joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ad80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea eax, [ebp + eax - 0x230]
push eax
call fcn.00408d90
add esp, 0xc
jmp 0x40ad97

Function at 0x40b420
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40c4f3
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x412018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0040ad80
add esp, 0x10
lea ecx, [ebp - 0x42c]
call fcn.00409660
mov dword [ebp - 4], 0
mov byte [ebp - 0x42d], 0
lea ecx, [ebp - 0x42d]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x42c]
call fcn.004096e0
xor ecx, ecx
mov word [ebp - 0x21c], cx
push 0x206
push 0
lea edx, [ebp - 0x21a]
push edx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push 0x2b
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jge 0x40b4e2
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x42c]
call fcn.004093e0
jmp 0x40b531
push str.AdobeARM1.0Temp
push 0x104
lea ecx, [ebp - 0x21c]
push ecx
call fcn.004063f0
test eax, eax
jge 0x40b510
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x42c]
call fcn.004093e0
jmp 0x40b531
lea edx, [ebp - 0x21c]
push edx
call fcn.0040a950
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x42c]
call fcn.004093e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00407668
mov esp, ebp
pop ebp
ret
Function at 0x407110
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
mov edi, edx
cmp dword [ecx], edi
jne 0x4071d4
cmp dword [ecx + 8], 0xffffff65
jne 0x4071d4
movzx eax, word [ecx + 0xc]
sub eax, 0x41
je 0x40717f
sub eax, 2
jne 0x4071d4
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x4071d4
mov ecx, edi
call fcn.00427020
mov esi, eax
mov ecx, edi
mov edx, esi
call fcn.00414b60
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4071d4
call fcn.00412410
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x4071d4
push 0
push 0
push 0x1004
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4071d4
xor esi, esi
test ebx, ebx
je 0x4071d4
lea esp, [esp]
lea eax, [ebp - 0x40]
mov dword [ebp - 0x30], 2
push eax
push esi
push 0x102b
push edi
mov dword [ebp - 0x34], 2
call dword [sym.imp.USER32.dll_SendMessageW]
inc esi
cmp esi, ebx
jb 0x4071b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410c20
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x454050
push 0x42de70
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [section..data]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, edx
mov esi, ecx
mov dword [esi + 4], edi
mov ebx, dword [ebp + 8]
mov dword [esi + 8], ebx
mov dword [ebp - 4], 0
push 0x40
call fcn.00411030
mov dword [ebp - 4], 0xfffffffe
mov eax, 0x5a4d
cmp word [edi], ax
je 0x410c98
mov eax, 0xc000012f
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x410d70
cmp eax, 0x10000000
jae 0x410d70
cmp eax, ebx
jae 0x410d70
lea edx, [eax + edi]
mov dword [esi + 0xc], edx
mov dword [ebp - 4], 1
push 0x18
mov ecx, esi
call fcn.00411030
mov edx, dword [esi + 0xc]
movzx eax, word [edx + 6]
lea ecx, [eax + eax*4]
movzx eax, word [edx + 0x14]
lea eax, [eax + ecx*8]
add eax, 0x18
push eax
mov ecx, esi
call fcn.00411030
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [esi + 0xc]
cmp dword [ecx], 0x4550
jne 0x410d70
movzx eax, word [ecx + 0x18]
mov word [esi + 0x18], ax
mov edx, 0x10b
cmp ax, dx
je 0x410d16
mov edx, 0x20b
cmp ax, dx
jne 0x410d70
movzx eax, word [ecx + 6]
mov dword [esi + 0x10], eax
movzx eax, word [ecx + 0x14]
add eax, 0x18
add eax, ecx
mov dword [esi + 0x14], eax
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, 0xc000007b
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x410eb0
Capabilities:
Get file attributes
Map section object

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x28], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
test ecx, ecx
jne 0x410eef
mov eax, 0xc0000030
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0042d1c6
mov esp, ebp
pop ebp
ret 0xc
push 0
push 0
lea eax, [ebp - 0x48]
