joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4efa10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x5dccb4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 0xc]
cmp dword [esi + 0x10], 0
jne 0x4efbf5
test edi, edi
je 0x4efbf5
mov ecx, dword [esi + 0x20]
mov eax, 0x532ae21d
sub ecx, dword [esi + 0x1c]
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jae 0x4efbf5
imul eax, ebx, 0x314
mov ebx, dword [esi + 0x1c]
mov ebx, dword [eax + ebx]
test byte [ebx + 0x26], 0x10
jne 0x4efbf5
mov eax, dword [ebp + 0x10]
cmp dword [ebx + 0x18], eax
ja 0x4efbf5
mov esi, dword [esi + 0xc]
mov edx, dword [ebx + 0x2a]
movzx eax, word [edx + esi + 0x1c]
movzx ecx, word [edx + esi + 0x1a]
add eax, edx
add ecx, eax
lea eax, [esi + 0x1e]
add eax, ecx
movzx ecx, word [ebx + 0xa]
mov dword [ebp - 8], eax
test cx, cx
jne 0x4efc0a
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebx + 0x14]
mov dword [ebp - 0xc], ecx
test esi, esi
je 0x4efafd
test eax, eax
je 0x4efac9
cmp ecx, esi
jb 0x4efac9
push esi
push eax
push edi
call fcn.00516a90
add esp, 0xc
jmp 0x4efafd
push ecx
push 0
push edi
call fcn.00516300
add esp, 0xc
cmp dword [ebp - 8], 0
jne 0x4efae8
call fcn.00533819
mov dword [eax], 0x16
jmp 0x4efaf8
cmp dword [ebp - 0xc], esi
jae 0x4efafd
call fcn.00533819
mov dword [eax], 0x22
call fcn.005336f3
mov edx, dword [ebx + 0x14]
test edx, edx
je 0x4efbee
or eax, 0xffffffff
cmp edx, 8
jb 0x4efbc6
mov esi, edx
shr esi, 3
nop dword [eax]
movzx ecx, byte [edi]
sub edx, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a6650]
movzx ecx, byte [edi + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a6650]
movzx ecx, byte [edi + 2]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a6650]
movzx ecx, byte [edi + 3]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a6650]
movzx ecx, byte [edi + 4]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a6650]
movzx ecx, byte [edi + 5]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a6650]
movzx ecx, byte [edi + 6]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a6650]
movzx ecx, byte [edi + 7]
add edi, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a6650]
sub esi, 1
jne 0x4efb20
test edx, edx
je 0x4efbea
nop word [eax + eax]
movzx ecx, byte [edi]
lea edi, [edi + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a6650]
sub edx, 1
jne 0x4efbd0
not eax
jmp 0x4efbf0
xor eax, eax
cmp eax, dword [ebx + 0x10]
je 0x4efc36
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b0a78
mov esp, ebp
pop ebp
ret 0xc
cmp ecx, 8
jne 0x4efbf5
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push ecx
push dword [ebp + 0x10]
push edi
push dword [ebx + 0x14]
push eax
call fcn.004f5b40
add esp, 0x14
test eax, eax
je 0x4efbf5
mov eax, dword [ebp - 8]
cmp eax, dword [ebx + 0x10]
jne 0x4efbf5
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b0a78
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4efee0
Capabilities:
Check if file exists
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x581edf
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5dccb4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x58
call fcn.004b1019
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x4eff37
push 0x58
push 0
push esi
call fcn.00516300
add esp, 0xc
mov ecx, esi
call fcn.004edb60
mov esi, eax
jmp 0x4eff39
xor esi, esi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0xffffffff
cmp dword [edi + 0x14], 8
jb 0x4eff4b
mov edi, dword [edi]
test edi, edi
je 0x4effe8
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4effe8
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x4effe8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0x14], eax
cmp eax, 0x16
jb 0x4effe8
push 0
push 0
push 0
push 2
push 0
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
cmp dword [esi + 4], 0
mov dword [esi + 8], eax
je 0x4effe8
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0xc], eax
test eax, eax
je 0x4effe8
push dword [esi + 0x14]
mov ecx, esi
push eax
call fcn.004eed90
test eax, eax
je 0x4effe8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x4efffe
mov ecx, esi
call fcn.004edce0
push 0x58
push esi
call fcn.004b0a8e
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4f1780
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
test edx, edx
je 0x4f187f
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x4f187f
or eax, 0xffffffff
cmp esi, 8
jb 0x4f1857
push edi
mov edi, esi
shr edi, 3
nop dword [eax]
movzx ecx, byte [edx]
sub esi, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a7ea0]
movzx ecx, byte [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a7ea0]
movzx ecx, byte [edx + 2]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a7ea0]
movzx ecx, byte [edx + 3]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a7ea0]
movzx ecx, byte [edx + 4]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a7ea0]
movzx ecx, byte [edx + 5]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a7ea0]
movzx ecx, byte [edx + 6]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a7ea0]
movzx ecx, byte [edx + 7]
add edx, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a7ea0]
sub edi, 1
jne 0x4f17b0
pop edi
test esi, esi
je 0x4f187a
nop dword [eax + eax]
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a7ea0]
sub esi, 1
jne 0x4f1860
not eax
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4f7ffb
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x55a4a5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0055a0aa

