joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403780
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4282c8
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x43800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 2
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
cmovae eax, dword [ebp + 8]
cmp dword [ebp + 0x18], 1
jne 0x4037d3
movzx eax, byte [eax]
cmp al, 0x31
jne 0x4037c6
xor eax, eax
jmp 0x4037cb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4037d3
mov cl, 1
jmp 0x4037d5
xor cl, cl
xor edx, edx
mov eax, 5
test cl, cl
lea ecx, [ebp + 8]
cmove eax, edx
mov edx, str.runas
push eax
mov eax, 0x43336b
cmovne eax, edx
push eax
call fcn.00415960
cmp dword [ebp + 0x4c], 0x10
lea edx, [ebp + 0x38]
push 0
cmovae edx, dword [ebp + 0x38]
lea ecx, [ebp + 0x20]
cmp dword [ebp + 0x34], 0x10
lea eax, [ebp + 8]
push 0
cmovae ecx, dword [ebp + 0x20]
cmp dword [ebp + 0x1c], 0x10
push edx
cmovae eax, dword [ebp + 8]
push ecx
push eax
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edx, dword [ebp + 0x1c]
mov esi, eax
mov dword [0x43a2e4], esi
cmp edx, 0x10
jb 0x403864
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40385a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4038fa
push edx
push ecx
call fcn.004171d4
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x4038a6
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40389c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4038fa
push edx
push ecx
call fcn.004171d4
add esp, 8
mov edx, dword [ebp + 0x4c]
mov dword [ebp + 0x30], 0
mov dword [ebp + 0x34], 0xf
mov byte [ebp + 0x20], 0
cmp edx, 0x10
jb 0x4038e8
mov ecx, dword [ebp + 0x38]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4038de
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4038fa
push edx
push ecx
call fcn.004171d4
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
call fcn.0041b83c
int3
Function at 0x403a60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4282c8
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x43800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 2
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
mov dword [0x43a2e0], 0
call esi
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x43a730]
cmp eax, dword [ecx + 4]
jle 0x403b31
push 0x43a730
call fcn.00416c82
add esp, 4
cmp dword [0x43a730], 0xffffffff
jne 0x403b31
push 0x42d610
mov dword [0x43a6f8], 0
mov dword [0x43a6fc], 0xf
mov byte [0x43a6e8], 0
mov dword [0x43a710], 0
mov dword [0x43a714], 0xf
mov byte [0x43a700], 0
mov dword [0x43a728], 0
mov dword [0x43a72c], 0xf
mov byte [0x43a718], 0
call fcn.004171bf
push 0x43a730
call fcn.00416c38
add esp, 8
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
mov ecx, 0x43a6e8
push eax
call fcn.00415960
cmp dword [ebp + 0x34], 0x10
lea eax, [ebp + 0x20]
push dword [ebp + 0x30]
cmovae eax, dword [ebp + 0x20]
mov ecx, 0x43a700
push eax
call fcn.00415960
cmp dword [ebp + 0x4c], 0x10
lea eax, [ebp + 0x38]
push dword [ebp + 0x48]
cmovae eax, dword [ebp + 0x38]
mov ecx, 0x43a718
push eax
call fcn.00415960
push 0
push 0
push 0x43a6e8
push 0x403900
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1f4
call esi
mov edx, dword [ebp + 0x1c]
mov esi, dword [0x43a2e0]
cmp edx, 0x10
jb 0x403bd5
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x403bcb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403c6b
push edx
push ecx
call fcn.004171d4
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x403c17
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x403c0d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403c6b
push edx
push ecx
call fcn.004171d4
add esp, 8
mov edx, dword [ebp + 0x4c]
mov dword [ebp + 0x30], 0
mov dword [ebp + 0x34], 0xf
mov byte [ebp + 0x20], 0
cmp edx, 0x10
jb 0x403c59
mov ecx, dword [ebp + 0x38]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x403c4f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403c6b