push eax
push ecx
call dword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U_WithStatus]
mov esi, eax
test esi, esi
js 0x411016
push 0
push 0
push 0x60
push 1
push 1
push 0x80
lea eax, [ebp - 0x48]
mov dword [ebp - 0x60], 0x18
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x68]
push 0
push eax
lea eax, [ebp - 0x60]
mov dword [ebp - 0x5c], 0
push eax
push 0x100081
lea eax, [ebp - 0x38]
mov dword [ebp - 0x54], 0x40
push eax
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
call dword [sym.imp.ntdll.dll_NtCreateFile]
mov esi, eax
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
test esi, esi
js 0x411016
mov edi, dword [ebp - 0x38]
lea eax, [ebp - 0x24]
push 5
push 0x18
push eax
lea eax, [ebp - 0x70]
push eax
push edi
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov ecx, eax
test ecx, ecx
jns 0x410f8d
mov esi, eax
jmp 0x410f9b
mov eax, dword [ebp - 0x1c]
mov esi, ecx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], eax
test ecx, ecx
js 0x411001
push edi
push 0x8000000
push 2
lea eax, [ebp - 0x34]
push eax
push 0
push 0xf001f
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.ntdll.dll_NtCreateSection]
mov esi, eax
test esi, esi
js 0x411001
mov eax, dword [ebp - 0x34]
push 2
push 0
push 1
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x3c]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 0xffffffffffffffff
push dword [ebp - 0x28]
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov esi, eax
test esi, esi
js 0x411001
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x2c]
mov dword [ebx], eax
mov eax, dword [ebp - 0x34]
mov dword [ecx], eax
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x41100f
push eax
call dword [sym.imp.ntdll.dll_NtClose]
push edi
call dword [sym.imp.ntdll.dll_NtClose]
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042d1c6
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4125c0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
push dword [0x458940]
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test edi, edi
jne 0x4125db
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [esi]
cmp eax, 0x40
jae 0x4125ed
mov dword [esi + eax*4 + 4], edi
mov eax, edi
inc dword [esi]
pop edi
pop esi
ret
cmp dword [esi + 0x10c], 0
jne 0x412619
push 0x100
push 4
push dword [0x458d0c]
mov dword [esi + 0x108], 0x40
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [esi + 0x10c], eax
mov ecx, dword [esi + 0x104]
mov eax, dword [esi + 0x108]
cmp ecx, eax
jne 0x412655
add eax, eax
mov dword [esi + 0x108], eax
shl eax, 2
push eax
push dword [esi + 0x10c]
push 4
push dword [0x458d0c]
call dword [sym.imp.ntdll.dll_RtlReAllocateHeap]
mov ecx, dword [esi + 0x104]
mov dword [esi + 0x10c], eax
mov eax, dword [esi + 0x10c]
mov dword [eax + ecx*4], edi
mov eax, edi
inc dword [esi + 0x104]
pop edi
pop esi
ret

Function at 0x414310
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
push 0xa
push 0x415200
mov edx, 0x4151d0
mov ecx, 0xc
call fcn.00413e70
push 0
mov dword [0x45896c], eax
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
test esi, esi
je 0x41435a
push 0x5a
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push esi
push 0
mov dword [0x4577b8], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.shlwapi.dll
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp dword [0x458d14], 0x3e
mov esi, eax
mov ebx, 0x5a4d
jb 0x4143cb
call fcn.0041a6c0
mov ecx, eax
test ecx, ecx
je 0x4143cb
cmp word [ecx], bx
jne 0x4143cb
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x4143cb
cmp eax, 0x10000000
jae 0x4143cb
cmp dword [eax + ecx], 0x4550
jne 0x4143cb
lea edx, [eax + 0x78]
mov eax, dword [edx + ecx]
add edx, ecx
test eax, eax
je 0x4143cb
cmp dword [edx + 4], 0
je 0x4143cb
push 0
push str.IsImmersiveProcess
add eax, ecx
push eax
push edx
call fcn.0041a7d0
cmp word [edi], bx
jne 0x414408
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x414408
cmp eax, 0x10000000
jae 0x414408
cmp dword [eax + edi], 0x4550