Function at 0x55a4b0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0055a22b

Function at 0x561438
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00560c12

Function at 0x561443
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00560e4d

Function at 0x5618d6
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0056165d

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x42e030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x702c8a
Capabilities:
Encode data using xor

Disassembly:
fiadd dword [0x4d6a641f]
pop edi
push ebx
loopne 0x702c68
push esi
jne fcn.00702cb8
adc bh, bh
call 0x236e25d5
pop ss
adc eax, 0x10b0c887
aas
shr byte [esi - 0x2335791c], 1
lea edi, [ebp - 0x1c]
std
inc dword [edi + 0x3558965d]
jmp 0x6b69b597
ja 0x702c5b
or dword [eax], ebp
dec esi
mov cl, 0x57

Function at 0x724f39
Capabilities:
Encode data using xor

Disassembly:
add al, 0x89
adc ecx, dword [ecx + 0x18894814]
inc eax
cmpsb byte [esi], byte es:[edi]
or al, 0xa0
push dword [0xd004c223]
stosd dword es:[edi], eax
pop esi
insb byte es:[edi], dx
fdivr dword [ebx]
invalid

Function at 0x7817b6
Capabilities:
Encode data using xor

Disassembly:
jmp 0x7817d4
or dword [0x10491169], edx
adc dword [ecx + 0x10], ecx
cmovno edx, esp
mov ebx, 0x2730cea6
mov dword [eax + 0x5c], ecx
or dword [ebx + 0x22], 0xffffffc7
aaa
jle 0x7817b3
je 0x7817f6
mov ebx, dword [esi]
in al, dx
dec edx
fdiv st(1)
invalid
invalid
and bl, byte [edi + edi*2 - 0x4fb780c1]
and dword [edi - 0x11], eax
mov dword [0x10ec45c7], eax
nop
jg 0x781848
pushfd
mov ah, byte [0x45439c10]
movups xmm4, xmm0
xchg ebp, eax
test eax, 0xecc0e3e2
invalid
clc
jg 0x7817a7
jle 0x781876
mov ebx, dword [esi + 0x5c]
cmp edi, ebx
je 0x781863
fbstp tbyte [esi + edi - 0x73]
outsd dx, dword [esi]
ja 0x781847
lea ebp, [edi + 0x77]
push ds
loopne 0x781819
dec ecx
nop
invalid
retf
loopne 0x781822
pop edi
enter 0x2425, 0xffffffffffffffdc
loopne 0x7818a1
call 0x2108b435
in al, 0xe2
test byte [ebp - 0x1c], bh
invalid
out dx, al
pop dword [eax - 0x75]
push ebp
invalid
add eax, 0x8958798b
dec ebp
int3
cmc
add al, 0xf
test byte [ecx], dh
mov bh, 0x13
lea ecx, [eax + 0x64]
mov dword [ebp - 0x4c], ecx
add eax, 0x68
mov dword [ebp - 0x44], eax
outsd dx, dword [esi]
cli
out dx, eax
fcom dword [ecx + 0x45ca015a]
int3
Function at 0x9b4700
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x65f00d
lea edi, [esi - 0x25e00d]
push edi
or ebp, 0xffffffff
jmp 0x9b4722
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x9b4729
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9b4718
mov eax, 1
add ebx, ebx
jne 0x9b473b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x9b4730
jne 0x9b474c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x9b4730
xor ecx, ecx
sub eax, 3
jb 0x9b4760
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x9b47d2
mov ebp, eax
add ebx, ebx
jne 0x9b476b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x9b4778
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x9b479c
inc ecx
add ebx, ebx
jne 0x9b4788
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x9b477d
jne 0x9b4799
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x9b477d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x9b47bc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x9b47ad
jmp 0x9b471e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x9b47bc
add edi, ecx
jmp 0x9b471e
pop esi
mov edi, esi
mov ecx, 0x184b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x9b47da
cmp byte [edi], 0x11
jne 0x9b47da
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x9b47df
lea edi, [esi + 0x5b0000]
mov eax, dword [edi]
or eax, eax
