joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cdc1c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
test byte [ebp + 0xd], 0xc0
jne 0x4cdc3b
mov eax, dword [0x6054dc]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x4cdc48
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x4cdc75
je 0x4cdc87
sub ecx, 0x100
je 0x4cdc95
sub ecx, 0x100
je 0x4cdc9c
sub ecx, 0x100
je 0x4cdc8e
jmp 0x4cdca3
sub ecx, 0x600
je 0x4cdc9c
sub ecx, 0x100
je 0x4cdc87
jmp 0x4cdca3
mov edi, 1
jmp 0x4cdca8
mov edi, 2
jmp 0x4cdca8
mov edi, 4
jmp 0x4cdca8
mov edi, 5
jmp 0x4cdca8
mov edi, 3
test byte [ebp + 0xd], 1
je 0x4cdccf
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x604f54]
test al, 0x80
je 0x4cdcc8
mov ebx, 0x80
jmp 0x4cdce1
mov ebx, 1
jmp 0x4cdce1
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4cdce1
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x4cdcf3
je 0x4cdcfc
dec eax
je 0x4cdd05
jmp 0x4cdd0e
mov dword [ebp - 4], CreateStatusWindowA
jmp 0x4cdd1d
mov dword [ebp - 4], 0x40000000
jmp 0x4cdd1d
mov dword [ebp - 4], 0xc0000000
jmp 0x4cdd1d
push 1
call fcn.004cecf0
pop ecx
mov ebx, eax
jmp 0x4cde0d
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x4cdd39
sub eax, 0x10
je 0x4cdd40
sub eax, 0x10
je 0x4cdd49
sub eax, 0x10
je 0x4cdd52
jmp 0x4cdd52
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x4cdd59
mov dword [ebp - 8], 1
jmp 0x4cdd59
mov dword [ebp - 8], 2
jmp 0x4cdd59
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileW
mov esi, eax
cmp eax, 0xffffffff
jne 0x4cddc6
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x4cddbb
test byte [ebp + 0xd], 1
je 0x4cddb6
mov ebx, 0x50
jmp 0x4cddbb
mov ebx, 2
push ebx
call fcn.004cecf0
pop ecx
mov ebx, eax
jmp 0x4cde0d
mov edi, esi
push edi
call fcn.004cd7f4
pop ecx
test eax, eax
je 0x4cddda
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x4cdde6
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.004cea34
add esp, 8
mov ebx, eax
inc eax
jne 0x4cde0d
push 4
call fcn.004cecf0
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d17c4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea eax, [ebp - 0x200]
push eax
push 0x1001
mov edx, dword [ebx + 4]
push edx
call sub.KERNEL32.DLL_GetLocaleInfoA
push str._._n
lea ecx, [ebp - 0x200]
push ecx
call fcn.004cc6e0
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.004cc770
pop ecx
mov edx, pe_nt_image_headers32
sub edx, eax
push edx
lea ecx, [ebp - 0x200]
push ecx
call fcn.004cc770
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
push 0x1002
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
push 0x6060c5
lea ecx, [ebp - 0x200]
push ecx
call fcn.004cc6e0
add esp, 8
push 0xa
lea eax, [ebp - 0x200]
push eax
call fcn.004cc770
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
mov ecx, dword [ebx]
push ecx
call fcn.004d2ac4
add esp, 0xc
cmp dword [ebx + 0x24], 0
jne 0x4d18d5
push esi
call fcn.004cc770
pop ecx
mov edi, eax
lea eax, [ebp - 0x200]
push eax
call fcn.004cc770
pop ecx
add edi, eax
add edi, 3
push edi
call fcn.00468260
pop ecx
mov edi, eax
mov dword [ebx + 0x24], edi
test edi, edi
jne 0x4d18ac
xor eax, eax
jmp 0x4d195c
push esi
call fcn.004cc770
pop ecx
push eax
lea edx, [ebp - 0x200]
push edx
call fcn.004cc770
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push 0
push edi
call fcn.004cc638
add esp, 0xc
jmp 0x4d1915
mov edi, dword [ebx + 0x24]
push edi
call fcn.004cc770
pop ecx
push eax
push esi
call fcn.004cc770
pop ecx
pop edx
add edx, eax
push edx
lea eax, [ebp - 0x200]
push eax
call fcn.004cc770
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push edi
call fcn.004695c0
add esp, 8
mov dword [ebx + 0x24], eax
cmp dword [ebx + 0x24], 0
jne 0x4d1915
xor eax, eax
jmp 0x4d195c
push esi
mov edx, dword [ebx + 0x24]
push edx
call fcn.004cc6e0
add esp, 8
