joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420750
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x917d6b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x42078b
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x4207a4
lea eax, [ebp - 0x10]
mov edx, dword [0x93573c]
mov edx, dword [edx]
mov edx, dword [edx + 0x14]
call fcn.00404d30
jmp 0x4207b7
lea eax, [ebp - 0x10]
mov edx, dword [0x93573c]
mov edx, dword [edx]
mov edx, dword [edx + 0x18]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x4207c3
adc edx, 0
mov edx, dword [edx*4 + 0x934538]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x42093d
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x420930
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x420930
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406dec
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x420930
mov eax, edi
cmp dword [eax], 0x4550
jne 0x420930
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x4208ce
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x4208ce
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x4208ce
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x4208ce
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x420930
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x420930
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x420930
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x420930
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420930
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x420955
inc ebx
cmp ebx, 0x19
jne 0x42077d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x917d72
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x10019a4
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0xc]
push esi
push edi
lea edx, [eax + 2]
xor edi, edi
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x10019b5
push dword [ebp + 8]
sub eax, edx
sar eax, 1
mov esi, eax
call fcn.0100196a
test eax, eax
je 0x10019e5
push edi
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
jmp 0x1001a29
push ebx
lea ebx, [esi + esi]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 4], eax
cmp eax, edi
je 0x1001a28
push edi
push edi
push ebx
push eax
push esi
push dword [ebp + 0xc]
push edi
push 1
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, edi
je 0x1001a1f
push edi
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop ebx
pop edi
pop esi
leave
ret 8
Function at 0x1001bdd
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
or dword [ebp - 4], 0xffffffff
push ebx
lea eax, [ebp - 0x2c]
push eax
xor ebx, ebx
push ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_RtlDosPathNameToRelativeNtPathName_U]
test al, al
jne 0x1001c12
push 3
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
jmp 0x1001d24
mov eax, dword [ebp - 8]
mov dword [ebp + 8], eax
mov eax, dword [ebp - 0x2c]
cmp ax, bx
je 0x1001c2b
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
jmp 0x1001c2e
mov dword [ebp - 0x24], ebx
mov eax, dword [ebp - 0x24]
push esi
mov dword [ebp - 0x40], eax
mov esi, dword [sym.imp.ntdll.dll_NtOpenFile]
push edi
push 0x200000
lea eax, [ebp - 0xc]
mov dword [ebp - 0x3c], eax
push 7
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x44]
push eax
mov eax, dword [ebp + 0x10]
shr eax, 1
not eax
and eax, 0x80
or eax, dword [ebp + 0xc]
mov dword [ebp - 0x44], 0x18
push eax
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x38], 0x40
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
call esi
mov edi, eax
cmp edi, ebx
jl 0x1001cf1
test dword [ebp + 0x10], 0x100
jne 0x1001cf1
push 0x23
push 8
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov edi, eax
cmp edi, ebx
jge 0x1001cb8
cmp edi, 0xc000000d
je 0x1001cf1
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtClose]
jmp 0x1001ced
test dword [ebp - 0x14], 0x400
je 0x1001cf1
cmp dword [ebp - 0x10], 0xa000000c
jne 0x1001cf1
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtClose]
push ebx
push 7
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x44]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
call esi
mov edi, eax
cmp edi, ebx
jge 0x1001cf1
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.ntdll.dll_RtlReleaseRelativeName]
push dword [ebp + 8]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push edi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1001f75
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor eax, eax
xor ebx, ebx
lea esi, [edi + 8]
cmp ax, word [edi + 4]
jae 0x1001fdd
lea eax, [esi + 8]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x1001fce
test byte [esi + 1], 0x10
jne 0x1001fce
test byte [ebp + 8], 0x10
je 0x1001faf
cmp byte [esi], 0
je 0x1001fba
test byte [ebp + 8], 0x20
je 0x1001fce
cmp byte [esi], 1
jne 0x1001fce
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteAce]
test eax, eax
