebx, 0xf
mov ecx, edi
sub ecx, ebx
test esi, esi
jbe 0x403c65
mov ebx, edx
mov edx, esi
jmp 0x403c20
mov esi, 0x8000
mov edi, ebx
test ebx, ebx
jne 0x403c2f
xor eax, eax
jmp 0x403c52
not eax
movzx ebp, byte [edi]
xor ebp, eax
and ebp, 0xff
shr eax, 8
xor eax, dword [ebp*4 + 0x420098]
dec esi
inc edi
test esi, esi
jne 0x403c31
mov ebp, dword [esp + 0x1c]
not eax
add ebx, 0x8000
sub edx, 1
jne 0x403c20
mov edx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
pop esi
pop ebx
test ecx, ecx
jbe 0x403c74
sub edx, ecx
add edx, edi
call fcn.00403ba0
mov ecx, eax
shr ecx, 0x18
mov byte [ebp], cl
mov edx, eax
shr edx, 0x10
mov ecx, eax
mov byte [ebp + 1], dl
mov edx, dword [esp + 0x18]
shr ecx, 8
mov byte [ebp + 3], al
mov byte [ebp + 2], cl
pop edi
mov dword [edx], 4
mov eax, 1
pop ebp
ret

Function at 0x403d40
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 0x14
push ebp
mov ebp, dword [esp + 0x24]
push esi
xor esi, esi
push edi
mov edi, eax
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], esi
cmp edi, esi
jne 0x403d6b
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x14
ret
cmp ebx, esi
jbe 0x403d62
cmp dword [esp + 0x28], esi
je 0x403d62
cmp ebp, esi
je 0x403d62
push 0xf0000000
push 0x18
push esi
push esi
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x403e06
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0xc]
push ecx
push esi
push esi
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x403e06
mov ecx, dword [esp + 0xc]
push esi
push ebx
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x403e06
mov ecx, dword [esp + 0xc]
mov edi, dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push esi
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x20]
push eax
push 4
push ecx
mov dword [esp + 0x28], 4
call edi
test eax, eax
je 0x403e06
mov edx, dword [esp + 0x18]
cmp edx, dword [ebp]
ja 0x403e06
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0xc]
push esi
push ebp
push eax
push 2
push ecx
call edi
mov edi, 1
test eax, eax
jne 0x403e08
mov edi, esi
mov eax, dword [esp + 0xc]
cmp eax, esi
je 0x403e17
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x403e27
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 0x14
ret
Function at 0x404440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test edi, edi
je 0x404470
push esi
push eax
call fcn.0040a281
add esp, 4
xor esi, esi
test ebx, ebx
jbe 0x40446f
call fcn.0040a293
and eax, 0x800000ff
jns 0x404467
dec eax
or eax, 0xffffff00
inc eax
xor byte [esi + edi], al
inc esi
cmp esi, ebx
jb 0x404454
pop esi
ret

Function at 0x404580
Capabilities:
Check if file exists

Disassembly:
push ecx
test ebx, ebx
je 0x4045f7
mov eax, ebx
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404590
sub eax, edx
je 0x4045f7
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push edi
xor edi, edi
lea esp, [esp]
push 0
push 0
push 3
push 0
push 7
push 0x40000000
push ebx
call esi
cmp eax, 0xffffffff
jne 0x4045e6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x4045df
push 5
call ebp
inc edi
cmp edi, 0x258
jb 0x4045b0
pop edi
pop esi
xor eax, eax
pop ebp
pop ecx
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebp
pop ecx
ret
xor eax, eax
pop ecx
ret