jne 0x414408
lea ecx, [eax + 0x78]
mov eax, dword [ecx + edi]
add ecx, edi
test eax, eax
je 0x414408
cmp dword [ecx + 4], 0
je 0x414408
push 0x3d
push 0
add eax, edi
push eax
push ecx
mov ecx, edi
call fcn.0041a7d0
cmp word [esi], bx
jne 0x414448
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x414448
cmp eax, 0x10000000
jae 0x414448
cmp dword [eax + esi], 0x4550
jne 0x414448
lea ecx, [eax + 0x78]
mov eax, dword [ecx + esi]
add ecx, esi
test eax, eax
je 0x414448
cmp dword [ecx + 4], 0
je 0x414448
push 0
push str.SHAutoComplete
add eax, esi
push eax
push ecx
mov ecx, esi
call fcn.0041a7d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414b60
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
mov eax, dword [edi]
add eax, 2
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push dword [edi]
mov esi, eax
push dword [edi + 4]
push esi
call fcn.0042ea70
mov ecx, dword [edi]
add esp, 0xc
xor eax, eax
push esi
mov word [esi + ecx], ax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x414bd4
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov esi, dword [ebp - 4]
test eax, eax
je 0x414bd7
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x414bd7
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414bf0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
push ebx
push esi
push dword [0x458940]
mov ebx, ecx
mov dword [ebp - 0x138], 0
mov dword [ebp - 4], ebx
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x138]
push eax
push dword [0x458940]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x414c50
push 0xc0000001
call dword [sym.imp.ntdll.dll_RtlRaiseStatus]
call dword [sym.imp.USER32.dll_GetFocus]
mov esi, dword [ebx + 8]
mov dword [ebp - 8], eax
test esi, esi
je 0x414c9c
push 0xfffffffffffffff0
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x40000000
je 0x414c7f
push esi
call dword [sym.imp.USER32.dll_GetParent]
mov esi, eax
test esi, esi
jne 0x414c60
jmp 0x414c9c
test esi, esi
je 0x414c9c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp esi, eax
je 0x414c9a
push 0
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
test eax, eax
je 0x414c9c
xor esi, esi
or dword [ebx + 4], 0x400
push ebx
call dword [sym.imp.COMCTL32.dll_PropertySheetW]
mov ebx, eax
test ebx, ebx
jne 0x414cc5
test esi, esi
je 0x414cbd
push 1
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push 0
push 0
push 0
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
mov edi, eax
test edi, edi
je 0x414d4a
lea esp, [esp]
cmp edi, 0xffffffff
je 0x414d46
lea eax, [ebp - 0x24]
push eax
push 0
push 0x475
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jne 0x414d0f
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
lea ecx, [ebp - 0x138]
call fcn.00412500
push 0
push 0
push 0x476
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x414d46
push 0
push 0
push 0
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
mov edi, eax
test edi, edi
jne 0x414ce0
jmp 0x414d4a
test edi, edi
jne 0x414d53
push dword [ebp - 0x1c]
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov edi, dword [ebp - 4]
cmp dword [edi + 8], 0
je 0x414d6f
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, ebx
jne 0x414d6f
push dword [edi + 8]
call dword [sym.imp.USER32.dll_SetActiveWindow]
pop edi
test esi, esi
je 0x414d7d
push 1
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
mov esi, dword [ebp - 8]
test esi, esi
je 0x414d96
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x414d96
push esi
call dword [sym.imp.USER32.dll_SetFocus]
push ebx
call dword [sym.imp.USER32.dll_DestroyWindow]
lea ecx, [ebp - 0x138]
call fcn.004124a0
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x418c70
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
mov eax, edi
and eax, 0xfff0000
cmp eax, 0x70000
je 0x418cc5
lea eax, [ebp - 4]
mov dword [ebp - 0x14], 0x140012
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], 0x4523a0
push eax
push 0
push 0
call dword [sym.imp.ntdll.dll_LdrGetDllHandle]