push edx
push ecx
call fcn.004171d4
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
call fcn.0041b83c
int3
Function at 0x403fb0
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x428420
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x43800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea edx, [ebp + 8]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.004033b0
cmp dword [eax + 0x14], 0x10
jb 0x403ff3
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov edx, dword [ebp - 0x1c]
cmp edx, 0x10
jb 0x40402e
mov ecx, dword [ebp - 0x30]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404024
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4041e8
push edx
push ecx
call fcn.004171d4
add esp, 8
sub esp, 0x18
mov dword [ebp - 0x34], esp
mov esi, esp
sub esp, 0x18
mov ecx, esp
push 0x438964
call fcn.00415600
lea ecx, [ebp - 0x64]
call fcn.004029b0
add esp, 0x18
push eax
lea eax, [ebp + 8]
mov byte [ebp - 4], 1
push eax
sub esp, 0x18
mov ecx, esp
push 0x438cac
call fcn.00415600
lea ecx, [ebp - 0x30]
call fcn.004029b0
add esp, 0x18
mov edx, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x4c]
call fcn.00415bb0
add esp, 4
mov edx, eax
mov byte [ebp - 4], 3
mov ecx, esi
call fcn.00415ab0
sub esp, 0x14
mov byte [ebp - 4], 4
mov dword [ebp - 0x14], esp
mov esi, esp
sub esp, 0x18
mov ecx, esp
push 0x438fac
call fcn.00415600
mov ecx, esi
call fcn.004029b0
mov ecx, esp
mov byte [ebp - 4], 5
push 1
push str.0123456789
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
call fcn.00415960
mov byte [ebp - 4], 3
call fcn.00403780
mov edx, dword [ebp - 0x38]
add esp, 0x48
cmp edx, 0x10
jb 0x404116
mov ecx, dword [ebp - 0x4c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40410c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4041ed
push edx
push ecx
call fcn.004171d4
add esp, 8
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0xf
mov byte [ebp - 0x4c], 0
cmp edx, 0x10
jb 0x40415c
mov ecx, dword [ebp - 0x30]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404152
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4041ed
push edx
push ecx
call fcn.004171d4
add esp, 8
mov edx, dword [ebp - 0x50]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0xf
mov byte [ebp - 0x30], 0
cmp edx, 0x10
jb 0x40419e
mov ecx, dword [ebp - 0x64]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404194
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4041ed
push edx
push ecx
call fcn.004171d4
add esp, 8
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x4041ce
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4041c4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4041f2
push edx
push ecx
call fcn.004171d4
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00416b62
mov esp, ebp
pop ebp
ret
call fcn.0041b83c
call fcn.0041b83c
call fcn.0041b83c
int3
Function at 0x4049a0
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4284db
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x17c
mov eax, dword [0x43800c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x118
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x154]
push 0
push eax
movups xmmword [ebp - 0x38], xmm0
movups xmmword [ebp - 0x28], xmm0
call fcn.00418230
add esp, 0xc
mov dword [ebp - 0x158], 0x11c
lea eax, [ebp - 0x158]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x404a2d
mov eax, 0x64
jmp 0x404b6f
sub esp, 0x18
mov ecx, esp
push 0x4393cc
call fcn.00415600
lea ecx, [ebp - 0x18c]
call fcn.004029b0
add esp, 0x18
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 0x10
jb 0x404a59
mov eax, dword [eax]
push eax
sub esp, 0x18
mov ecx, esp
push 0x438d6c
call fcn.00415600
lea ecx, [ebp - 0x174]
call fcn.004029b0
add esp, 0x18
cmp dword [eax + 0x14], 0x10
jb 0x404a7f
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0x160]
mov esi, eax
cmp edx, 0x10
jb 0x404ac9
