joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405a10
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [0x469ebc]
test eax, eax
jne 0x405a64
mov eax, 1
test byte [0x45fce0], al
jne 0x405a5a
or dword [0x45fce0], eax
mov dword [0x45fce8], 0xffffffff
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push 0x45fce8
xor ecx, ecx
mov dword [0x45fe08], eax
call fcn.00433050
push 0x44f9f0
call fcn.00436886
add esp, 4
mov eax, 0x45fce8
mov dword [0x469ebc], eax
ret

Function at 0x407740
Capabilities:
Get file version info

Disassembly:
sub esp, 8
push edi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jne 0x40775a
or eax, 0xffffffff
pop edi
add esp, 8
ret
push esi
push edi
call fcn.0043651c
add esp, 4
mov esi, eax
push esi
push edi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoA
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
push ecx
push 0x454100
push esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call sub.VERSION.dll_VerQueryValueA
mov eax, dword [esp + 8]
movzx edx, word [eax + 0xc]
movzx ecx, word [eax + 0xe]
push edx
movzx edx, word [eax + 8]
movzx eax, word [eax + 0xa]
push ecx
mov ecx, dword [esp + 0x1c]
push edx
push eax
push str._d._d._d._d
push 0x64
push ecx
call fcn.0043631a
push esi
call fcn.0043643f
add esp, 0x20
pop esi
xor eax, eax
pop edi
add esp, 8
ret
Function at 0x40b7e0
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
sub esp, 0x29c
mov eax, dword [0x45d600]
xor eax, esp
mov dword [esp + 0x294], eax
lea eax, [esp]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x40b821
mov eax, 1
mov ecx, dword [esp + 0x294]
xor ecx, esp
call fcn.0043581d
add esp, 0x29c
ret
push 0x100
lea ecx, [esp + 0x194]
push ecx
call dword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
je 0x40b854
lea edx, [esp + 0x190]
push edx
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x40b854
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov eax, dword [ecx]
jmp 0x40b857
or eax, 0xffffffff
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
push 0x454030
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x294]
xor ecx, esp
xor eax, eax
call fcn.0043581d
add esp, 0x29c
ret

