joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ac910
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5ac9fe
movzx eax, byte [esp + 0xc]
test al, al
je 0x5ac9f1
mov eax, dword [esp + 8]
cmp eax, 1
jle 0x5ac9eb
mov ecx, dword [esp + 4]
movzx edx, byte [ecx]
cmp dl, 0x22
jne 0x5ac977
lea edx, [eax - 1]
cmp edx, eax
jae 0x5ac9e4
movzx ebx, byte [ecx + eax - 1]
cmp bl, 0x22
jne 0x5ac977
cmp edx, 1
jb 0x5ac9dd
lea edx, [eax - 3]
sar edx, 0x1f
xor edx, 0xffffffff
and edx, 1
add ecx, edx
add eax, 0xfffffffe
xor edx, edx
cmp edx, eax
jge 0x5ac9a6
jae 0x5ac9d6
movzx ebx, byte [ecx + edx]
lea ebp, [ebx - 0x20]
xchg ebp, eax
cmp al, 0x5f
xchg ebp, eax
jae 0x5ac9d2
cmp bl, 0x22
je 0x5ac9ce
cmp bl, 0x3b
je 0x5ac9ca
cmp bl, 0x5c
setne bl
test bl, bl
je 0x5ac9b4
inc edx
cmp edx, eax
jl 0x5ac97d
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
mov byte [esp + 0x18], 1
ret
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov byte [esp + 0x18], 0
ret
xor ebx, ebx
jmp 0x5ac99d
xor ebx, ebx
jmp 0x5ac99d
xor ebx, ebx
jmp 0x5ac99d
call fcn.00424680
ud2
call fcn.004246e0
ud2
call fcn.00424680
ud2
mov ecx, dword [esp + 4]
jmp 0x5ac977
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
jmp 0x5ac977
call fcn.004486b0
jmp fcn.005ac910

Function at 0x5b0bc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5b0c87
sub esp, 4
mov eax, dword [esp + 8]
test byte [eax], al
mov dword [esp], eax
call fcn.005af090
mov eax, dword [esp + 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
mov eax, dword [eax + 0x14]
movzx ebx, word [esp + 0xc]
test edx, edx
jle 0x5b0c30
cmp eax, 2
jb 0x5b0c80
movzx ebp, byte [ecx + 1]
movzx esi, byte [ecx]
shl esi, 8
or esi, ebp
cmp bx, si
je 0x5b0c48
cmp edx, 6
jb 0x5b0c41
lea ebp, [eax - 7]
sar ebp, 0x1f
xor ebp, 0xffffffff
and ebp, 6
add ecx, ebp
add edx, 0xfffffffa
add eax, 0xfffffffa
test edx, edx
jg 0x5b0bfd
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
add esp, 4
ret
call fcn.004246e0
ud2
cmp eax, 6
jb 0x5b0c79
movzx eax, byte [ecx + 3]
movzx edx, byte [ecx + 2]
movzx ebx, byte [ecx + 5]
movzx ecx, byte [ecx + 4]
shl ecx, 8
or ecx, ebx
shl eax, 0x10
or ecx, eax
shl edx, 0x18
or ecx, edx
mov dword [esp + 0x10], ecx
mov byte [esp + 0x14], 1
add esp, 4
ret
call fcn.004246e0
ud2
call fcn.004246e0
ud2
call fcn.004486b0
jmp fcn.005b0bc0
Function at 0x5efe10
Capabilities:
Compute adler32 checksum

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5eff78
sub esp, 0x14
mov ecx, dword [esp + 0x18]
mov edx, ecx
and ecx, 0xffff
shr edx, 0x10
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
test esi, esi
jle 0x5eff53
cmp esi, 0x15b0
jle 0x5eff67
cmp ebp, 0x15b0
jb 0x5eff60
lea edi, [ebp - 0x15b1]
sar edi, 0x1f
xor edi, 0xffffffff
and edi, 0x15b0
add edi, ebx
add esi, 0xffffea50
mov eax, ecx
lea ecx, [ebp - 0x15b0]
mov dword [esp + 0xc], eax
mov eax, 0x15b0
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x20]
cmp ecx, 4
jl 0x5efef0
movzx esi, byte [ebx]
add eax, esi
add edx, eax
movzx esi, byte [ebx + 1]
add eax, esi
add edx, eax
movzx esi, byte [ebx + 2]
add eax, esi
add edx, eax
movzx esi, byte [ebx + 3]
add eax, esi
add edx, eax
lea esi, [ebp - 5]
sar esi, 0x1f
xor esi, 0xffffffff
and esi, 4
add ebx, esi
add ecx, 0xfffffffc