xor esi, esi
test eax, eax
push edi
cmovns esi, dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
mov ecx, esi
push eax
call fcn.00418be0
jmp 0x418ccd
movzx ecx, di
call fcn.00418dc0
mov esi, eax
test esi, esi
je 0x418cdc
cmp dword [esi], 0
je 0x418cdc
xor al, al
jmp 0x418cde
mov al, 1
test al, al
jne 0x418daf
mov ecx, dword [esi + 4]
call fcn.00412950
add eax, eax
mov dword [esi], eax
cmp eax, 4
jb 0x418d31
mov ecx, dword [esi + 4]
mov edx, eax
shr edx, 1
cmp word [ecx + edx*2 - 4], 0xd
jne 0x418d31
cmp word [ecx + edx*2 - 2], 0xa
jne 0x418d31
lea edx, [eax - 4]
call fcn.00412e50
mov ecx, esi
mov esi, eax
test ecx, ecx
je 0x418d31
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x418d31
call fcn.00412410
mov eax, dword [esi + 4]
cmp word [eax], 0x7b
jne 0x418daf
lea eax, [ebp - 0xc]
mov edx, 0xa
push eax
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
call fcn.00412de0
test al, al
je 0x418daf
mov ebx, dword [ebp - 0xc]
test ebx, ebx
jne 0x418d62
call fcn.00412ea0
mov edi, eax
jmp 0x418d94
mov edx, dword [0x458d34]
lea ecx, [ebx + 0xa]
call fcn.00412330
mov edi, eax
xor ecx, ecx
lea eax, [edi + 8]
mov dword [edi + 4], eax
mov dword [edi], ebx
mov word [eax + ebx], cx
mov eax, dword [ebp - 8]
test eax, eax
je 0x418d94
push ebx
push eax
push dword [edi + 4]
call fcn.0042ea70
add esp, 0xc
mov ecx, esi
mov esi, edi
test ecx, ecx
je 0x418daf
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x418daf
call fcn.00412410
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x418dc0
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
lea eax, [ebp - 4]
mov dword [ebp - 0x10], 0x1a0018
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], str.kernel32.dll
push eax
push 0
push 0
mov edi, ecx
call dword [sym.imp.ntdll.dll_LdrGetDllHandle]
xor esi, esi
test eax, eax
push edi
cmovns esi, dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
mov ecx, esi
push eax
call fcn.00418be0
mov esi, eax
test esi, esi
je 0x418e5d
mov ecx, dword [esi + 4]
call fcn.00412950
add eax, eax
mov dword [esi], eax
cmp eax, 4
jb 0x418e5b
mov ecx, dword [esi + 4]
mov edx, eax
shr edx, 1
cmp word [ecx + edx*2 - 4], 0xd
jne 0x418e5b
cmp word [ecx + edx*2 - 2], 0xa
jne 0x418e5b
lea edx, [eax - 4]
call fcn.00412e50
mov edi, eax
test esi, esi
je 0x418e5d
lea ecx, [esi - 8]
or edx, 0xffffffff
lock xadd dword [ecx + 4], edx
dec edx
jne 0x418e5d
call fcn.00412410
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4199e0
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov ecx, dword [0x4589b0]
test ecx, ecx
je 0x419a00
mov eax, dword [0x4589ac]
mov dword [esi], eax
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x7ffe0030
call fcn.00412950
add eax, eax
cmp word [eax + 0x7ffe002e], 0x5c
jne 0x419a19
add eax, 0xfffffffe
mov dword [esi], eax
xor ecx, ecx
mov dword [0x4589ac], eax
lea eax, [ebp - 4]
mov dword [esi + 4], 0x7ffe0030
lock or dword [eax], ecx
mov dword [0x4589b0], 0x7ffe0030
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41a330
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
test byte [0x457a18], 1
push ebx
push esi
push edi
jne 0x41a4d0
mov eax, 0x457a18
lock bts dword [eax], 0x1f
jae 0x41a375
test byte [0x457a18], 1
jne 0x41a4d0
mov ecx, eax
call fcn.00429b00
jmp 0x41a4d0
push 2
push 0x457a20
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ntdll.dll_RtlInitializeSid]
push 0
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ntdll.dll_RtlSubAuthoritySid]
push 1
mov dword [eax], 0x20
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ntdll.dll_RtlSubAuthoritySid]
push 0x4577c8
mov dword [eax], 0x220
call dword [sym.imp.ntdll.dll_RtlLengthSid]
mov esi, eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ntdll.dll_RtlLengthSid]
push 0x4577bc
add esi, eax
call dword [sym.imp.ntdll.dll_RtlLengthSid]
add eax, 0x40
add esi, eax
push esi
push 4
push dword [0x458d0c]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ebx, eax
push 1
push ebx