jne 0x1001fd5
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1001fe9
movzx eax, word [esi + 2]
inc ebx
add esi, eax
movzx eax, word [edi + 4]
cmp ebx, eax
jl 0x1001f8d
push edi
call fcn.01001d8f
mov word [edi + 2], ax
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x1001ff5
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
or dword [ebp - 8], 0xffffffff
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
and dword [ebp + 8], 0
xor ecx, ecx
lea esi, [eax + 8]
cmp cx, word [eax + 4]
jae 0x10020be
cmp dword [ebp - 8], 0xffffffff
jne 0x100204d
mov al, byte [esi + 1]
test al, 0x10
jne 0x1002042
cmp byte [esi], 0
je 0x1002042
mov ebx, dword [ebp + 0xc]
mov cl, byte [ebx + 0xc]
and cl, 3
and al, 3
cmp al, cl
jb 0x1002050
jmp 0x1002045
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
jmp 0x1002050
mov ebx, dword [ebp + 0xc]
mov al, byte [esi + 1]
test al, 0x10
jne 0x10020a6
cmp al, byte [ebx + 0xc]
jne 0x10020a6
cmp byte [esi], 0
jne 0x10020a6
lea eax, [esi + 8]
push eax
push dword [ebx + 8]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x10020a6
mov ecx, dword [ebx + 0x10]
mov eax, 0xffefffff
and ecx, eax
not ecx
and dword [esi + 4], ecx
test dword [esi + 4], eax
jne 0x10020a6
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_DeleteAce]
test eax, eax
je 0x1002113
mov ebx, dword [edi]
push ebx
call fcn.01001d8f
mov word [ebx + 2], ax
jmp 0x100201f
movzx eax, word [esi + 2]
inc dword [ebp + 8]
add esi, eax
mov eax, dword [edi]
movzx eax, word [eax + 4]
cmp dword [ebp + 8], eax
jl 0x100201f
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx + 0x14]
mov eax, dword [edi]
movzx esi, word [ecx + 2]
movzx ecx, word [eax + 2]
add esi, ecx
push esi
push eax
call dword [sym.imp.msvcrt.dll_realloc]
pop ecx
pop ecx
mov ebx, eax
cmp esi, 0xffff
ja 0x1002121
test ebx, ebx
je 0x1002131
mov eax, dword [ebp + 0xc]
mov word [ebx + 2], si
mov eax, dword [eax + 0x14]
movzx ecx, word [eax + 2]
push ecx
push eax
push dword [ebp - 8]
push 2
push ebx
call dword [sym.imp.ADVAPI32.dll_AddAce]
test eax, eax
jne 0x100211b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x1002138
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1002143
mov dword [edi], ebx
xor ebx, ebx
jmp 0x1002138
test ebx, ebx
je 0x1002131
and dword [edi], 0
mov dword [ebp - 4], 0x53c
jmp 0x1002138
mov dword [ebp - 4], 8
push ebx
call dword [sym.imp.msvcrt.dll_free]
mov eax, dword [ebp - 4]
pop ecx
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x100214f
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
or dword [ebp - 8], 0xffffffff
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
and dword [ebp + 8], 0
push esi
xor ecx, ecx
push edi
mov edi, dword [ebp + 0xc]
lea esi, [eax + 8]
cmp cx, word [eax + 4]
jae 0x1002210
cmp dword [ebp - 8], 0xffffffff
jne 0x10021a0
mov al, byte [esi + 1]
test al, 0x10
jne 0x100219a
cmp byte [esi], 0
jne 0x10021a0
mov cl, byte [edi + 0xc]
and cl, 3
and al, 3
cmp al, cl
jb 0x10021a0
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov al, byte [esi + 1]
test al, 0x10
jne 0x10021f8
cmp al, byte [edi + 0xc]
jne 0x10021f8
lea eax, [esi + 8]
push eax
push dword [edi + 8]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x10021f8
cmp byte [esi], 0
je 0x1002296
mov ecx, dword [edi + 0x10]
mov eax, 0xffefffff
and ecx, eax
not ecx
and dword [esi + 4], ecx
test dword [esi + 4], eax
jne 0x10021f8
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_DeleteAce]
test eax, eax
je 0x1002260
push dword [ebx]
call fcn.01001d8f
mov ecx, dword [ebx]
mov word [ecx + 2], ax
jmp 0x100217c
movzx eax, word [esi + 2]
inc dword [ebp + 8]
add esi, eax
mov eax, dword [ebx]
movzx eax, word [eax + 4]
cmp dword [ebp + 8], eax
jl 0x100217c
mov ecx, dword [edi + 0x14]
mov eax, dword [ebx]
movzx esi, word [ecx + 2]
movzx ecx, word [eax + 2]
add esi, ecx
push esi
push eax
call dword [sym.imp.msvcrt.dll_realloc]
pop ecx
pop ecx
mov dword [ebp + 8], eax
cmp esi, 0xffff
ja 0x1002273
test eax, eax
je 0x1002283
mov word [eax + 2], si
mov edi, dword [edi + 0x14]
movzx ecx, word [edi + 2]
push ecx
push edi
push dword [ebp - 8]
push 2
push eax
call dword [sym.imp.ADVAPI32.dll_AddAce]
test eax, eax
jne 0x1002268
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x100228a
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10022a9
mov eax, dword [ebp + 8]
and dword [ebp + 8], 0
mov dword [ebx], eax
jmp 0x100228a
test eax, eax
je 0x1002283
and dword [ebx], 0
mov dword [ebp - 4], 0x53c
jmp 0x100228a
mov dword [ebp - 4], 8
push dword [ebp + 8]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
jmp 0x10022a6
test byte [edi], 0x40
mov eax, dword [edi + 0x10]
je 0x10022a3
mov dword [esi + 4], eax
jmp 0x10022a6
or dword [esi + 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1002801
Capabilities:
Get user security identifier