mov ecx, dword [ebp - 0x174]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404abf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404b8c
push edx
push ecx
call fcn.004171d4
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x178]
mov dword [ebp - 0x164], 0
mov dword [ebp - 0x160], 0xf
mov byte [ebp - 0x174], 0
cmp edx, 0x10
jb 0x404b21
mov ecx, dword [ebp - 0x18c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404b17
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404b8c
push edx
push ecx
call fcn.004171d4
add esp, 8
mov dword [ebp - 0x17c], 0
lea eax, [ebp - 0x38]
mov dword [ebp - 0x178], 0xf
mov byte [ebp - 0x18c], 0
push eax
test esi, esi
je 0x404b48
call esi
jmp 0x404b4e
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [ebp - 0x154], 6
jb 0x404b6f
mov ax, word [ebp - 0x38]
cmp ax, 9
jne 0x404b68
mov eax, 1
jmp 0x404b6f
test ax, ax
jne 0x404b6f
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00416b62
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.0041b83c
int3
Function at 0x405430
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x428631
mov eax, dword fs:[0]
push eax
sub esp, 0x450
mov eax, dword [0x43800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x414], esi
lea eax, [ebp - 0x410]
mov dword [ebp - 0x414], esi
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
sub esp, 0x18
mov ecx, esp
push 0x438cdc
call fcn.00415600
lea ecx, [ebp - 0x45c]
call fcn.004029b0
add esp, 0x18
mov edi, eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x410]
mov dword [ebp - 0x434], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x430], 0xf
mov byte [ebp - 0x444], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4054c7
sub ecx, edx
lea eax, [ebp - 0x410]
push ecx
push eax
lea ecx, [ebp - 0x444]
call fcn.00415960
mov byte [ebp - 4], 1
lea eax, [ebp - 0x444]
mov ecx, 3
mov dword [ebp - 0x41c], 0
cmp dword [ebp - 0x434], ecx
mov dword [ebp - 0x418], 0xf
cmovb ecx, dword [ebp - 0x434]
cmp dword [ebp - 0x430], 0x10
push ecx
cmovae eax, dword [ebp - 0x444]
lea ecx, [ebp - 0x42c]
push eax
mov byte [ebp - 0x42c], 0
call fcn.00415960
push edi
lea edx, [ebp - 0x42c]
mov byte [ebp - 4], 2
mov ecx, esi
call fcn.00415ab0
mov edx, dword [ebp - 0x418]
add esp, 4
cmp edx, 0x10
jb 0x405584
mov ecx, dword [ebp - 0x42c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40557a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405628
push edx
push ecx
call fcn.004171d4
add esp, 8
mov edx, dword [ebp - 0x430]
mov dword [ebp - 0x41c], 0
mov dword [ebp - 0x418], 0xf
mov byte [ebp - 0x42c], 0
cmp edx, 0x10
jb 0x4055d5
mov ecx, dword [ebp - 0x444]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4055cb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405628
push edx
push ecx
call fcn.004171d4
add esp, 8
mov edx, dword [ebp - 0x448]
cmp edx, 0x10
jb 0x40560b
mov ecx, dword [ebp - 0x45c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x405601
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405628
push edx
push ecx
call fcn.004171d4
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00416b62
mov esp, ebp
pop ebp
ret
call fcn.0041b83c
int3
Function at 0x405630
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x428676
mov eax, dword fs:[0]
push eax
sub esp, 0x13c
mov eax, dword [0x43800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x118], esi
lea eax, [ebp - 0x114]
mov dword [ebp - 0x118], esi
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
sub esp, 0x18
mov ecx, esp
push 0x43924c
call fcn.00415600
lea ecx, [ebp - 0x148]
call fcn.004029b0
add esp, 0x18
mov edi, eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x120], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x11c], 0xf
mov byte [ebp - 0x130], 0
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4056d0
sub ecx, edx
lea eax, [ebp - 0x114]
push ecx
push eax
lea ecx, [ebp - 0x130]
call fcn.00415960