Function at 0x414240
Capabilities:
Get file attributes

Disassembly:
sub esp, 0x258
mov eax, dword [0x45d600]
xor eax, esp
mov dword [esp + 0x254], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x26c]
push edi
lea eax, [esp + 0x15c]
push 0x104
push eax
call fcn.00435e29
add esp, 0xc
push 0x455194
lea ecx, [esp + 0x15c]
push 0x104
push ecx
call fcn.00435f19
add esp, 0xc
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x4143ae
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ebp, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea ecx, [esp + 0x44]
push 0x455170
push ecx
call fcn.00436105
add esp, 8
test eax, eax
je 0x41438b
lea edx, [esp + 0x44]
push 0x455198
push edx
call fcn.00436105
add esp, 8
test eax, eax
je 0x41438b
push edi
lea eax, [esp + 0x15c]
push 0x104
push eax
call fcn.00435e29
add esp, 0xc
push 0x454100
lea ecx, [esp + 0x15c]
push 0x104
push ecx
call fcn.00435f19
add esp, 0xc
lea edx, [esp + 0x44]
push edx
lea eax, [esp + 0x15c]
push 0x104
push eax
call fcn.00435f19
add esp, 0xc
lea ecx, [esp + 0x158]
push ecx
call ebx
lea edx, [esp + 0x158]
test al, 0x10
je 0x414375
push edx
call fcn.00414240
add esp, 4
push 0
lea eax, [esp + 0x15c]
push eax
call esi
lea ecx, [esp + 0x158]
push ecx
call ebp
jmp 0x41438b
push 0x80
push edx
call esi
lea eax, [esp + 0x158]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4142c1
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x264]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043581d
add esp, 0x258
ret
Function at 0x414840
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
sub esp, 0x35c
mov eax, dword [0x45d600]
xor eax, esp
mov dword [esp + 0x354], eax
push esi
push edi
push 0x103
lea eax, [esp + 0x255]
push 0
push eax
mov byte [esp + 0x25c], 0
call fcn.0043e3a0
add esp, 0xc
push 0
push 0x2b
lea ecx, [esp + 0x258]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push str.TerutenWebCubeAgent_
lea edx, [esp + 0x254]
push 0x104
push edx
call fcn.00435f19
add esp, 0xc
lea eax, [esp + 0x250]
push eax
lea ecx, [esp + 0x14c]
push 0x104
push ecx
call fcn.00435e29
add esp, 0xc
push 0x4551dc
lea edx, [esp + 0x14c]
push 0x104
push edx
call fcn.00435f19
add esp, 0xc
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x14c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x41495d
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea ebx, [ebx]
cmp byte [esp + 0x34], 0x2e
je 0x414951
test byte [esp + 8], 0x10
jne 0x414951
lea edx, [esp + 0x250]
push edx
lea eax, [esp + 0x14c]
push 0x104
push eax
call fcn.00435e29
add esp, 0xc
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x14c]
push 0x104
push edx
call fcn.00435f19
add esp, 0xc
lea ecx, [esp + 0x148]
call fcn.00430f40
lea eax, [esp + 8]
push eax
push esi
call edi
test eax, eax
jne 0x414900
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x35c]
pop edi
pop esi
xor ecx, esp
call fcn.0043581d
add esp, 0x35c
ret
Function at 0x41ea50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44da08
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x45d600]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
and dword [esp + 0x14], 0xfffffe00
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0xc]
push eax
push edi
push esi
mov dword [esp + 0x3c], 1
call fcn.0041eb30
test al, al
jne 0x41eac8
lea esi, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.004266b0
xor al, al
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret
mov eax, esi
call fcn.00420b70
mov eax, dword [eax]
lea ecx, [esp + 0xc]
mov edx, eax
call fcn.00426840
mov eax, esi
call fcn.00420b70
mov ecx, dword [eax]
mov eax, dword [edi + 4]
sub eax, dword [esi + 0x5c]
mov dword [ecx + 0x10], eax
mov eax, esi
call fcn.00420b70
mov ecx, dword [eax]
mov eax, dword [edi + 8]
sub eax, dword [esi + 0x5c]
lea esi, [esp + 0xc]
mov dword [ecx + 0x14], eax
mov dword [esp + 0x30], 0xffffffff
call fcn.004266b0
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret
Function at 0x4223b0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x44c0fb
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x45d600]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004351cd
push 4
mov dword [esp + 0x20], 0
call fcn.0043611c
mov edi, eax
add esp, 4
test edi, edi
je 0x42242e
call fcn.00434b01
mov dword [edi], eax
call fcn.0043492f
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.00434c51
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x422423
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.00434c79
jmp 0x422430
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x4308d0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov esi, eax
mov edi, ecx
mov edx, 0x10
test ebp, ebp
je 0x430a52
test edi, edi
je 0x430a52
test esi, esi
je 0x430a52
mov ecx, dword [esp + 0x18]
test ecx, ecx
jl 0x430a52
cmp dword [ebp], 1
lea eax, [ecx - 0x10]
push ebx
mov dword [ebp + 0xa4], eax
lea ebx, [ebp + 4]
jne 0x4309ba
cmp ecx, edx
mov eax, ebx
jl 0x430977
shr ecx, 4
mov dword [esp + 0x10], ecx
inc ecx
shl ecx, 4
mov dword [esp + 0x18], ecx
mov ecx, dword [eax]
xor ecx, dword [edi]
push esi
mov dword [esi], ecx
mov edx, dword [eax + 4]
xor edx, dword [edi + 4]
mov dword [esi + 4], edx
mov ecx, dword [eax + 8]
xor ecx, dword [edi + 8]
mov dword [esi + 8], ecx
mov edx, dword [eax + 0xc]
xor edx, dword [edi + 0xc]
lea eax, [ebp + 0x14]
mov dword [esi + 0xc], edx
mov edx, esi
call fcn.0042dd00
mov eax, esi
add esp, 4
add edi, 0x10
add esi, 0x10
sub dword [esp + 0x10], 1
jne 0x430931
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
add edx, 0xfffffff0
sub ecx, edx
mov dword [ebp + 0xa4], ecx
mov dword [esi], edx
mov edx, dword [eax]
mov dword [ebx], edx
mov edx, dword [eax + 4]
mov dword [ebx + 4], edx
mov edx, dword [eax + 8]
push ecx
mov dword [ebx + 8], edx
mov eax, dword [eax + 0xc]
push edi
add ebp, 0x94
push ebp
mov dword [ebx + 0xc], eax
call fcn.0043bde0
add esp, 0xc
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
pop ecx
ret
cmp ecx, edx
jl 0x430a07
shr ecx, 4
lea eax, [ecx + 1]
shl eax, 4
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], eax
nop
push esi
lea eax, [ebp + 0x14]
mov edx, edi
call fcn.0042ed10
mov ecx, dword [ebx]
xor dword [esi], ecx
mov edx, dword [ebx + 4]
xor dword [esi + 4], edx
mov eax, dword [ebx + 8]
xor dword [esi + 8], eax
mov ecx, dword [ebx + 0xc]
xor dword [esi + 0xc], ecx
mov ebx, edi
add esp, 4
add edi, 0x10
add esi, 0x10
sub dword [esp + 0x10], 1
jne 0x4309d0
mov edx, dword [esp + 0x18]
mov ecx, dword [ebx]
mov eax, dword [esp + 0x20]
mov dword [ebp + 4], ecx
add edx, 0xfffffff0
mov dword [eax], edx
mov edx, dword [ebx + 4]
mov dword [ebp + 8], edx
mov eax, dword [ebx + 8]
mov dword [ebp + 0xc], eax
mov ecx, dword [ebx + 0xc]
add esi, 0xfffffff0
mov dword [ebp + 0x10], ecx
mov edx, dword [esi]
add ebp, 0xa8
mov dword [ebp], edx
mov eax, dword [esi + 4]
mov dword [ebp + 4], eax
mov ecx, dword [esi + 8]
pop ebx
mov dword [ebp + 8], ecx
mov edx, dword [esi + 0xc]
pop edi
pop esi
mov dword [ebp + 0xc], edx
mov eax, 1
pop ebp
pop ecx
ret
pop edi
pop esi
xor eax, eax
pop ebp
pop ecx
ret
Function at 0x432570
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x44c21b
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x45d600]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor ebx, ebx
lea ecx, [esi + 4]
mov dword [esi], ebx
push 0x80
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push 0x4561e0
mov byte [ecx + 4], bl
call fcn.004019c0
mov dword [esp + 0x14], ebx
lea ecx, [esi + 0x30]
mov dword [esi + 0x20], 0x118
mov dword [esi + 0x24], 0x82
mov dword [esi + 0x28], 0xa
mov dword [esi + 0x2c], 0x1388
push 5
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push str.Arial
mov byte [ecx + 4], bl
call fcn.004019c0
mov dword [esi + 0x4c], 0x14
mov dword [esi + 0x50], 1
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4