Disassembly:
push 0x20
push 0x1005950
call fcn.010054c4
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
cmp word [eax], 0x2a
jne 0x10028b6
mov dword [ebp + 8], ebx
lea ecx, [ebp + 8]
push ecx
add eax, 2
push eax
call sub.ADVAPI32.dll_ConvertStringSidToSidW
test eax, eax
je 0x10028a3
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
lea eax, [ebp - 0x24]
push eax
push ebx
push dword [ebp + 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x10028a3
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_LocalSize]
call esi
push eax
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
cmp eax, ebx
je 0x100289c
push dword [ebp + 8]
push eax
push dword [ebp + 8]
call esi
push eax
call dword [sym.imp.ADVAPI32.dll_CopySid]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x10028a3
mov dword [ebp - 0x1c], 8
mov eax, dword [ebp + 0xc]
cmp dword [eax], ebx
jne 0x100293b
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x100292f
lea ecx, [ebp - 0x30]
push ecx
lea ecx, [ebp - 0x20]
push ecx
push ebx
lea ecx, [ebp - 0x24]
push ecx
push ebx
push eax
push ebx
mov edi, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
call edi
test eax, eax
jne 0x1002934
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x7a
jne 0x100292d
push dword [ebp - 0x24]
mov esi, dword [sym.imp.msvcrt.dll_malloc]
call esi
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
add eax, eax
push eax
call esi
pop ecx
pop ecx
mov dword [ebp - 0x2c], eax
mov esi, dword [ebp - 0x28]
cmp esi, ebx
je 0x1002924
cmp eax, ebx
je 0x1002924
lea ecx, [ebp - 0x30]
push ecx
lea ecx, [ebp - 0x20]
push ecx
push eax
lea eax, [ebp - 0x24]
push eax
push esi
push dword [ebp + 8]
push ebx
call edi
test eax, eax
je 0x10028ae
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
jmp 0x100293b
mov dword [ebp - 0x1c], 8
jmp 0x100293b
call esi
mov dword [ebp - 0x1c], eax
jmp 0x100293b
mov dword [ebp - 0x1c], 0x54f
mov dword [ebp - 4], 0xfffffffe
call fcn.01002954
mov eax, dword [ebp - 0x1c]
call fcn.01005509
ret 8
Function at 0x1005489
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x10059f0
call fcn.010054c4
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x10075e0
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x100529e
cmp eax, esi
jne 0x1005291
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x10052a1
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1005278
xor esi, esi
inc esi
mov eax, dword [0x10075dc]
cmp eax, esi
jne 0x10052b4
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x10052ef
mov eax, dword [0x10075dc]
test eax, eax
jne 0x10052e9
mov dword [0x10075dc], esi
push 0x10011b0
push 0x10011a4
call fcn.010051f5
pop ecx
pop ecx
test eax, eax
je 0x10052ef
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x10053b9
mov dword [0x10072a4], esi
mov eax, dword [0x10075dc]
cmp eax, esi
jne 0x1005313
push 0x10011a0
push 0x1001198
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x10075dc], 2
cmp dword [ebp - 0x1c], ebx
jne 0x1005320
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x10075e4], ebx
je 0x1005341
push 0x10075e4
call fcn.01005679
pop ecx
test eax, eax
je 0x1005341
push ebx
push 2
push ebx
call dword [0x10075e4]
push dword [0x100728c]
push dword [0x1007290]
push dword [0x1007288]
call fcn.0100471f
add esp, 0xc
mov dword [0x10072a0], eax
cmp dword [0x1007294], ebx
jne 0x100539f
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x10072a4], ebx
jne 0x10053ad
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x10072a0]
call fcn.01005509
ret
call fcn.010057c6
jmp 0x1005256
Function at 0x40a720
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42da1d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x45f06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x30]
mov dword [ebp - 4], 0xb
call dword [0x435408]
lea ecx, [esi + 0x2c]
mov byte [ebp - 4], 0xa
call dword [0x435408]
lea ecx, [esi + 0x28]
mov byte [ebp - 4], 9
call dword [0x435408]
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 8
call dword [0x435408]
lea ecx, [esi + 0x20]
mov byte [ebp - 4], 7
call dword [0x435408]
lea ecx, [esi + 0x1c]
mov byte [ebp - 4], 6
call dword [0x435408]
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 5
call dword [0x435408]
lea ecx, [esi + 0x14]
mov byte [ebp - 4], 4
call dword [0x435408]
lea ecx, [esi + 0x10]
mov byte [ebp - 4], 3
call dword [0x435408]
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 2
call dword [0x435408]
lea ecx, [esi + 8]
mov byte [ebp - 4], 1
call dword [0x435408]
lea ecx, [esi + 4]
mov byte [ebp - 4], 0
call dword [0x435408]
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call dword [0x435408]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4010d4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x88], eax
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x88], 0
jne 0x401104
xor al, al
