joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10063790
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007f79d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x100d4480]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 0xc]
xorps xmm0, xmm0
mov eax, dword [ebp + 8]
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0
push ecx
push 0
push 0
push Ordinal_2
push 0
push dword [ebp + 0x10]
push eax
call fcn.10063cd0
mov eax, dword [ebp - 0x18]
add esp, 0x1c
mov ebx, dword [ebp - 0x1c]
sub eax, ebx
sar eax, 2
mov dword [ebp - 0x28], eax
test eax, eax
je 0x10063870
xor edi, edi
test eax, eax
je 0x10063870
cmp edi, dword [ebp + 0x18]
jge 0x10063870
mov esi, dword [ebx + edi*4]
lea eax, [ebp - 0x20]
push eax
push 0x40
push dword [ebp + 0x14]
push esi
push dword [0x100d56e4]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push dword [ebp + 0x14]
push dword [ebp - 0x24]
push esi
push dword [0x100d56e4]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push dword [ebp - 0x20]
push dword [ebp + 0x14]
push esi
push dword [0x100d56e4]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
inc edi
cmp edi, dword [ebp - 0x28]
jb 0x10063822
test ebx, ebx
je 0x100638a6
mov ecx, dword [ebp - 0x14]
mov eax, ebx
sub ecx, ebx
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x1006389c
mov ebx, dword [eax - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1006389c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push ebx
call fcn.1007c344
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007c66c
mov esp, ebp
pop ebp
ret

Function at 0x10063bb0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x100d4480]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x130], eax
push esi
push 2
xor ebx, ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x10063bf5
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007c66c
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x12c], 0x128
push eax
push edi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x10063c4d
push dword [ebp - 0x130]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
jne 0x10063c3c
mov eax, dword [ebp - 0x118]
cmp eax, esi
jbe 0x10063c3c
mov ebx, dword [ebp - 0x124]
mov esi, eax
lea eax, [ebp - 0x12c]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x10063c10
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007c66c
mov esp, ebp
pop ebp
ret
Function at 0x10069bc0
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
cmp byte [0x100d5fe8], 0
jne 0x10069bce
call fcn.10078450
cmp byte [0x100d5ff1], 0
je 0x10069bec
push 0
push 0x40
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.100787e0
add esp, 0x10
ret
jmp fcn.10067f70

Function at 0x1007a230
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
push edi
lea edi, [ebp - 0x30]
mov ecx, 0xc
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x100d4480]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x1007a3ac
mov dword [ebp - 0x28], 0x1c
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 8]
push ecx
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x1007a399
cmp dword [ebp - 0x28], 0x10
jb 0x1007a37d
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp esi, esp
call fcn.1007d393
cmp dword [ebp - 0x1c], eax
jne 0x1007a37d
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp esi, esp
call fcn.1007d393
cmp dword [ebp - 0x20], eax
je 0x1007a37d
mov edx, dword [ebp + 8]
cmp dword [edx], 0
jne 0x1007a304
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0x80
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
shl edx, 2
mov esi, esp
push edx
push 0
mov eax, dword [0x100d705c]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp esi, esp
call fcn.1007d393
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp + 8]
cmp dword [edx], 0
jne 0x1007a302
jmp 0x1007a399
jmp 0x1007a35d
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 8]
cmp edx, dword [ecx + 4]