push edi
lea edx, [ebp - 0x130]
mov byte [ebp - 4], 1
mov ecx, esi
call fcn.00415ab0
mov edx, dword [ebp - 0x11c]
add esp, 4
cmp edx, 0x10
jb 0x405737
mov ecx, dword [ebp - 0x130]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40572d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4057a5
push edx
push ecx
call fcn.004171d4
add esp, 8
mov edx, dword [ebp - 0x134]
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 0xf
mov byte [ebp - 0x130], 0
cmp edx, 0x10
jb 0x405788
mov ecx, dword [ebp - 0x148]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40577e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4057a5
push edx
push ecx
call fcn.004171d4
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00416b62
mov esp, ebp
pop ebp
ret
call fcn.0041b83c
int3
Function at 0x4057b0
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x428676
mov eax, dword fs:[0]
push eax
sub esp, 0x13c
mov eax, dword [0x43800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x118], esi
lea eax, [ebp - 0x114]
mov dword [ebp - 0x118], esi
push eax
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
sub esp, 0x18
mov ecx, esp
push 0x43924c
call fcn.00415600
lea ecx, [ebp - 0x148]
call fcn.004029b0
add esp, 0x18
mov edi, eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x120], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x11c], 0xf
mov byte [ebp - 0x130], 0
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405850
sub ecx, edx
lea eax, [ebp - 0x114]
push ecx
push eax
lea ecx, [ebp - 0x130]
call fcn.00415960
push edi
lea edx, [ebp - 0x130]
mov byte [ebp - 4], 1
mov ecx, esi
call fcn.00415ab0
mov edx, dword [ebp - 0x11c]
add esp, 4
cmp edx, 0x10
jb 0x4058b7
mov ecx, dword [ebp - 0x130]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4058ad
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405925
push edx
push ecx
call fcn.004171d4
add esp, 8
mov edx, dword [ebp - 0x134]
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 0xf
mov byte [ebp - 0x130], 0
cmp edx, 0x10
jb 0x405908
mov ecx, dword [ebp - 0x148]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4058fe
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405925
push edx
push ecx
call fcn.004171d4
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00416b62
mov esp, ebp
pop ebp
ret
call fcn.0041b83c
int3
Function at 0x405930
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x428676
mov eax, dword fs:[0]
push eax
sub esp, 0x13c
mov eax, dword [0x43800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x118], esi
lea eax, [ebp - 0x114]
mov dword [ebp - 0x118], esi
push eax
push 0
push 0
push 0x28
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
sub esp, 0x18
mov ecx, esp
push 0x43924c
call fcn.00415600
lea ecx, [ebp - 0x148]
call fcn.004029b0
add esp, 0x18
mov edi, eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x120], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x11c], 0xf
mov byte [ebp - 0x130], 0
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4059d0
sub ecx, edx
lea eax, [ebp - 0x114]
push ecx
push eax
lea ecx, [ebp - 0x130]
call fcn.00415960
push edi
lea edx, [ebp - 0x130]
mov byte [ebp - 4], 1
mov ecx, esi
call fcn.00415ab0
mov edx, dword [ebp - 0x11c]
add esp, 4
cmp edx, 0x10
jb 0x405a37
mov ecx, dword [ebp - 0x130]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x405a2d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405aa5
push edx
push ecx
call fcn.004171d4
add esp, 8
mov edx, dword [ebp - 0x134]
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 0xf
mov byte [ebp - 0x130], 0
cmp edx, 0x10
jb 0x405a88
mov ecx, dword [ebp - 0x148]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x405a7e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405aa5
push edx
push ecx
call fcn.004171d4
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00416b62
mov esp, ebp
pop ebp
ret
call fcn.0041b83c