jmp 0x401129
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp - 0xc]
push ecx
push 0x40112d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
xor eax, eax
cmp dword [ebp - 8], 0
setne al
mov esp, ebp
pop ebp
ret

Function at 0x4011b1
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp + 0x10], eax
call fcn.004242c1
mov dword [ebp - 4], eax
mov eax, dword [0x433438]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [ebp - 0x10]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0xc], eax
push 0x4271c8
mov edx, dword [ebp + 8]
push edx
push 0x433500
mov ecx, 0x4333a8
call fcn.00425ca0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x43342c], eax
mov ax, word [0x432cfc]
mov word [ebp - 0x1c], ax
mov cl, byte [0x432cfe]
mov byte [ebp - 0x1a], cl
mov dword [ebp - 0x14], 1
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.00401147
add esp, 8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4012d5
push str.UnregServer
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x401280
push 0
push 0
push 0x64
push 0x4333a8
call fcn.00425ea0
push 0
push 1
mov ecx, 0x4333a8
call fcn.00425e80
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x4012d5
push str.RegServer
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4012bd
push 0
push 1
push 0x64
push 0x4333a8
call fcn.00425ea0
push 0
push 1
mov ecx, 0x4333a8
call fcn.00425e60
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x4012d5
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00401147
add esp, 8
mov dword [ebp - 0x18], eax
jmp 0x401239
cmp dword [ebp - 0x14], 0
je 0x40132b
mov ecx, 0x4333a8
call fcn.004010d4
push 1
push 4
mov ecx, 0x4333a8
call fcn.00425ed0
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
lea edx, [ebp - 0x38]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401316
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x4012f6
mov ecx, 0x4333a8
call fcn.00425ef0
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x4333a8
call fcn.00425e00
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40137d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0xb0
jae 0x401419
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
call fcn.0040137d
add esp, 8
mov eax, dword [ebp + 8]
xor edx, edx
mov ecx, 3
div ecx
test edx, edx
jne 0x4013cf
mov byte [ebp - 0x10], 0
lea edx, [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
jmp 0x401417
mov eax, dword [ebp + 8]
xor edx, edx
mov ecx, 4
div ecx
test edx, edx
jne 0x4013ed
push 0xe
lea edx, [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x401417
mov eax, dword [ebp + 8]
xor edx, edx
mov ecx, 0xd
div ecx
test edx, edx
jne 0x401417
mov byte [ebp - 0xe], 0x4d
mov byte [ebp - 0xd], 0
lea edx, [ebp - 0x10]
push edx
push 1
push 0
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
jmp 0x401422
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 1
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x401983
Capabilities:
Check for time delay via gettickcount
Delete file
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x10], 0x64
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x42f594]
mov dword [ecx + 0x98], edx
mov eax, dword [ebp - 4]
mov ecx, dword [0x432cf0]
mov dword [eax + 0x90], ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edx, dword [ebp - 4]
mov dword [edx + 0xb0], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xb0], 0
je 0x4019fb
mov ecx, dword [ebp - 0x10]
add ecx, 0x7c
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 4]
mov dword [edx + 0x1a0], 0x42f598
mov eax, dword [ebp - 4]
mov ecx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [eax + 0x194], ecx
jmp 0x401aa5
push 0
push 0
push 4
push 0
push 0
push 2
push 0x432d68
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x401a6f
push 0x80
call fcn.00426183
add esp, 4
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x401a6f
push 0
lea eax, [ebp - 0x10]
push eax
push 4
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x10], 4
jne 0x401a6f
push 0
lea eax, [ebp - 0x10]
push eax
push 4
mov ecx, dword [ebp - 4]
add ecx, 0x690
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.wing.txt
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push 0
push 0
push 0x432d80
push 5
push 0
call dword [sym.imp.KERNEL32.dll_UpdateResourceA]
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xb0]
mov dword [ecx + 0x9c], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x432ce8]
mov dword [ecx + 0x94], edx
push 0x2bc
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 4]
mov ecx, dword [0x432cec]
mov dword [eax + 0x8c], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 4]
mov dword [edx + 0x168], 0x428000
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 8]
cmp eax, 0x28a
jbe 0x401b15
mov ecx, dword [ebp - 4]
push ecx
call fcn.00424485
xor eax, eax
mov esp, ebp
pop ebp
ret 8