Function at 0x432a60
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x44c55b
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x45d600]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, ecx
test edx, edx
je 0x432aa5
cmp byte [edx], 0
je 0x432aa5
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x432a92
sub eax, esi
push eax
push edx
lea ecx, [edi + 4]
call fcn.004019c0
mov eax, dword [esp + 0x1c]
push 0x54
mov dword [edi + 0x2c], eax
call fcn.0043611c
add esp, 4
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], 0
test eax, eax
je 0x432ace
push eax
call fcn.00432b10
jmp 0x432ad0
xor eax, eax
push 0
push 0
push eax
push 0x432620
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4

Function at 0x432b10
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x44c21b
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x45d600]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov eax, dword [edi]
mov dword [esi], eax
xor ebx, ebx
push 0xffffffffffffffff
lea ecx, [esi + 4]
lea eax, [edi + 4]
push ebx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.00401790
mov dword [esp + 0x14], ebx
mov ecx, dword [edi + 0x20]
mov dword [esi + 0x20], ecx
mov edx, dword [edi + 0x24]
mov dword [esi + 0x24], edx
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov ecx, dword [edi + 0x2c]
mov dword [esi + 0x2c], ecx
push 0xffffffffffffffff
lea ecx, [esi + 0x30]
lea eax, [edi + 0x30]
push ebx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.00401790
mov edx, dword [edi + 0x4c]
mov dword [esi + 0x4c], edx
mov eax, dword [edi + 0x50]
mov dword [esi + 0x50], eax
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x4334d0
Capabilities:
Get file size
Get thread local storage value
Set thread local storage value
Write file on windows

Disassembly:
mov eax, 0xa024
call fcn.00448800
mov eax, dword [0x45d600]
xor eax, esp
mov dword [esp + 0xa01c], eax
cmp dword [esi], 0xffffffff
push ebp
mov ebp, dword [esp + 0xa030]
push edi
mov edi, ecx
jne 0x433502
mov eax, 2
jmp 0x433632
mov eax, dword [esi + 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x43351d
mov eax, 4
jmp 0x433632
mov ecx, dword [esi + 0x120]
push 1
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov edx, dword [esi + 4]
push 0x64
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x433549
mov eax, 3
jmp 0x433632
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
test edi, edi
jne 0x433563
lea edi, [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [esp + 0xa034]
movzx edx, word [esp + 0x22]
push eax
movzx eax, word [esp + 0x24]
push ecx
movzx ecx, word [esp + 0x26]
push edi
push edx
movzx edx, word [esp + 0x2c]
push eax
movzx eax, word [esp + 0x2e]
push ecx
movzx ecx, word [esp + 0x2e]
push edx
movzx edx, word [esp + 0x30]
push eax
push ecx
push edx
push str._04d__02d__02d_t_02d:_02d:_02d:_03d_t_s_t_08d_t_4u_t_4u_t
lea edx, [esp + 0x50]
call fcn.00433650
push ebx
mov ecx, 0xa000
push ebp
sub ecx, eax
push ecx
lea edx, [esp + eax + 0x5c]
push edx
mov dword [esp + 0x4c], eax
call fcn.004369f1
mov ecx, dword [esp + 0x4c]
add ecx, eax
mov eax, dword [esi]
mov byte [esp + ecx + 0x60], 0xd
add esp, 0x40
mov byte [esp + ecx + 0x21], 0xa
mov byte [esp + ecx + 0x22], 0
push 0
add ecx, 2
push eax
mov dword [esp + 0x14], ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
lea ecx, [esi + 8]
push ecx
lea edx, [esp + 0x10]
push edx
mov edx, dword [esi]
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x14]
push eax
lea ecx, [esp + 0x2c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 4]
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov ecx, dword [esi + 0x120]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor eax, eax
mov ecx, dword [esp + 0xa024]
pop edi
pop ebp
xor ecx, esp
call fcn.0043581d
add esp, 0xa024
ret 8
Function at 0x4341d0
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x24
lea eax, [esp + 4]
push eax
push 0x20
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x434282
lea ecx, [esp + 8]
push ecx
push str.SeDebugPrivilege
push 0
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 2
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x43426e
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
push 0
push 0
push 0x10
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x14]
push 0
push edx
mov dword [esp + 0x30], eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x43425a
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add esp, 0x24
ret
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xfffff31c
add esp, 0x24
ret
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xfffff3e4
add esp, 0x24
ret
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xfffff3e4
add esp, 0x24
ret