add ebp, 0xfffffffc
mov esi, dword [esp + 4]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 8]
mov ecx, dword [esp + 0x20]
cmp ecx, 4
jge 0x5efea8
xor ebp, ebp
cmp ebp, ecx
jge 0x5eff0b
lea esi, [ebx + 1]
inc ebp
movzx ebx, byte [ebx]
add eax, ebx
add edx, eax
mov ebx, esi
mov esi, dword [esp + 4]
cmp ebp, ecx
jl 0x5efef6
mov dword [esp], eax
mov ecx, edi
mov edi, 0x80078071
mov ebx, edx
mul edi
shr edx, 0xf
imul edx, edx, 0xfff1
mov edi, dword [esp]
sub edi, edx
mov eax, ebx
mov edx, edi
mov edi, 0x80078071
mov ebp, edx
mul edi
shr edx, 0xf
imul edx, edx, 0xfff1
sub ebx, edx
mov eax, dword [esp + 8]
mov edx, ebx
mov ebx, ecx
mov ecx, ebp
mov ebp, eax
test esi, esi
jg 0x5efe4c
shl edx, 0x10
or edx, ecx
mov dword [esp + 0x28], edx
add esp, 0x14
ret
call fcn.004246e0
ud2
mov eax, ecx
mov dword [esp + 0x20], esi
xor edi, edi
xor esi, esi
xor ecx, ecx
jmp 0x5efe97
call fcn.004486b0
jmp fcn.005efe10
Function at 0x6444e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6445c2
sub esp, 0x14
mov eax, dword [esp + 0x18]
mov dword [esp], eax
mov ecx, dword [esp + 0x1c]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x20]
mov dword [esp + 8], edx
call fcn.00644300
mov eax, dword [esp + 0x1c]
lea ecx, [eax - 8]
cmp ecx, eax
ja 0x6445bb
sub eax, ecx
mov edx, dword [esp + 0x20]
sub edx, ecx
dec edx
sar edx, 0x1f
xor edx, 0xffffffff
and ecx, edx
cmp eax, 7
jbe 0x6445b4
mov eax, dword [esp + 0x18]
movzx edx, byte [eax + ecx + 1]
movzx ebx, byte [eax + ecx + 2]
movzx ebp, byte [eax + ecx]
movzx esi, byte [eax + ecx + 3]
movzx edi, byte [eax + ecx + 4]
mov dword [esp + 0x10], edi
movzx edi, byte [eax + ecx + 5]
mov dword [esp + 0xc], edi
movzx edi, byte [eax + ecx + 6]
movzx eax, byte [eax + ecx + 7]
mov ecx, edx
shl edx, 8
or ebp, edx
mov edx, ebx
shl ebx, 0x10
or ebp, ebx
mov ebx, esi
shl esi, 0x18
or ebp, esi
mov dword [esp + 0x24], ebp
shr ecx, 0x18
shr edx, 0x10
or ecx, edx
shr ebx, 8
or ecx, ebx
mov edx, dword [esp + 0x10]
or ecx, edx
mov edx, dword [esp + 0xc]
shl edx, 8
or ecx, edx
shl edi, 0x10
or ecx, edi
shl eax, 0x18
or ecx, eax
mov dword [esp + 0x28], ecx
add esp, 0x14
ret
call fcn.00424680
ud2
call fcn.004246e0
ud2
call fcn.004486b0
jmp fcn.006444e0
Function at 0x66d600
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x66d843
sub esp, 0x68
mov ecx, dword [esp + 0x70]
movzx edx, byte [ecx + 0x10]
test dl, dl
je 0x66d836
mov eax, dword [ecx + 4]
mov dword [esp + 0x20], eax
mov edx, dword [ecx]
mov ebx, dword [esp + 0x6c]
mov ebp, dword [ebx + 0xc]
mov dword [esp + 0x1c], ebp
mov esi, dword [ebx + 8]
mov dword [esp + 0x28], esi
cmp ebp, eax
jge 0x66d804
xor edx, edx
test dl, dl
je 0x66d7fd
cmp eax, ebp
ja 0x66d7f6
sub ebp, eax
lea edx, [ebp - 1]
sar edx, 0x1f
xor edx, 0xffffffff
and edx, eax
lea eax, [edx + esi]
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
mov edx, dword [ecx + 0x18]
mov esi, dword [ecx + 0x14]
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], edx
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], ebp
lea eax, [esp + 0x40]
mov dword [esp], eax
mov dword [esp + 4], 2
mov dword [esp + 8], 2
call fcn.004d7e30
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x24], ecx
lea edi, [esp + 0x50]
xor eax, eax
call fcn.0044a37a