lea edi, [ebx + 0x14]
call dword [sym.imp.ntdll.dll_RtlCreateSecurityDescriptor]
push 2
lea ecx, [esi - 0x14]
push ecx
push edi
call dword [sym.imp.ntdll.dll_RtlCreateAcl]
push 0x4577bc
push 0xf000f
push 2
push edi
call dword [sym.imp.ntdll.dll_RtlAddAccessAllowedAce]
lea eax, [ebp - 0x14]
push eax
push 0xf000f
push 2
push edi
call dword [sym.imp.ntdll.dll_RtlAddAccessAllowedAce]
push 0x4577c8
push 7
push 2
push edi
call dword [sym.imp.ntdll.dll_RtlAddAccessAllowedAce]
push 0
push edi
push 1
push ebx
call dword [sym.imp.ntdll.dll_RtlSetDaclSecurityDescriptor]
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x18
push eax
push 0x2000000
push 0x4589a8
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x20], 0x80
mov dword [ebp - 0x24], 0x457a28
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], 0
call dword [sym.imp.ntdll.dll_NtCreateDirectoryObject]
push ebx
push 0
push dword [0x458d0c]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov edi, 0x457a18
lock bts dword [edi], 0
jb 0x41a4d0
mov esi, dword [0x457a1c]
test esi, esi
je 0x41a4a6
push 0
push esi
call dword [sym.imp.ntdll.dll_NtSetEvent]
mov eax, 0xfffffffe
lock xadd dword [edi], eax
shr eax, 1
and eax, 0x7fff
sub eax, 1
jne 0x41a4d0
test esi, esi
je 0x41a4d0
push esi
call dword [sym.imp.ntdll.dll_NtClose]
mov dword [0x457a1c], 0
mov ecx, dword [ebp - 4]
mov eax, dword [0x4589a8]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0042d1c6
mov esp, ebp
pop ebp
ret
Function at 0x41a4f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x10], eax
mov edi, ecx
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 0x14]
push eax
push 3
lea eax, [ebp - 0x10]
mov dword [ebp - 0x20], ecx
push eax
push edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], 0
call dword [sym.imp.ntdll.dll_LdrFindResource_U]
test eax, eax
js 0x41a58b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x14]
push edi
call dword [sym.imp.ntdll.dll_LdrAccessResource]
test eax, eax
js 0x41a58b
push ebx
mov ebx, dword [ebp - 0x18]
test esi, esi
je 0x41a552
mov dword [esi], ebx
mov edi, dword [ebp - 0x1c]
push ebx
push 4
push dword [0x458d0c]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push ebx
mov esi, eax
push edi
push esi
call fcn.0042ea70
mov eax, dword [ebp - 0x20]
add esp, 0xc
pop ebx
mov dword [eax], esi
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042d1c6
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.0042d1c6
mov esp, ebp
pop ebp
ret 0xc

Function at 0x41a5a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
test byte [0x457a30], 1
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
jne 0x41a689
mov esi, 0x457a30
lock bts dword [esi], 0x1f
jae 0x41a5e0
test byte [0x457a30], 1
jne 0x41a689
mov ecx, esi
call fcn.00429b00
jmp 0x41a689
cmp dword [0x4589a4], 0
jne 0x41a640
call fcn.0041a6c0
mov ecx, eax
test ecx, ecx
je 0x41a639
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x41a639
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x41a639
cmp eax, 0x10000000
jae 0x41a639
cmp dword [eax + ecx], 0x4550
jne 0x41a639
lea edx, [eax + 0x78]
mov eax, dword [edx + ecx]
add edx, ecx
test eax, eax
je 0x41a639
cmp dword [edx + 4], 0
je 0x41a639
push 0
push str.PrivateExtractIconExW
add eax, ecx
push eax
push edx
call fcn.0041a7d0
jmp 0x41a63b
xor eax, eax
mov dword [0x4589a4], eax
lock bts dword [esi], 0
jb 0x41a689
mov esi, dword [0x457a34]
test esi, esi
je 0x41a65a
push 0
push esi
call dword [sym.imp.ntdll.dll_NtSetEvent]
mov eax, 0xfffffffe
mov ecx, 0x457a30
lock xadd dword [ecx], eax
shr eax, 1
and eax, 0x7fff
sub eax, 1
jne 0x41a689
test esi, esi
je 0x41a689
push esi
call dword [sym.imp.ntdll.dll_NtClose]
mov dword [0x457a34], 0
mov esi, dword [0x4589a4]
test esi, esi
jne 0x41a69e
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 1
push dword [ebp + 8]
mov ecx, esi
push edi
push 0
push ebx
call dword [0x4484cc]
call esi
pop edi
test eax, eax
pop esi
setne al
pop ebx
mov esp, ebp
pop ebp
ret 4