jb 0x1007a35d
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
shl ecx, 1
shl ecx, 2
mov esi, esp
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
push 0
mov ecx, dword [0x100d705c]
push ecx
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
cmp esi, esp
call fcn.1007d393
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x1007a347
jmp 0x1007a399
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
shl eax, 1
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x30]
mov dword [edx], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x20]
mov dword [ecx + edx*4], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
add edx, 1
mov eax, dword [ebp + 8]
mov dword [eax + 8], edx
mov dword [ebp - 0x28], 0x1c
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp - 8]
push edx
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x1007a283
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.1007d393
push edx
mov ecx, ebp
push eax
lea edx, [0x1007a3d8]
call fcn.1007d33f
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007c66c
add esp, 0x30
cmp ebp, esp
call fcn.1007d393
mov esp, ebp
pop ebp
ret
Function at 0x1007a3f0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0
mov eax, dword [ebp + 8]
push eax
call fcn.1007a230
add esp, 4
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0
je 0x1007a4bb
mov dword [ebp - 4], 0
jmp 0x1007a44c
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 8]
jae 0x1007a4bb
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov esi, esp
mov ecx, dword [ebp - 4]
mov edx, dword [eax + ecx*4]
push edx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.1007d393
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1007a4b9
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp esi, esp
call fcn.1007d393
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.1007a050
add esp, 0xc
mov esi, esp
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.1007d393
jmp 0x1007a443
pop esi
add esp, 8
cmp ebp, esp
call fcn.1007d393
mov esp, ebp
pop ebp
ret

Function at 0x1007a4d0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x1007a57b
mov dword [ebp - 4], 0
jmp 0x1007a503
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
cmp eax, dword [edx + 8]
jae 0x1007a55e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov esi, esp
mov eax, dword [ebp - 4]
mov ecx, dword [edx + eax*4]
push ecx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.1007d393
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1007a55c
mov esi, esp
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp esi, esp
call fcn.1007d393
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.1007d393
jmp 0x1007a4fa
mov esi, esp
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [0x100d705c]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp esi, esp
call fcn.1007d393
pop esi
add esp, 8
cmp ebp, esp
call fcn.1007d393
mov esp, ebp
pop ebp
ret
Function at 0x1007a590
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov eax, 0xcccccccc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
imul eax, dword [ebp + 8], 0x2c
add eax, dword [0x100d73e0]
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 5
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x1007a5f3
mov eax, dword [ebp - 0x18]
sub eax, 5
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
add ecx, 2
mov dword [ebp - 0x14], ecx
mov esi, esp
lea edx, [ebp - 0xc]
push edx
push 0x40
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.1007d393
test eax, eax
jne 0x1007a61e
mov eax, 0xa
jmp 0x1007a720
cmp dword [ebp + 0xc], 0
je 0x1007a66a
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov byte [eax], 0xe9
mov ecx, dword [ebp - 0x18]
add ecx, 5
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
sub eax, ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 1], eax
mov edx, dword [ebp - 4]
mov al, byte [edx + 0x14]
and al, 1
movzx ecx, al