mov ecx, dword [esp + 0x6c]
test byte [ecx], al
add ecx, 0x10
mov dword [esp + 4], ecx
lea ecx, [0x6b4960]
mov dword [esp], ecx
call fcn.0040a880
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov dword [esp + 0x50], edx
mov dword [esp + 0x54], ecx
mov ecx, dword [esp + 0x70]
lea edx, [ecx + 0x30]
mov dword [esp + 4], edx
lea edx, [0x6b4960]
mov dword [esp], edx
call fcn.0040a880
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov dword [esp + 0x58], edx
mov dword [esp + 0x5c], ecx
mov ecx, dword [esp + 0x70]
add ecx, 0x3c
mov dword [esp + 4], ecx
lea ecx, [0x6b4960]
mov dword [esp], ecx
call fcn.0040a880
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov dword [esp + 0x60], ecx
mov dword [esp + 0x64], edx
lea ecx, [0x7054fc]
mov dword [esp], ecx
mov dword [esp + 4], 7
lea ecx, [esp + 0x50]
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 3
mov dword [esp + 0x10], 3
call fcn.0049a880
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov ebx, dword [esp + 0x2c]
mov dword [esp + 0x30], ebx
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], edx
lea ecx, [esp + 0x30]
mov dword [esp], ecx
mov dword [esp + 4], 2
mov dword [esp + 8], 2
call fcn.004d7e30
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], edx
add esp, 0x68
ret
call fcn.004246e0
ud2
mov eax, esi
jmp 0x66d66e
mov dword [esp], esi
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov dword [esp + 0xc], eax
call fcn.00449f40
movzx edx, byte [esp + 0x10]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x70]
mov ebx, dword [esp + 0x6c]
mov ebp, dword [esp + 0x1c]
mov esi, dword [esp + 0x28]
jmp 0x66d64e
mov edx, dword [ecx + 0x18]
mov eax, dword [ecx + 0x14]
mov ecx, edx
jmp 0x66d6c8
call fcn.004486b0
jmp fcn.0066d600
Function at 0x66da10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x66dc62
sub esp, 0x68
mov ecx, dword [esp + 0x70]
movzx edx, byte [ecx + 0x10]
test dl, dl
je 0x66dc4f
mov eax, dword [ecx + 4]
mov dword [esp + 0x20], eax
mov edx, dword [ecx]
mov ebx, dword [esp + 0x6c]
mov ebp, dword [ebx + 0xc]
mov dword [esp + 0x1c], ebp
mov esi, dword [ebx + 8]
mov dword [esp + 0x28], esi
cmp ebp, eax
jge 0x66dc1d
xor edx, edx
test dl, dl
je 0x66dc16
cmp eax, ebp
ja 0x66dc0f
sub ebp, eax
lea edx, [ebp - 1]
sar edx, 0x1f
xor edx, 0xffffffff
and edx, eax
lea eax, [edx + esi]
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
mov edx, dword [ecx + 0x84]
mov esi, dword [ecx + 0x80]
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], edx
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], ebp
lea eax, [esp + 0x40]
mov dword [esp], eax
mov dword [esp + 4], 2
mov dword [esp + 8], 2
call fcn.004d7e30
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x24], ecx
lea edi, [esp + 0x50]
xor eax, eax
call fcn.0044a37a
mov ecx, dword [esp + 0x6c]
test byte [ecx], al
add ecx, 0x10
mov dword [esp + 4], ecx
lea ecx, [0x6b4960]
mov dword [esp], ecx
call fcn.0040a880
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov dword [esp + 0x50], edx
mov dword [esp + 0x54], ecx
mov ecx, dword [esp + 0x70]
lea edx, [ecx + 0x78]
mov dword [esp + 4], edx
lea edx, [0x6b4960]
mov dword [esp], edx
call fcn.0040a880
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov dword [esp + 0x58], edx
