joyce8/EMBER2024-capa huggingface dataset:
Function at 0x427adc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x427bdc
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040a8f0
lea eax, [ebp - 4]
call fcn.0040aa64
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040afa0
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x427bc6
mov eax, ebx
call fcn.00406e60
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x427bbf
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040afa0
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x427ba9
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x427bf0
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x427ba9
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x10]
shr eax, 0x10
movzx eax, ax
mov dword [esi], eax
mov eax, dword [ebp - 0x14]
movzx eax, word [eax + 0x10]
mov dword [edi], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x14]
shr eax, 0x10
movzx eax, ax
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x427bc6
mov eax, dword [ebp - 0x10]
call fcn.00406e7c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x427be3
lea eax, [ebp - 4]
call fcn.0040a4c8
ret

Function at 0x428bfc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.0040a9a4
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040f73c
mov edi, eax
cmp edi, 0x104
jbe 0x428ba7
mov eax, edi
add eax, eax
call fcn.00406e60
mov esi, eax
jmp 0x428ba9
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040f73c
push esi
call sub.user32.dll_CharUpperW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x428be2
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x428bcc
mov eax, esp
cmp esi, eax
je 0x428bef
mov eax, esi
call fcn.00406e7c
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x428c28
cmp bl, 0
je 0x428c24
cmp bl, 0x41
jl 0x428c1f
cmp bl, 0x5a
jg 0x428c1f
or bl, 0x20
xor al, bl
inc esi
jmp 0x428c03
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x428b68

Function at 0x429520
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, ecx
mov word [esp], 0
push 0x400
lea ecx, [esp + 4]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW
mov eax, ebx
mov edx, esp
mov ecx, 0x400
call fcn.0040b040
add esp, 0x800
pop ebx
ret
Function at 0x482a20
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x482a28
mov eax, edx
pop esi
pop ebx
ret

Function at 0x4bfbcc
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
or dl, byte [ebx + 0xd]
je 0x4bfc0f
cmp byte [ebx + 0x11], 0
jne 0x4bfc0f
cmp byte [ebx + 0x2c], 0
jne 0x4bfc0f
mov byte [ebx + 0xf], 0
mov byte [ebx + 0xd], 0
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x4bfc26
mov ecx, dword [0x4fab90]
mov dl, 1
mov eax, dword [0x49226c]
call fcn.00426af0
call fcn.00409bc4
pop ebx
ret
mov ecx, dword [0x4fab90]
mov dl, 1
mov eax, dword [0x49226c]
call fcn.00426af0
call fcn.00409bc4
pop ebx
ret

Function at 0x4c0458
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x4c04a6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.004bfa4c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c04bf
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4c04c8
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.004bfa4c
dec esi
jne 0x4c04ea
mov byte [ebx + 0xf], 0
pop esi
pop ebx
ret