push 0x6060c7
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.004cc6e0
add esp, 8
lea eax, [ebp - 0x200]
push eax
mov edx, dword [ebx + 0x24]
push edx
call fcn.004cc6e0
add esp, 8
push 0x6060c9
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.004cc6e0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4d5054
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
jne 0x4d5081
jmp 0x4d50b8
call fcn.004d5004
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.004cc770
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.004cc770
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4d5118
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x6067c8], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x4d51f2
cmp dword [0x6067c4], 0
jne 0x4d51f2
cmp dword [0x6069b8], 0
je 0x4d51ac
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.004d4f04
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4d5192
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.004d4f04
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4d5192
lea ebx, [ebp - 0x84]
jmp 0x4d5193
inc ebx
call fcn.004d50d4
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x4d522d
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x6067cc
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.004cc770
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x6067cf
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x4d522d
cmp dword [0x6067c4], 0
je 0x4d520c
cmp dword [0x6067c4], 0xffffffff
je 0x4d522d
push esi
call dword [0x6067c4]
pop ecx
mov eax, dword [0x6067c8]
test eax, eax
je 0x4d522d
cmp dword [0x6067c8], 0xffffffff
je 0x4d522d
cmp byte [eax], 0
je 0x4d522d
push esi
push eax
call fcn.004d5054
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d5a18
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x609720], 0
jne 0x4d5a99
cmp dword [0x609740], 0
jne 0x4d5a48
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x609740], eax
test eax, eax
jne 0x4d5a48
push str.GetEnvironmentStrings_failed
call fcn.004d5244
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x609740]
jmp 0x4d5a5c
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004cc770
pop ecx
mov edi, eax
test eax, eax
jne 0x4d5a54
lea edi, [ebp + 1]
push edi
call fcn.00468260
pop ecx
mov ebx, eax
mov dword [0x609724], ebx
test ebx, ebx
jne 0x4d5a86
xor eax, eax
jmp 0x4d5b5c
push edi
mov edx, dword [0x609740]
push edx
push ebx
call fcn.004cc5a4
add esp, 0xc
jmp 0x4d5ab9
xor esi, esi
mov ebx, dword [0x609720]
jmp 0x4d5ab3
push eax
call fcn.004cc770
pop ecx
test eax, eax
jne 0x4d5aaf
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x4d5aa3
lea ebx, [esi + 4]
push 4
mov dword [0x609728], ebx
inc ebx
push ebx
call fcn.00468d6c
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x4d5adc
xor eax, eax
jmp 0x4d5b5c
cmp dword [0x609720], 0
jne 0x4d5b0d
xor esi, esi
mov ebx, dword [0x609724]
mov eax, dword [esp]
mov ebp, eax
jmp 0x4d5afe
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004cc770
pop ecx
mov edi, eax
test eax, eax
jne 0x4d5af4
jmp 0x4d5b3e
xor esi, esi
mov ebx, dword [0x609720]
mov eax, dword [esp]
mov edi, eax
jmp 0x4d5b38
push eax
call fcn.004cc770
pop ecx
test eax, eax
je 0x4d5b2d
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x4d5b31
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x4d5b1c
mov eax, dword [0x609720]
test eax, eax
je 0x4d5b4e
push eax
call fcn.004685a4
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x609720], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x48f130
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x74000]
push edi
or ebp, 0xffffffff
jmp 0x48f152
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x48f159
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48f148
mov eax, 1
add ebx, ebx