mov dword [esp + 0x5c], ecx
mov ecx, dword [esp + 0x70]
add ecx, 0x90
mov dword [esp + 4], ecx
lea ecx, [0x6b4960]
mov dword [esp], ecx
call fcn.0040a880
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov dword [esp + 0x60], ecx
mov dword [esp + 0x64], edx
lea ecx, [0x7054fc]
mov dword [esp], ecx
mov dword [esp + 4], 7
lea ecx, [esp + 0x50]
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 3
mov dword [esp + 0x10], 3
call fcn.0049a880
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov ebx, dword [esp + 0x2c]
mov dword [esp + 0x30], ebx
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], edx
lea ecx, [esp + 0x30]
mov dword [esp], ecx
mov dword [esp + 4], 2
mov dword [esp + 8], 2
call fcn.004d7e30
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], edx
add esp, 0x68
ret
call fcn.004246e0
ud2
mov eax, esi
jmp 0x66da7e
mov dword [esp], esi
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov dword [esp + 0xc], eax
call fcn.00449f40
movzx edx, byte [esp + 0x10]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x70]
mov ebx, dword [esp + 0x6c]
mov ebp, dword [esp + 0x1c]
mov esi, dword [esp + 0x28]
jmp 0x66da5e
mov edx, dword [ecx + 0x84]
mov eax, dword [ecx + 0x80]
mov ecx, edx
jmp 0x66dade
call fcn.004486b0
jmp fcn.0066da10
Function at 0x432006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
mov eax, section..rsrc
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x432072
mov ebx, 0x40c7d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x340a220f
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x432060
nop
nop
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4320d2
nop
nop
nop
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x15a03873
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x404d70
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x150
mov eax, dword [0x433eb0]
xor eax, esp
mov dword [esp + 0x14c], eax
push ebx
xor ebx, ebx
mov dword [esp + 4], ebx
push edi
mov dword [esi], ebx
mov dword [esi + 0x18], 3
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push str.IsWow64Process
push str.kernel32.dll
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
jne 0x404dc2
xor eax, eax
jmp 0x404de2
lea ecx, [esp + 8]
push ecx
push edi
mov dword [esp + 0x10], ebx
call eax
test eax, eax
jne 0x404dd9
mov eax, 2
jmp 0x404de2
xor eax, eax
cmp dword [esp + 8], ebx
setne al
mov dword [esi + 0x24], eax
push 0x118
lea edx, [esp + 0x38]
push ebx
mov dword [esi + 0x3c], 0xf
mov dword [esi + 0x38], ebx
mov byte [esi + 0x28], bl
push edx
mov dword [esp + 0x3c], 0x11c
call fcn.004137b0
add esp, 0xc
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
cmp eax, 5
jne 0x404e43
cmp ecx, ebx
jle 0x404e76
xor eax, eax
cmp ecx, 1
setne al
inc eax
mov dword [esi], eax
jmp 0x404e76
cmp eax, 6
jne 0x404e6e
sub ecx, ebx
je 0x404e66
dec ecx
je 0x404e5e
dec ecx
je 0x404e56
mov dword [esi], eax
jmp 0x404e76
mov dword [esi], 5
jmp 0x404e76
mov dword [esi], 4
jmp 0x404e76
mov dword [esi], 3
jmp 0x404e76
jle 0x404e76
mov dword [esi], 7
movzx ecx, word [esp + 0x144]
movzx edx, word [esp + 0x146]
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
lea eax, [esp + 0xc]
push eax
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], edx