je 0x9b484e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5b6fa4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5b6ffc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x9b480c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5b7004]
or eax, eax
je 0x9b4848
mov dword [ebx], eax
add ebx, 4
jmp 0x9b4829
call dword [esi + 0x5b7000]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x9b487f
cmp al, 0xef
ja 0x9b4872
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x9b4854
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x9b4861
mov ebp, dword [esi + 0x5b7008]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x197]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x9b48b3
sub esp, 0xffffff80
jmp 0x40f16c
Function at 0x4013f0
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x40fffc]
push edi
push 0x196
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov eax, esi
lea edx, [eax + 2]
jmp 0x401410
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401410
sub eax, edx
sar eax, 1
js 0x401430
sub eax, 1
mov cx, word [esi + eax*2 + 2]
mov word [esi + eax*2 + 8], cx
jns 0x401421
push 0xc6
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov ax, word [edi]
xor edx, edx
mov word [edi + 6], dx
mov word [esi], ax
mov cx, word [edi + 2]
mov eax, dword [0x40fffc]
push edi
mov word [esi + 2], cx
mov dx, word [edi + 4]
push 0
push eax
mov word [esi + 4], dx
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
ret

Function at 0x401fb0
Capabilities:
Create process on windows
Terminate thread
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x6ac
mov eax, dword [0x40e008]
xor eax, esp
mov dword [esp + 0x6a8], eax
mov eax, dword [0x40fb04]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push eax
mov dword [0x41002c], 0
call esi
mov ecx, dword [0x40f914]
push ecx
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, 1
cmp dword [0x41002c], esi
je 0x402044
mov edx, dword [0x40f8f8]
mov eax, dword [edx]
push 0
push 6
push 2
push 0
push esi
push 0x40000000
push eax
call ebx
mov ecx, dword [0x40f8f8]
mov edx, dword [ecx + 4]
push 0
push 6
push 2
push 0
push esi
push 0x40000000
push edx
mov dword [0x40fb04], eax
call ebx
mov dword [0x40f914], eax
mov dword [0x41002c], esi
lea edi, [esp + 0x10]
call fcn.00402170
mov esi, edi
call fcn.004023d0
mov edx, dword [0x40fb04]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [esp + 0x10]
push eax
push 0x6a0
mov ecx, edi
push ecx
push edx
mov dword [esp + 0x20], 0
call esi
mov edx, dword [0x40f914]
push 0
lea eax, [esp + 0x10]
push eax
push 0x6a0
mov ecx, edi
push ecx
push edx
call esi
mov eax, dword [0x40f8e4]
mov esi, dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0
push eax
call esi
mov ecx, dword [0x40f8e0]
push 0
push ecx
call esi
mov edx, dword [0x40f8dc]
push 0
push edx
call esi
mov eax, dword [0x40ffe8]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [0x40f910]
mov edx, dword [ecx + 0xc]
mov edi, 1
push edi
push 0
push 0
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [0x40fb04]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
mov dword [0x41002c], 0
call esi
mov ecx, dword [0x40f914]
push ecx
call esi
cmp dword [0x41002c], edi
je 0x40214e
mov edx, dword [0x40f8f8]
mov eax, dword [edx]
push 0
push 6
push 3
push 0
push edi
push 0x80000000
push eax
call ebx
mov ecx, dword [0x40f8f8]
mov edx, dword [ecx + 4]
push 0
push 6
push 3
push 0
push edi
push 0x80000000
push edx
mov dword [0x40fb04], eax
call ebx
mov dword [0x40f914], eax
mov dword [0x41002c], edi
mov ecx, dword [esp + 0x6b4]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00403bba
mov esp, ebp
pop ebp
ret
Function at 0x402560
Capabilities:
List user accounts