Function at 0x4f2624
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x24], ecx
mov esi, eax
lea edi, [ebp - 0x20]
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
lea eax, [ebp - 0x20]
mov edx, dword [0x4f1ea8]
call fcn.0040b848
xor eax, eax
push ebp
push 0x4f26ff
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4faa1c]
call fcn.004081fc
call fcn.00406fd4
lea edx, [ebp - 0x10]
lea eax, [ebp - 0x18]
call fcn.004f2474
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0
lea edx, [ebp - 0x2c]
xor ecx, ecx
mov eax, 0x4f2718
call fcn.00421bd8
mov eax, dword [ebp - 0x24]
call fcn.004f1fc0
lea eax, [ebp - 0x30]
mov ecx, dword [ebp - 0x20]
mov edx, 0x4f2754
call fcn.0040b1f0
mov eax, dword [ebp - 0x30]
call fcn.004f1fc0
push 1
push 0
push 0
mov eax, dword [ebp - 0x20]
call fcn.0040afa0
push eax
push 0x4f276c
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f2706
lea eax, [ebp - 0x30]
call fcn.0040a4c8
lea eax, [ebp - 0x24]
call fcn.0040a4c8
lea eax, [ebp - 0x20]
mov edx, dword [0x4f1ea8]
call fcn.0040b6b4
ret
Function at 0x405e20
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x474c6b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x4040f4
call fcn.00406a81
push 4
mov dword [esp + 0x18], 0
call fcn.00407a74
mov edi, eax
add esp, 4
test edi, edi
je 0x405e94
push ebx
call fcn.00406959
mov dword [edi], eax
call fcn.00406718
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.00406a42
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x405e88
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.00406a6a
pop ebx
jmp 0x405e96
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x4084e1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x478f08]
jne 0x4084eb
repz ret
jmp fcn.0040d34c
Function at 0x4117b2
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x478f08]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040a60d
and dword [ebp - 0x14], 0
cmp dword [0x47d64c], 0
mov dword [ebp - 0x18], eax
jne 0x411865
push 0x40378c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41190d
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403780
push ebx
call edi
test eax, eax
je 0x41190d
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403770
push ebx
mov dword [0x47d64c], eax
call edi
push eax
call esi
push 0x40375c
push ebx
mov dword [0x47d650], eax
call edi
push eax
call esi
push 0x403740
push ebx
mov dword [0x47d654], eax
call edi
push eax
call esi
mov dword [0x47d65c], eax
test eax, eax
je 0x411865
push 0x403728
push ebx
call edi
push eax
call esi
mov dword [0x47d658], eax
mov eax, dword [0x47d658]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4118be
cmp dword [0x47d65c], ecx
je 0x4118be
push eax
call esi
push dword [0x47d65c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4118be
test ebx, ebx
je 0x4118be
call edi
test eax, eax
je 0x4118b5
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4118b5
test byte [ebp - 8], 1
jne 0x4118be
or dword [ebp + 0x10], 0x200000
jmp 0x4118f1
mov eax, dword [0x47d650]
cmp eax, dword [ebp - 0x18]
je 0x4118f1
push eax
call esi
test eax, eax
je 0x4118f1
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4118f1
mov eax, dword [0x47d654]
cmp eax, dword [ebp - 0x18]
je 0x4118f1
push eax
call esi
test eax, eax
je 0x4118f1
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x47d64c]
call esi
test eax, eax
je 0x41190d
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41190f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004084e1
leave
ret
Function at 0x472b80
Capabilities:
Delete directory
Get common file path
Manipulate console buffer

Disassembly:
sub esp, 0x80c
cmp dword [0x8013e4], 0x37
jne 0x472c16
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetSystemPowerState]
push 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
lea edx, [esp + 4]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
lea eax, [esp + 0x410]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringA]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReplaceFileA]
mov ecx, dword [0x8023d8]
mov dword [esp], ecx
mov eax, 0x5d1
add dword [esp], eax
mov edx, dword [esp]
mov al, byte [edx + esi]
mov ecx, dword [0x482434]
mov byte [ecx + esi], al
add esp, 0x80c
ret
Function at 0x472e90
Capabilities:
Accept command line arguments
Manipulate console buffer
Move file