jne 0x48f16b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x48f160
jne 0x48f17c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x48f160
xor ecx, ecx
sub eax, 3
jb 0x48f190
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x48f202
mov ebp, eax
add ebx, ebx
jne 0x48f19b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x48f1a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x48f1cc
inc ecx
add ebx, ebx
jne 0x48f1b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x48f1ad
jne 0x48f1c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x48f1ad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x48f1ec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x48f1dd
jmp 0x48f14e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x48f1ec
add edi, ecx
jmp 0x48f14e
pop esi
mov edi, esi
mov ecx, 0x1a9e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x48f20a
cmp byte [edi], 6
jne 0x48f20a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x48f20f
lea edi, [esi + 0x8d000]
mov eax, dword [edi]
or eax, eax
je 0x48f287
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8f000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8f11c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x48f23c
mov ecx, edi
jns 0x48f26b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8f124]
or eax, eax
je 0x48f281
mov dword [ebx], eax
add ebx, 4
jmp 0x48f259
call dword [esi + 0x8f120]
mov ebp, dword [esi + 0x8f128]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x48f2bb
sub esp, 0xffffff80
jmp section.UPX0

Function at 0x955f18
Capabilities:
Encode data using xor

Disassembly:
jmp 0x955f22
pushal
call 0x955f28
pop ebp
sub ebp, 0x10
sub ebp, 0x555f18
jmp 0x955f3e
mov eax, 0x555f18
add eax, ebp
add eax, 0x4c
mov ecx, 0x60a
mov edx, 0x3f0e416
xor byte [eax], dl
inc eax
dec ecx
jne 0x955f55
jmp 0x955f68
popfd
fistp dword [ebp + 0x16162a9f]
push ss
xchg edi, eax
xlatb
out dx, al
push ss
push ss
push ss
adc eax, 0x1612aedb
scasb al, byte es:[edi]
adc dl, byte [esi]
push ss
push ss
lodsb al, byte [esi]
push ss
push ss
push ss
loope 0x955f78
adc eax, 0x1a979dde
push ss
push ss
push ss
adc eax, 0x32729bd3
ljmp 0x3272
Function at 0x404fdf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x404fee
pop dword [ebp - 0x18]
mov eax, 0x404fee
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xabc3f3a8
sub dword [ebp - 0x28], 0x5d71ae5d
mov dword [ebp - 0x24], 0xe25474de
add dword [ebp - 0x24], 0x4fded767
mov dword [ebp - 0x20], 0xcb49583c
add dword [ebp - 0x20], 0x8102ebf2
mov dword [ebp - 0x1c], 0x7e4bb898
sub dword [ebp - 0x1c], 0x7e4bb898
lea eax, [ebp - 0x28]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x765c961c
sub dword [ebp - 0x28], 0x1ea2cc6
mov dword [ebp - 0x24], 0xe1d1506d
add dword [ebp - 0x24], 0x5f9b1108
mov dword [ebp - 0x20], 0x5f110fe0
add dword [ebp - 0x20], 0x45e5c8c
mov dword [ebp - 0x1c], 0x549c3dd9
sub dword [ebp - 0x1c], 0x549c3dd9
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x38313
push 0
call eax
mov ecx, 0x4594
xor ebx, ebx
add ebx, eax
mov edi, 0x12221c78
sub edi, 0x11de5e78
add edi, dword [ebp - 0x18]
mov edx, 0xcff900e2
sub edx, 0xb367a32e
xor dword [ebp - 0x14], 0xbc201f7c
mov esi, dword [edi]
sub esi, edx
mov dword [ebp - 8], 0x2121f4fc
mov dword [ebx], esi
xor dword [ebp - 0x14], eax
add ebx, 0x1d9710b8
sub ebx, 0x1d9710b4
add edi, 0xf0d87c78
sub edi, 0xf0d87c74
loop 0x4050fd
add eax, 0x4f1f5a2a
add eax, 0xb0e1aef9
xor ebx, ebx
add ebx, eax
add eax, 0x134e331d
sub eax, 0x134e3318
mov ecx, 0x41658999
sub ecx, 0x41258999
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x402b6a
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x413094]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, ecx
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
test esi, esi
je 0x402bd8