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
xor edi, edi
push edi
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0xffffffffffffffff
lea edx, [esp + 0x28]
push edx
push 2
push 1
push edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
call sub.NETAPI32.dll_NetUserEnum
mov eax, dword [esp + 0x10]
mov edx, dword [0x40fffc]
mov esi, dword [esp + 0x18]
lea ecx, [eax*4 + 1]
push ecx
push 8
push edx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, dword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov dword [0x40f8fc], eax
xor ebx, ebx
lea esp, [esp]
cmp dword [esi + 0xc], 2
jne 0x4025e9
mov eax, dword [esi]
mov ecx, dword [esp + 0x20]
push eax
push 0
push 0x143
push 0x3ed
push ecx
call ebp
mov edx, dword [esi]
mov eax, dword [0x40f8fc]
mov dword [edi + eax], edx
add edi, 4
mov ecx, dword [esp + 0x10]
inc ebx
dec ecx
add esi, 0x20
cmp ebx, ecx
jbe 0x4025c0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x402930
Capabilities:
Compare security identifiers

Disassembly:
sub esp, 0x54
mov eax, dword [0x40e008]
xor eax, esp
mov dword [esp + 0x50], eax
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push 2
mov dword [esp + 0x14], ebx
call fcn.00403cbb
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push eax
push 0x2000e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push 0x43
lea ecx, [esp + 0x21]
push ebx
push ecx
mov byte [esp + 0x28], bl
call fcn.00407600
add esp, 0xc
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x20]
push eax
push ebx
push 0x1a
mov dword [esp + 0x28], 0x44
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
mov edx, dword [esp + 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea ecx, [esp + 0x10]
push ecx
push 2
push esi
push 2
push edx
call edi
push esi
call fcn.00403d85
mov eax, dword [esp + 0x14]
push eax
call fcn.00403cbb
mov edx, dword [esp + 0x18]
add esp, 8
lea ecx, [esp + 0x10]
push ecx
push edx
mov esi, eax
mov eax, dword [esp + 0x1c]
push esi
push 2
push eax
call edi
xor ebp, ebp
xor edi, edi
lea ebx, [esi + 4]
mov ecx, dword [ebx]
push ecx
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x402a00
mov eax, dword [esi]
inc edi
dec eax
add ebx, 8
cmp edi, eax
jbe 0x4029e1
jmp 0x402a05
mov ebp, 1
push esi
call fcn.00403d85
mov ecx, dword [esp + 0x18]
add esp, 4
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x60]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
xor ecx, esp
call fcn.00403bba
add esp, 0x54
ret
Function at 0x402bb0
Capabilities:
Create directory

Disassembly:
mov eax, dword [0x40fffc]
push ebx
push ebp
push esi
push edi
push 0x190
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x40f910]
mov edx, dword [ecx + 4]
push edx
mov ebx, eax
push 0xc6
push ebx
call fcn.00403bfd
add esp, 0xc
xor ecx, ecx
xor eax, eax
cmp word [ebx + eax*2], 0x5c
jne 0x402bee
mov ecx, eax
inc eax
cmp eax, 0xc6
jbe 0x402be5
xor eax, eax
mov word [ebx + ecx*2], ax
xor esi, esi
xor ecx, ecx
cmp word [ebx + eax*2], 0x5c
jne 0x402c0a
mov esi, eax
inc ecx
cmp ecx, 2
je 0x402c17
inc eax
cmp eax, 0xc6
jbe 0x402c00
mov eax, 0xc6
cmp esi, eax
ja 0x402c2e
mov cx, word [ebx + eax*2]
mov word [ebx + eax*2 + 2], cx
dec eax
cmp eax, esi
jae 0x402c20
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor edx, edx
push edx
lea edi, [ebx + esi*2]
push ebx
mov word [edi], dx
call ebp
cmp esi, 0xc6
ja 0x402c57
lea eax, [edi + 2]
mov ecx, 0xc7
sub ecx, esi
mov esi, eax
rep movsw word es:[edi], word [esi]
push 0
push ebx
call ebp
mov eax, dword [0x40fffc]
push ebx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x402c70
Capabilities:
Set registry value