mov dword [esp + 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [esp + 0xc]
cmp eax, ebx
je 0x404ee2
cmp eax, 6
je 0x404ed9
cmp eax, 9
jne 0x404ee5
mov dword [esi + 0x18], 1
jmp 0x404ee5
mov dword [esi + 0x18], 2
jmp 0x404ee5
mov dword [esi + 0x18], ebx
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x28]
mov dword [esi + 0x1c], ecx
mov ecx, dword [esp + 0x154]
pop edi
pop ebx
xor ecx, esp
mov dword [esi + 0x20], edx
mov eax, esi
call fcn.004134fa
mov esp, ebp
pop ebp
ret

Function at 0x4055d0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
pop ebp
ret
Function at 0x4059a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x490
mov eax, dword [0x433eb0]
xor eax, esp
mov dword [esp + 0x48c], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
push 0
push 2
mov dword [esp + 0x14], 0
mov byte [esp + 0x13], 1
mov dword [esp + 0x240], 0x4304c4
mov byte [esp + 0x248], 0
mov dword [esp + 0x478], eax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
xor ecx, ecx
push 0xffffffffffffffff
push ecx
mov word [esp + 0x47c], cx
push esi
lea ecx, [esp + 0x480]
mov dword [esp + 0x248], eax
mov dword [esp + 0x244], 0x43045c
mov dword [esp + 0x494], 7
mov dword [esp + 0x490], 0
call fcn.00402910
lea esi, [esp + 0x238]
call fcn.004070c0
test eax, eax
je 0x405aeb
mov eax, dword [eax + 8]
push eax
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x405a79
test byte [esp + 0xc], 1
je 0x405a75
and dword [esp + 0xc], 0xfffffffe
lea ecx, [esp + 0x10]
call fcn.00406d40
xor al, al
jmp 0x405ad3
mov edx, dword [ebp + 0xc]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
setne bl
test bl, bl
je 0x405ab2
push 0xea60
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x405aca
test byte [esp + 0xc], 2
je 0x405aca
and dword [esp + 0xc], 0xfffffffd
lea ecx, [esp + 0x180]
jmp 0x405ac5
test byte [esp + 0xc], 4
je 0x405aca
and dword [esp + 0xc], 0xfffffffb
lea ecx, [esp + 0xc8]
call fcn.00406d40
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
and byte [esp + 0xb], al
lea esi, [esp + 0x238]
call fcn.004070c0
test eax, eax
jne 0x405a49
cmp dword [esp + 0x488], 8
mov dword [esp + 0x238], 0x43045c
jb 0x405b10
mov eax, dword [esp + 0x474]
push eax
call fcn.0041275a
add esp, 4
mov edx, dword [esp + 0x23c]
xor ecx, ecx
push edx
mov dword [esp + 0x48c], 7
mov dword [esp + 0x488], 0
mov word [esp + 0x478], cx
mov dword [esp + 0x23c], 0x4304c4
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x494]
mov al, byte [esp + 0xb]
pop esi
pop ebx
xor ecx, esp
call fcn.004134fa
mov esp, ebp
pop ebp
ret
Function at 0x4068b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x288
mov eax, dword [0x433eb0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x10], 0
push edi
je 0x406a5b
cmp byte [0x4379fc], 0
je 0x406a5b
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x210]
push 0x5c
push ecx
call fcn.004132c8
add esp, 8
test eax, eax
je 0x40690d
xor edx, edx
mov word [eax + 2], dx
push str.debug_message.exe
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.00414d61
add esp, 0xc
cmp dword [esi + 0x14], 0x10
jb 0x406930
mov edi, dword [esi]
jmp 0x406932
mov edi, esi
mov esi, dword [esi + 0x10]
xor ecx, ecx
mov word [ebp - 0x22c], cx
push edi
lea ecx, [ebp - 0x22c]
mov eax, esi
mov dword [ebp - 0x218], 7