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x402b95
sub ecx, edx
sar ecx, 1
lea ebx, [ecx + 1]
cmp ebx, 0xffa
jae 0x402bd6
xor ecx, ecx
mov eax, ebx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004111a3
mov dword [edi], eax
pop ecx
test eax, eax
je 0x402bd6
push esi
mov edx, ebx
mov ecx, eax
call fcn.00402810
xor ebx, ebx
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x402c26
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x402be4
sub ecx, edx
Function at 0x4058f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x447dc0
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x47a008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp + 0xc]
xor esi, esi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x48], esi
add eax, 1
je 0x405abf
sub esp, 0x18
mov dword [ebp - 0x14], 0
mov ecx, esp
mov dword [ebp - 0x50], esp
xorps xmm0, xmm0
xor eax, eax
movups xmmword [ebp - 0x2c], xmm0
push 0x24
movq qword [ebp - 0x1c], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.364EEC90_8BB3_4834_BE8D_26E3E1C8C1AA
mov word [ecx], ax
call fcn.00404970
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00408550
mov dword [ebp - 4], 1
cmp esi, dword [ebp + 0xc]
jne 0x4059cf
cmp dword [edi + 0x10], 0
je 0x4059cf
lea ecx, [ebp - 0x2c]
call fcn.00408760
test eax, eax
je 0x4059cf
cmp dword [edi + 0x14], 8
mov ecx, dword [edi + 0x10]
mov dword [ebp - 0x44], 0
lea ecx, [ecx*2 + 2]
mov dword [ebp - 0x40], ecx
mov ecx, edi
jb 0x4059bd
mov ecx, dword [edi]
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0x44]
push ecx
push 1
push 0x4a
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [ebp - 0x2c]
call fcn.00408760
mov esi, eax
test esi, esi
je 0x405a34
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x405a34
push 0xfffffffffffffff0
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, eax
je 0x405a29
test eax, 0x20000000
je 0x405a29
push 1
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 0
push eax
push 2
push 0x4a
push esi
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
jne 0x405a70
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax + 4]
test eax, eax
je 0x405a4c
push dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x405ab0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00408640
mov esi, dword [ebp - 0x48]
mov eax, dword [ebp + 0xc]
inc esi
inc eax
mov dword [ebp - 0x48], esi
cmp esi, eax
jb 0x405931
jmp 0x405abf
cmp dword [edi + 0x10], 0
je 0x405ab0
lea ecx, [ebp - 0x2c]
call fcn.00408760
test eax, eax
je 0x405ab0
cmp dword [edi + 0x14], 8
mov ecx, dword [edi + 0x10]
mov dword [ebp - 0x38], 0
lea ecx, [ecx*2 + 2]
mov dword [ebp - 0x34], ecx
jb 0x405a9e
mov edi, dword [edi]
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x30], edi
push ecx
push 1
push 0x4a
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00408640
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004306b4
mov esp, ebp
pop ebp
ret 0xc
Function at 0x408850
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x47a008]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0xc], 0
mov byte [ebp - 0xb], 0
mov byte [ebp - 0xa], 0
mov byte [ebp - 9], 0
mov byte [ebp - 8], 0
mov byte [ebp - 7], 5
mov byte [ebp - 0x15], 0
push 0x47dfc0
push 0x400
call fcn.00430bff
add esp, 8
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x4088ab
xor al, al
jmp 0x408986
lea ecx, [ebp - 0x10]
push ecx
push 0x400
mov edx, dword [ebp - 0x1c]
push edx
push 2
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x4088ca
jmp 0x408948
lea ecx, [ebp - 0x14]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea edx, [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x4088f3
jmp 0x408948
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0
jmp 0x40890b
mov ecx, dword [ebp - 0x20]
add ecx, 1