Disassembly:
cmp dword [esp + 4], 1
push ebx
push ebp
push esi
push edi
mov ebx, eax
jne 0x402c8e
mov eax, dword [esp + 0x18]
push 0xffffffffffffffff
push 0
push eax
push 3
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor esi, esi
jmp 0x402ca0
mov ecx, dword [0x40f910]
mov edx, dword [esi + ecx]
mov eax, edx
lea edi, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402cb0
mov ecx, dword [0x40f8f4]
sub eax, edi
sar eax, 1
add eax, eax
push eax
mov eax, dword [esi + ebx]
push edx
mov edx, dword [esi + ecx]
push 1
push 0
push edx
push eax
call ebp
add esi, 4
cmp esi, 8
jbe 0x402ca0
mov edi, dword [esp + 0x18]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
mov esi, ebx
sub edi, ebx
mov ebx, 3
mov ecx, dword [edi + esi]
mov edx, dword [esi]
push 1
push ecx
push 4
push 0
push edx
call ebp
add esi, 4
sub ebx, 1
jne 0x402cf2
cmp dword [esp + 0x14], 1
pop edi
pop esi
pop ebp
pop ebx
jne 0x402d25
mov eax, dword [esp + 8]
push 0xffffffffffffffff
push 0
push eax
push 3
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
ret
Function at 0x402e40
Capabilities:
Copy file
Create process on windows
Create process suspended
Resume thread

Disassembly:
mov eax, dword [0x40ffe0]
test eax, eax
jne 0x402e61
mov eax, dword [0x40fffc]
push 0x1f4
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [0x40ffe0], eax
mov ecx, dword [esp + 4]
push ecx
push pe_nt_image_headers32
push eax
call fcn.00403bfd
mov edx, dword [0x40ffe0]
push 0x40cd04
push pe_nt_image_headers32
push edx
call fcn.00403e13
mov eax, dword [0x40f904]
mov ecx, dword [eax + 0xc]
mov edx, dword [0x40ffe0]
push ecx
push pe_nt_image_headers32
push edx
call fcn.00403e13
mov eax, dword [0x40fb14]
add esp, 0x24
push 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [0x40fac0], 0x44
test eax, eax
jne 0x402f3b
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileW]
push eax
push 0x40fb18
push 0x40f918
call esi
push 0
push 0x40fcb0
push 0x40f918
call esi
cmp dword [0x40fb10], 0
je 0x402efc
push 0
push 0x40fe48
push 0x40f918
call esi
mov ecx, dword [0x40ffe0]
push 0x40fab0
push 0x40fac0
push 0
push 0
push 4
push 0
push 0
push 0
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edx, dword [0x40fab4]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [0x40fb14]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop esi
ret

Function at 0x4033b0
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [0x40fffc]
push esi
push 0x258
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0xc6
mov esi, eax
push 0x12b
push esi
mov edx, 0x40f918
call section..text
add esp, 0xc
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x403400
push 1
call fcn.00404130
mov ecx, dword [0x40fffc]
push esi
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
ret

Function at 0x403490
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended
Resume thread

Disassembly:
push ecx
push esi
push edi
lea eax, [esp + 8]
push eax
push ecx
mov dword [esp + 0x10], 0
mov dword [0x40fac0], 0x44
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
xor esi, esi
jmp 0x4034c0
mov edx, dword [0x40f904]
mov eax, dword [edx + 0xc]
mov ecx, dword [edi + esi*4]
push eax
push ecx
call fcn.00409f45
add esp, 8
test eax, eax
je 0x4034e8
mov edx, dword [esp + 8]
inc esi
dec edx
cmp esi, edx
jbe 0x4034c0
pop edi
pop esi
pop ecx
ret
push 0x40fab0
push 0x40fac0
push 0
push 0
push 4
push 0
push 0
push 0
push 0
push 0x40f918
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov eax, dword [0x40fab4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 1
call fcn.00404130
int3