mov dword [ebp - 0x21c], 0
call fcn.00407380
push esi
push edi
lea eax, [ebp - 0x22c]
call fcn.00405c90
add esp, 0xc
cmp dword [ebp - 0x21c], 0
jne 0x406992
cmp dword [ebp - 0x218], 8
jb 0x406a5b
mov edx, dword [ebp - 0x22c]
push edx
jmp 0x406a53
push 0x44
lea eax, [ebp - 0x288]
push 0
push eax
call fcn.004137b0
mov eax, dword [ebp - 0x22c]
mov edi, 8
add esp, 0xc
mov dword [ebp - 0x288], 0x44
cmp dword [ebp - 0x218], edi
jae 0x4069c8
lea eax, [ebp - 0x22c]
lea ecx, [ebp - 0x23c]
push ecx
lea edx, [ebp - 0x288]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x406a1d
mov ecx, dword [ebp - 0x23c]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 0x238]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [ebp - 0x23c]
push eax
call esi
jmp 0x406a44
mov eax, dword [ebp - 0x22c]
cmp dword [ebp - 0x218], edi
jae 0x406a31
lea eax, [ebp - 0x22c]
push 0x40010
push str.Fatal_error
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp dword [ebp - 0x218], edi
jb 0x406a5b
mov ecx, dword [ebp - 0x22c]
push ecx
call fcn.0041275a
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004134fa
mov esp, ebp
pop ebp
ret
Function at 0x4070c0
Capabilities:
Enumerate processes

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Process32FirstW]
push edi
lea edi, [esi + 0xc]
jmp 0x4070d0
push 0x22c
push 0
push edi
call fcn.004137b0
add esp, 0xc
mov dword [edi], 0x22c
cmp byte [esi + 8], 0
push edi
jne 0x4070f9
mov eax, dword [esi + 4]
push eax
mov byte [esi + 8], 1
call ebx
jmp 0x407103
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
setne al
test al, al
je 0x40711e
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
test al, al
je 0x4070d0
mov eax, edi
pop edi
pop ebx
ret
pop edi
xor eax, eax
pop ebx
ret

Function at 0x407910
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x104
mov eax, dword [0x4352bc]
push ebx
push esi
push edi
mov dword [esp + 0xc], 0
cmp eax, 0xffffffff
je 0x4079bb
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
je 0x4079bb
mov ecx, 0x40
mov esi, ebx
lea edi, [esp + 0x10]
lea eax, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x4352bc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push ebx
call fcn.00413bdb
add esp, 4
mov edi, 0x40
nop
mov esi, dword [0x437adc]
xor ebx, ebx
xor dl, dl
cmp esi, ebx
jle 0x4079a4
mov edi, edi
mov eax, dword [esp + esi*4 + 0x10]
cmp eax, ebx
je 0x40799f
mov ecx, dword [esi*4 + 0x4378e8]
cmp ecx, ebx
je 0x40799f
push eax
mov dword [esp + esi*4 + 0x14], ebx
call ecx
add esp, 4
mov dl, 1
dec esi
cmp esi, ebx
jg 0x407980
dec edi
cmp edi, ebx
jle 0x4079ad
test dl, dl
jne 0x407970
mov edx, dword [0x4352bc]
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x407c1f
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x433eb0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0xc], ebx
mov word [ebp - 8], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x407c60
xor al, al
jmp 0x407c88
push esi
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
mov dword [ebp - 0x10], ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0x14]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp esi, ebx
pop esi
je 0x407c5c
cmp dword [ebp - 0x10], ebx
setne al
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004134fa
leave
ret