Function at 0x43581d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45d600]
jne 0x435827
repz ret
jmp fcn.0043d1aa
Function at 0x447ab6
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0043dd6a
and dword [ebp - 4], 0
cmp dword [0x45fadc], 0
mov ebx, eax
jne 0x447b67
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x447c18
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4528d0
push edi
call esi
test eax, eax
je 0x447c18
push eax
call fcn.0043dcf8
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x45fadc], eax
call esi
push eax
call fcn.0043dcf8
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x45fae0], eax
call esi
push eax
call fcn.0043dcf8
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x45fae4], eax
call esi
push eax
call fcn.0043dcf8
pop ecx
mov dword [0x45faec], eax
test eax, eax
je 0x447b67
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0043dcf8
pop ecx
mov dword [0x45fae8], eax
mov eax, dword [0x45fae8]
cmp eax, ebx
je 0x447bbf
cmp dword [0x45faec], ebx
je 0x447bbf
push eax
call fcn.0043dd73
push dword [0x45faec]
mov esi, eax
call fcn.0043dd73
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x447bbf
test edi, edi
je 0x447bbf
call esi
test eax, eax
je 0x447bb6
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x447bb6
test byte [ebp - 0xc], 1
jne 0x447bbf
or dword [ebp + 0x10], 0x200000
jmp 0x447bf8
mov eax, dword [0x45fae0]
cmp eax, ebx
je 0x447bf8
push eax
call fcn.0043dd73
pop ecx
test eax, eax
je 0x447bf8
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x447bf8
mov eax, dword [0x45fae4]
cmp eax, ebx
je 0x447bf8
push eax
call fcn.0043dd73
pop ecx
test eax, eax
je 0x447bf8
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x45fadc]
call fcn.0043dd73
pop ecx
test eax, eax
je 0x447c18
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x447c1a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0xb56058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xb561a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xb5607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xb5606a
add dl, dl
jne 0xb56089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xb560dc
xor eax, eax
add dl, dl
jne 0xb56096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xb5617d
add dl, dl
jne 0xb560a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb560b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb560bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb560c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xb560d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xb56075
mov eax, 1
add dl, dl
jne 0xb560ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb560f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xb560e1
sub eax, ebx
mov ebx, 1
jne 0xb56128
mov ecx, 1
add dl, dl
jne 0xb5610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xb56119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xb56105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xb56075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xb5613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xb5614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xb56136
cmp eax, 0x7d00
jae 0xb5616d
cmp eax, 0x500
jb 0xb56168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xb56075
cmp eax, 0x7f
ja 0xb56170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xb56075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xb5619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xb56075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10492058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.104921a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1049207e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1049206a
add dl, dl
jne 0x10492089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104920dc
xor eax, eax
add dl, dl
jne 0x10492096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1049217d
add dl, dl
jne 0x104920a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104920b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104920bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104920c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x104920d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10492075
mov eax, 1
add dl, dl
jne 0x104920ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104920f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104920e1
sub eax, ebx
mov ebx, 1
jne 0x10492128
mov ecx, 1
add dl, dl
jne 0x1049210e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10492119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10492105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10492075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1049213f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1049214a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10492136
cmp eax, 0x7d00
jae 0x1049216d
cmp eax, 0x500
jb 0x10492168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10492075
cmp eax, 0x7f
ja 0x10492170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10492075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1049219e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10492075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10