Function at 0x404ea0
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x20
push esi
lea eax, [esp + 4]
push eax
push 0x28
mov dword [esp + 0xc], 0
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x404f2c
lea ecx, [esp + 8]
push ecx
push str.SeDebugPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x404f2c
mov ecx, 0x10
lea eax, [esp + 0x10]
mov byte [eax], 0
inc eax
sub ecx, 1
jne 0x404ee4
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
push ecx
push ecx
push 0x10
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x14]
push 0
push edx
mov dword [esp + 0x28], 1
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x404f2c
mov esi, 1
mov eax, dword [esp + 4]
test eax, eax
je 0x404f3b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
add esp, 0x20
ret
Function at 0x404f50
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x110
mov eax, dword [0x41f050]
xor eax, esp
mov dword [esp + 0x10c], eax
push ebx
push ebp
push esi
push edi
push 0x104
lea eax, [esp + 0x19]
push 0
push eax
mov byte [esp + 0x20], 0
call fcn.004100c0
push 0x41c720
lea ecx, [esp + 0x24]
call fcn.00404480
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateMutexA]
lea ecx, [esp + 0x24]
add esp, 0x10
xor edi, edi
test ecx, ecx
je 0x404fef
mov eax, ecx
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404fb0
sub eax, edx
je 0x404fef
lea edx, [esp + 0x14]
push edx
push 0
push 0
call ebx
mov esi, eax
test esi, esi
je 0x404fef
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x404fde
mov edi, 1
push esi
call ebp
test edi, edi
je 0x404fef
mov eax, 1
jmp 0x4050b7
push str._VQFA
lea ecx, [esp + 0x18]
call fcn.00404480
lea eax, [esp + 0x18]
add esp, 4
xor edi, edi
test eax, eax
je 0x40504c
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405010
sub eax, edx
je 0x40504c
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
call ebx
mov esi, eax
test esi, esi
je 0x40504c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40503e
mov edi, 1
push esi
call ebp
test edi, edi
je 0x40504c
mov eax, 2
jmp 0x4050b7
push 0x41c770
lea ecx, [esp + 0x18]
call fcn.00404480
add esp, 4
lea edx, [esp + 0x14]
call fcn.004050d0
test eax, eax
je 0x405071
mov eax, 3
jmp 0x4050b7
push 0x41c798
lea ecx, [esp + 0x18]
call fcn.00404480
add esp, 4
lea edx, [esp + 0x14]
call fcn.004050d0
test eax, eax
je 0x405096
mov eax, 4
jmp 0x4050b7
push str.___W26
lea ecx, [esp + 0x18]
call fcn.00404480
add esp, 4
lea edx, [esp + 0x14]
call fcn.004050d0
neg eax
sbb eax, eax
and eax, 5
mov ecx, dword [esp + 0x11c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004089ca
add esp, 0x110
ret

Function at 0x4050d0
Capabilities:
Check mutex on windows

Disassembly:
push ecx
push esi
push edi
xor edi, edi
test edx, edx
je 0x40511b
mov eax, edx
lea esi, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4050e0
sub eax, esi
je 0x40511b
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x405115
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40510e
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ecx
ret
pop edi
xor eax, eax
pop esi
pop ecx
ret

Function at 0x405350
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [0x4d5edc], 0
mov dword [esp], 0
jne 0x405382
mov eax, dword [0x4d5ee0]
test eax, eax
je 0x405382
lea ecx, [esp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x405382
cmp dword [esp], 0x103
je 0x4053b6
push 0
push 0
push 0
push 0x405250
push 0
push 0
mov dword [0x4d5edc], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4d5ee0], eax
test eax, eax
jne 0x4053b6
mov dword [0x4d5edc], 1
pop ecx
ret
mov eax, 1
pop ecx
ret
Function at 0x4053c0
Capabilities:
Terminate thread

Disassembly:
cmp dword [0x4d5edc], 0
jne 0x40542d
mov eax, dword [0x4d5ee0]
test eax, eax
je 0x40542d
push 0x2710
push eax
mov dword [0x4d5edc], 1
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4053f7
mov dword [0x4d5ee0], eax
mov eax, 1
ret
mov eax, dword [0x4d5ee0]
push 0xffffffffffffffff
push eax
mov dword [0x4d5edc], 0
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x40542d
mov dword [0x4d5ee0], 0
mov dword [0x4d5edc], 1
mov eax, 1
ret
xor eax, eax
ret

Function at 0x4054f0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x13c
mov eax, dword [0x41f050]
xor eax, esp
mov dword [esp + 0x134], eax
push ebx
push esi
or ebx, 0xffffffff
xor esi, esi
test edi, edi
je 0x40557f
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405514
sub eax, edx
je 0x40557f
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x405586
mov ecx, 0x128
lea eax, [esp + 0x10]
mov byte [eax], 0
inc eax
sub ecx, 1
jne 0x405538
lea eax, [esp + 0x10]
push eax
push esi
mov dword [esp + 0x18], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x40557f
lea ecx, [esp + 0x34]
push edi
push ecx
call fcn.00408b6e
add esp, 8
test eax, eax
je 0x40557b
lea edx, [esp + 0x10]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x405558
jmp 0x40557f
mov ebx, dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x13c]
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.004089ca
add esp, 0x13c
ret