test ecx, ecx
je 0x1007a668
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov byte [ecx], 0xeb
mov edx, dword [ebp - 0x20]
mov byte [edx + 1], 0xf9
jmp 0x1007a6a6
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x1007a691
push 7
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
jmp 0x1007a6a6
push 5
mov edx, dword [ebp - 4]
add edx, 0xc
push edx
mov eax, dword [ebp - 0x18]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov esi, esp
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.1007d393
mov esi, esp
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp edi, esp
call fcn.1007d393
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
cmp esi, esp
call fcn.1007d393
mov cl, byte [ebp + 0xc]
and cl, 1
shl cl, 1
mov edx, dword [ebp - 4]
mov al, byte [edx + 0x14]
and al, 0xfd
or al, cl
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x14], al
mov dl, byte [ebp + 0xc]
and dl, 1
shl dl, 2
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 0xfb
or cl, dl
mov edx, dword [ebp - 4]
mov byte [edx + 0x14], cl
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x1007a744]
call fcn.1007d33f
pop eax
pop edx
pop edi
pop esi
add esp, 0x20
cmp ebp, esp
call fcn.1007d393
mov esp, ebp
pop ebp
ret
Function at 0x1007ae10
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [0x100d73d4]
mov dword [ebp - 4], eax
jmp 0x1007ae37
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x1007ae50
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x1007ae4e
mov eax, dword [ebp - 4]
jmp 0x1007aed4
jmp 0x1007ae2f
mov esi, esp
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp esi, esp
call fcn.1007d393
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1007aed1
mov ecx, dword [ebp - 4]
add ecx, 0x20
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 8]
add eax, 0x20
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 4]
cmp ecx, 0xfe0
jbe 0x1007ae93
mov edx, dword [ebp - 4]
mov eax, dword [0x100d73d4]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
mov dword [0x100d73d4], ecx
mov eax, dword [ebp - 4]
pop esi
add esp, 8
cmp ebp, esp
call fcn.1007d393
mov esp, ebp
pop ebp
ret

Function at 0x1007b3c0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0xcccccccc
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
test eax, eax
je 0x1007b410
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x90
je 0x1007b410
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + eax]
cmp edx, 0xcc
je 0x1007b410
xor eax, eax
jmp 0x1007b451
mov dword [ebp - 4], 1
jmp 0x1007b422
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x1007b44c
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
mov ecx, 1
imul edx, ecx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
cmp eax, edx
je 0x1007b44a
xor eax, eax
jmp 0x1007b451
jmp 0x1007b419
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x6001fec8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x6003bdd6
call fcn.6003b2fb
mov edi, ecx
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x420], eax
call dword [0x6004096c]
xor esi, esi
mov dword [ebp - 0x424], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x42c], edi
mov dword [ebp - 0x430], esi
mov dword [ebp - 0x418], esi
push 2
push esi
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov ebx, eax
cmp ebx, esi
mov dword [ebp - 0x428], ebx
jne 0x6001ff37
call fcn.6001d2bd
mov esi, eax
jmp 0x60020039
push dword [ebp - 0x420]
push dword [ebp - 0x41c]
push ebx
call dword [sym.imp.kernel32.dll_FindResourceW]
mov edi, eax
cmp edi, esi
jne 0x6001ff5a
call fcn.6001d2bd
jmp 0x6002002b
push edi
push ebx
call dword [sym.imp.kernel32.dll_LoadResource]
cmp eax, esi
mov dword [ebp - 0x420], eax
je 0x6001ff50
push edi
push ebx
call dword [sym.imp.kernel32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
cmp eax, edi
mov dword [ebp - 0x41c], edi
jae 0x6001ffb6
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x6001ff9c