int3
Function at 0x407b90
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x428930
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x43800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x439144
lea ecx, [ebp - 0x40]
call fcn.00415600
mov dword [ebp - 4], 0
xor edx, edx
mov ecx, 7
mov dword [ebp - 0x18], edx
xor eax, eax
mov dword [ebp - 0x14], ecx
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 1
xor esi, esi
mov ebx, dword [ebp - 0x40]
cmp dword [ebp - 0x30], esi
jbe 0x407c42
cmp dword [ebp - 0x2c], 0x10
lea eax, [ebp - 0x40]
cmovae eax, ebx
movsx ax, byte [eax + esi]
movzx edi, ax
cmp edx, ecx
jae 0x407c23
lea eax, [edx + 1]
cmp ecx, 8
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
xor ecx, ecx
mov word [eax + edx*2], di
mov word [eax + edx*2 + 2], cx
jmp 0x407c34
push edi
mov byte [ebp - 0x44], 0
push dword [ebp - 0x44]
push ecx
lea ecx, [ebp - 0x28]
call fcn.00416320
mov ecx, dword [ebp - 0x14]
inc esi
cmp esi, dword [ebp - 0x30]
jae 0x407c42
mov edx, dword [ebp - 0x18]
jmp 0x407bf0
cmp ecx, 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x407cfd
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x407c9e
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407c94
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407d04
push edx
push ecx
call fcn.004171d4
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], 7
cmp eax, 0x10
jb 0x407ce1
lea ecx, [eax + 1]
mov eax, ebx
cmp ecx, 0x1000
jb 0x407cd7
mov ebx, dword [ebx - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407d04
push ecx
push ebx
call fcn.004171d4
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00416b62
mov esp, ebp
pop ebp
ret
push 0
call fcn.0041a5ff
call fcn.0041b83c
int3
Function at 0x4153f0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x4152c0
push 0
push 0
call esi
push 0
push 0
push 0
push 0x415350
push 0
push 0
call esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
nop
push 0x7530
call esi
jmp 0x415420
Function at 0x4253c0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x401346
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x401308
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x34], ebx
call fcn.0041f6d4
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
mov edi, eax
call esi
cmp edi, ebx
jl 0x4254c0
call fcn.0041f720
mov edi, eax
call esi
lea ecx, [ebp - 0x28]
push ecx
push 0x28
push edi
call fcn.0041f7cc
mov edi, eax
call esi
xor edx, edx
cmp edi, ebx
sete dl
neg edx
test dx, dx
jne 0x425528
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaStrToAnsi]
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x34]
push 0x420234
push ecx
call edi
push eax
lea edx, [ebp - 0x30]
push 0x42022c
push edx
call edi
push eax
call fcn.0041f81c
mov edi, eax
call esi
xor eax, eax
cmp edi, ebx
lea ecx, [ebp - 0x34]
lea edx, [ebp - 0x30]
sete al
push ecx
push edx
neg eax
push 2
mov edi, eax
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0xc
cmp di, bx
jne 0x425528
mov ecx, dword [ebp - 0x28]
push ebx
push ebx
lea eax, [ebp - 0x24]
push ebx
push eax
push ebx
push ecx
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x18], 2
call fcn.0041f86c
mov edi, eax
call esi
cmp edi, ebx
je 0x425528
mov edx, dword [ebp + 8]
push edx
push ebx
push 0x1f0fff
call fcn.0041f8b0
mov edi, eax
call esi
test edi, edi
mov ebx, edi
je 0x4254fb
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.0041f8fc
mov edi, eax
call esi
xor ecx, ecx
push ebx
test edi, edi
setne cl
neg ecx
mov dword [ebp - 0x2c], ecx
call fcn.0041f770
call esi
call fcn.0041f6d4
mov edi, eax
call esi
test edi, edi
jl 0x425537
mov eax, dword [ebp - 0x28]
push 0
push 0
lea edx, [ebp - 0x24]
push 0
push edx
push 0
push eax
mov dword [ebp - 0x18], 0
call fcn.0041f86c
call esi
xor ebx, ebx
mov eax, dword [ebp - 0x28]
cmp eax, ebx
je 0x425537
push eax
call fcn.0041f770
call esi
push 0x425553
jmp 0x425552
ret