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
cmp eax, dword [edx]
jae 0x408936
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + ecx*8 + 4]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x408934
mov byte [ebp - 0x15], 1
jmp 0x408936
jmp 0x408902
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
xor eax, eax
jne 0x4088ab
cmp dword [ebp - 0x1c], 0
je 0x408983
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x28]
push edx
call fcn.00430bfa
add esp, 4
cmp dword [ebp - 0x28], 0
jne 0x40896f
mov dword [ebp - 0x30], 0
jmp 0x40897c
mov dword [ebp - 0x1c], 0x8123
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x1c], 0
mov al, byte [ebp - 0x15]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004306b4
mov esp, ebp
pop ebp
ret
Function at 0x40ad80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x448710
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x47a008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [edi + 4]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
test esi, esi
je 0x40aef3
cmp byte [esi + 0x54], 0
je 0x40aef3
add esi, 0x1c
xorps xmm0, xmm0
xor bl, bl
movlpd qword [ebp - 0x18], xmm0
mov dword [ebp - 0x18], esi
mov byte [ebp - 0x14], bl
test esi, esi
je 0x40ae06
mov eax, dword [esi]
test eax, eax
je 0x40ae03
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40adfd
cmp eax, 0x80
je 0x40adfd
xor bl, bl
jmp 0x40ae03
mov byte [esi + 4], 1
mov bl, 1
mov byte [ebp - 0x14], bl
mov dword [ebp - 4], 0
mov eax, dword [edi + 4]
cmp dword [eax + 0x14], 8
jb 0x40ae18
mov eax, dword [eax]
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x40aecc
mov edx, dword [ebp - 0x38]
lea ecx, [ebp - 0x30]
push 0
call fcn.00412330
add esp, 4
mov byte [ebp - 4], 1
push 2
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [ebp - 0x1c], 0x10
lea ecx, [ebp - 0x34]
push 0
push ecx
push dword [ebp - 0x20]
lea eax, [ebp - 0x30]
cmovae eax, dword [ebp - 0x30]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x1c]
cmp edx, 0x10
jb 0x40aeba
mov ecx, dword [ebp - 0x30]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40aeb0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40aeb0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.004306f5
add esp, 8
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0xf
mov byte [ebp - 0x30], 0
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x40aeec
test bl, bl
je 0x40aeec
mov eax, dword [esi]
test eax, eax
je 0x40aee8
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [esi + 4], 0
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004306b4
mov esp, ebp
pop ebp
ret 4
Function at 0x40be80
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x448ae8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x47a008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [ebp - 0x2c]
mov dword [esi], 0
push eax
push fcn.0040c050
push 6
mov byte [esi + 4], 0
mov dword [ebp - 0x2c], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x40bfb5
cmp dword [ebp - 0x2c], 0
je 0x40bfb5
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x28]
push str.9CDB4DA2_ACEA_446E_AA3A_D25628140939__d__p
push eax
call fcn.00410550
add esp, 0x10
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
test eax, eax
jne 0x40bf74
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x40bfa5
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40bf9b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40bf9b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40bf87
mov byte [esi + 4], 1
jmp 0x40bf3b
push dword [esi]
mov byte [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
jmp 0x40bf3b
push edx
push ecx
call fcn.004306f5
add esp, 8
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 0x18], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004306b4
mov esp, ebp
pop ebp
ret