lea ecx, [ebp - 0x418]
call fcn.6001da88
mov esi, 0x8007000e
lea ecx, [ebp - 0x424]
call fcn.6001d9a3
mov eax, esi
call fcn.6003b354
ret 0x10
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.6002b770
mov dword [ebp - 4], 1
jmp 0x6001ffdd
mov ebx, dword [ebp - 0x418]
cmp ebx, esi
jne 0x6001ffee
mov esi, 0x8007000e
jmp 0x6002002d
call dword [0x6004096c]
push edi
push ebx
push edi
push dword [ebp - 0x420]
push esi
push eax
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
cmp eax, esi
je 0x6001ff50
mov ecx, dword [ebp - 0x418]
push dword [ebp + 0x14]
mov word [ecx + eax*2], si
push dword [ebp - 0x418]
lea ecx, [ebp - 0x430]
call fcn.6002b770
mov esi, eax
push dword [ebp - 0x428]
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x6001ffa1
lea ecx, [ebp - 0x418]
call fcn.6001da88
jmp 0x6001ffa1
Function at 0x60020b7a
Capabilities:
Get session user name

Disassembly:
push 0x40c
mov eax, 0x6003beba
call fcn.6003b2c5
mov edi, ecx
xor ebx, ebx
xor esi, esi
call fcn.6002b770
test eax, eax
jne 0x60020ba9
mov ecx, edi
call fcn.60020795
mov esi, eax
cmp esi, ebx
jne 0x60020d12
mov ecx, edi
call fcn.6002b770
test eax, eax
je 0x60020d12
push dword [ebp + 8]
mov ecx, edi
call fcn.6002b770
test eax, eax
je 0x60020bd3
mov dword [edi + 0x40], ebx
mov eax, 0x80004005
jmp 0x60020d14
mov esi, 0x200
push esi
lea eax, [ebp - 0x210]
push ebx
push eax
call sub.MSVCR80.dll_memset
push esi
lea eax, [ebp - 0x410]
push ebx
push eax
call sub.MSVCR80.dll_memset
add esp, 0x18
push 0x60001ccc
mov esi, 0xff
push esi
lea eax, [ebp - 0x210]
push eax
mov dword [ebp - 0x414], esi
call fcn.6002b770
cmp eax, ebx
jl 0x60020d14
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x410]
push eax
push 6
call sub.Secur32.dll_GetUserNameExW
test al, al
je 0x60020ca5
lea eax, [ebp - 0x410]
mov dword [ebp - 0x414], esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x60020c44
sub eax, edx
sar eax, 1
mov word [ebp + eax*2 - 0x412], bx
lea eax, [ebp - 0x40e]
push eax
push esi
lea eax, [ebp - 0x210]
push eax
call fcn.6002b770
mov esi, eax
cmp esi, ebx
jne 0x60020d12
push 0x60001cc8
push dword [ebp - 0x414]
lea eax, [ebp - 0x210]
push eax
call fcn.6002b770
mov esi, eax
cmp esi, ebx
jne 0x60020d12
mov eax, dword [ebp - 0x414]
mov word [ebp + eax*2 - 0x210], bx
jmp 0x60020cae
mov ecx, edi
call fcn.6001d2bd
mov esi, eax
cmp esi, ebx
jne 0x60020d12
lea ebx, [edi + 0x58]
push ebx
push 0x6001c104
push 0x21
push 0
push 0
lea eax, [ebp - 0x210]
push eax
call sub.ACTIVEDS.dll_ADsOpenObject
mov esi, eax
test esi, esi
jl 0x60020d12
push dword [edi + 0x48]
lea ecx, [ebp - 0x418]
call fcn.6002b770
mov eax, dword [ebx]
mov ecx, dword [eax]
and dword [ebp - 4], 0
add edi, 0x60
push edi
push dword [ebp - 0x418]
push eax
call dword [ecx + 0x3c]
mov esi, eax
test esi, esi
jge 0x60020d06
push edi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
xor esi, esi
push dword [ebp - 0x418]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, esi
call fcn.6003b348
ret 4

Function at 0x60021397
Capabilities:
Get common file path

Disassembly:
push ebx
push edi
push 0x60001d88
call dword [sym.imp.kernel32.dll_lstrlenW]
mov edi, eax
add edi, 0x105
lea eax, [edi + edi]
push eax
call dword [sym.imp.MSVCR80.dll_malloc]
mov ebx, eax
test ebx, ebx
pop ecx
je 0x600213ec
push esi
mov esi, dword [sym.imp.shell32.dll_SHGetSpecialFolderPathW]
push 1
push 0x1c
push ebx
push 0
call esi
test eax, eax
jne 0x600213dd
push 1
push 0x1a
push ebx
push eax
call esi
test eax, eax
je 0x600213eb
push 0x60001d88
push edi
push ebx
call fcn.6002b770
mov eax, ebx
pop esi
pop edi
pop ebx
ret
Function at 0x600283ad
Capabilities:
Set thread local storage value

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [eax + 4]
mov edx, dword [eax]
cmp ecx, edx
jb 0x600283ce
mov eax, dword [eax + 8]
cmp ecx, eax
jb 0x600283ce
cmp edx, eax
jb 0x600283ce
add eax, 0x10000
cmp eax, ecx
jae 0x600283f9
mov eax, dword [0x60040980]
push 0
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push 0
push 0x35636561
call fcn.6002b770
push 0
push 0
push 1
push 0xe0000001
call dword [sym.imp.kernel32.dll_RaiseException]
ret
Function at 0x6003a897
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6001c114]
jne 0x6003b777
ret
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x60077cc0], eax
mov dword [0x60077cbc], ecx
mov dword [0x60077cb8], edx
mov dword [0x60077cb4], ebx
mov dword [0x60077cb0], esi
mov dword [0x60077cac], edi
mov word [0x60077cd8], ss
mov word [0x60077ccc], cs
mov word [0x60077ca8], ds
mov word [0x60077ca4], es
mov word [0x60077ca0], fs
mov word [0x60077c9c], gs
pushfd
pop dword [0x60077cd0]
mov eax, dword [ebp]
mov dword [0x60077cc4], eax
mov eax, dword [ebp + 4]
mov dword [0x60077cc8], eax
lea eax, [ebp + 8]
mov dword [0x60077cd4], eax
mov eax, dword [ebp - 0x320]
mov dword [0x60077c10], 0x10001
mov eax, dword [0x60077cc8]
mov dword [0x60077bc4], eax
mov dword [0x60077bb8], 0xc0000409
mov dword [0x60077bbc], 1
mov eax, dword [0x6001c114]
mov dword [ebp - 0x328], eax
mov eax, dword [0x60071678]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x60077c08], eax
push 1
call sub.MSVCR80.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x6001c3dc
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x60077c08], 0
jne 0x6003b867
push 1
call sub.MSVCR80.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x402d20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x454
mov eax, dword [0x419fa8]
xor eax, ebp
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x454], ecx
call fcn.00402470
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x2c]
call fcn.00406e50
mov eax, dword [ebp - 0x454]
push eax
lea ecx, [ebp - 0x18]
call fcn.00402fe0
lea ecx, [ebp - 0x438]
call fcn.00406e50
push 0x400
mov ecx, dword [ebp + 8]
push ecx
call fcn.004097f0
mov dword [ebp - 8], eax
push 2
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x402d9d
call fcn.00402510
mov dword [ebp - 0x444], eax
jmp 0x402ef2
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x440], eax
cmp dword [ebp - 0x440], 0
jne 0x402dce
call fcn.00402510
mov dword [ebp - 0x444], eax
jmp 0x402ef2
mov eax, dword [ebp - 0x440]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x448], eax
cmp dword [ebp - 0x448], 0
jne 0x402dfe
call fcn.00402510
mov dword [ebp - 0x444], eax
jmp 0x402ef2
mov edx, dword [ebp - 0x440]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x448]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x1c]
add edx, 1
cmp edx, dword [ebp - 0x1c]
jae 0x402e4e
mov dword [ebp - 0x44c], 0x8007000e
lea ecx, [ebp - 0x438]
call fcn.00406ef0
lea ecx, [ebp - 0x2c]
call fcn.00406ba0
mov eax, dword [ebp - 0x44c]
jmp 0x402f27
mov eax, dword [ebp - 0x1c]
add eax, 1
push eax
lea ecx, [ebp - 0x438]
call fcn.00406ec0
lea ecx, [ebp - 0x438]
call fcn.00409860
test eax, eax
jne 0x402e7b
mov dword [ebp - 0x444], 0x8007000e
jmp 0x402ef2
mov ecx, dword [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x438]
call fcn.00409860
push eax
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0xc]
push eax
push 0
call fcn.00402470
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x43c], eax
cmp dword [ebp - 0x43c], 0
jne 0x402ebd
call fcn.00402510
mov dword [ebp - 0x444], eax
jmp 0x402ef2
lea ecx, [ebp - 0x438]
call fcn.00409860
mov ecx, dword [ebp - 0x43c]
mov word [eax + ecx*2], 0
mov edx, dword [ebp + 0x14]
push edx
lea ecx, [ebp - 0x438]
call fcn.00409860
push eax
lea ecx, [ebp - 0x18]
call fcn.00403010
mov dword [ebp - 0x444], eax
cmp dword [ebp - 0x10], 0
je 0x402f02
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0x444]
mov dword [ebp - 0x450], ecx
lea ecx, [ebp - 0x438]
call fcn.00406ef0
lea ecx, [ebp - 0x2c]
call fcn.00406ba0
mov eax, dword [ebp - 0x450]
mov ecx, dword [ebp - 0x30]
xor ecx, ebp
call fcn.0040ad0d
mov esp, ebp
pop ebp
ret 0x10