Disassembly:
mov eax, dword [0x8013e4]
mov ecx, dword [0x482434]
sub esp, 0x444
push ebx
push ebp
shr eax, 3
xor ebp, ebp
push esi
push edi
cmp eax, ebp
jbe 0x47308c
mov esi, ecx
mov dword [esp + 0x3c], 0x9e3779b9
mov dword [esp + 0x2c], esi
mov dword [esp + 0x34], eax
jmp 0x472ed4
mov esi, dword [esp + 0x2c]
cmp dword [0x8013e4], 0x1c
jne 0x472eeb
lea eax, [esp + 0x48]
push eax
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
mov ecx, dword [esi + 4]
mov eax, dword [esi]
mov edx, dword [0x4792c0]
mov edi, dword [0x4792c8]
mov ebx, dword [0x4792cc]
mov dword [esp + 0x18], ecx
mov ecx, dword [0x4792c4]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0xc6ef3720
mov dword [esp + 0x44], edx
mov dword [esp + 0x38], ecx
mov dword [esp + 0x30], 0x20
jmp 0x472f34
mov eax, dword [esp + 0x20]
mov edx, eax
shr edx, 5
add edx, ebx
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x1c]
mov ecx, eax
shl ecx, 4
add ecx, edi
add edx, eax
xor ecx, edx
mov dword [esp + 0x14], ecx
mov dword [0x801354], ebp
mov eax, dword [esp + 0x28]
add dword [0x801354], eax
mov eax, dword [0x801354]
mov dword [esp + 0x40], eax
mov dword [esp + 0x28], ebp
mov eax, dword [esp + 0x40]
add dword [esp + 0x28], eax
mov eax, dword [esp + 0x14]
xor eax, dword [esp + 0x28]
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x28], ecx
mov eax, dword [esp + 0x28]
sub dword [esp + 0x18], eax
mov edx, dword [esp + 0x18]
shl edx, 4
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0x44]
add dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
add esi, eax
cmp dword [0x8013e4], 0x1be
jne 0x472fce
lea edx, [esp + 0x4c]
push edx
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov eax, dword [esp + 0x18]
shr eax, 5
add eax, dword [esp + 0x38]
cmp dword [0x8013e4], 0x979
mov dword [0x801358], 0xff6b3619
mov dword [0x80135c], 0xffffffff
mov dword [esp + 0x28], eax
jne 0x473006
push ebp
lea eax, [esp + 0x54]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameA]
xor dword [esp + 0x14], esi
mov eax, dword [esp + 0x28]
xor dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
sub dword [esp + 0x20], eax
mov dword [esp + 0x24], ebp
mov eax, dword [esp + 0x3c]
add dword [esp + 0x24], eax
sub dword [esp + 0x1c], eax
dec dword [esp + 0x30]
jne 0x472f30
cmp dword [0x8013e4], 0x8d4
jne 0x473046
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
cmp dword [0x8013e4], 0x17
jne 0x47307b
push ebp
push ebp
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressA]
lea eax, [esp + 0x50]
push eax
push 0x403f2c
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
add esi, 8
dec dword [esp + 0x34]
mov dword [esp + 0x2c], esi
jne 0x472ed0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x444
ret
Function at 0x401129
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
push 8
call fcn.00428519
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.00428519
add esp, 4
mov dword [ebp - 0x14], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x18], 0
push 0x10
call fcn.00428519
add esp, 4
mov dword [ebp - 0x1c], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x20], esp
mov eax, 0
call fcn.00428525
cmp dword [ebp - 0x20], esp
je 0x4011e6
push 6
call fcn.0042851f
add esp, 4
mov dword [ebp - 4], eax
mov eax, str.SeDebugPrivilege
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4011ff
push ebx
call fcn.00428513
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x20], esp
lea eax, [ebp - 0xc]
push eax
push 0x28
push dword [ebp - 4]
mov eax, 1
call fcn.00428525
cmp dword [ebp - 0x20], esp
je 0x40122e
push 6
call fcn.0042851f
add esp, 4
mov dword [ebp - 0x20], esp
push dword [ebp - 0x10]
push dword [ebp - 8]
push 0x4aa38d
mov eax, 2
call fcn.00428525
cmp dword [ebp - 0x20], esp
je 0x401258
push 6
call fcn.0042851f
add esp, 4
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x20]
mov dword [ebx], 1
mov ebx, dword [ebp - 0x14]
add ebx, 8
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x10]
add ebx, 4
mov dword [ebp - 0x24], ebx
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x20]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x14]
add ebx, 4
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x24], ebx
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x20]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x14]
add ebx, 0xc
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x20]
mov dword [ebx], 2
mov dword [ebp - 0x20], esp
mov eax, 0
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x1c]
push 0x1c
push dword [ebp - 0x14]
push 0
push dword [ebp - 0xc]
mov eax, 3
call fcn.00428525
cmp dword [ebp - 0x20], esp
je 0x4012ec
push 6
call fcn.0042851f
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], esp
push dword [ebp - 0xc]
mov eax, 4
call fcn.00428525
cmp dword [ebp - 0x20], esp
je 0x401311
push 6
call fcn.0042851f
add esp, 4
mov eax, dword [ebp - 0x18]
jmp 0x401319
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x40132a
push ebx
call fcn.00428513
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.00428513
add esp, 4
mov ebx, dword [ebp - 0x14]
push ebx
call fcn.00428513
add esp, 4
mov ebx, dword [ebp - 0x1c]
push ebx
call fcn.00428513
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x401392
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
push 8
call fcn.00428519
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.00428519
add esp, 4
mov dword [ebp - 0x14], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x18], 0
push 0x10
call fcn.00428519
add esp, 4
mov dword [ebp - 0x1c], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x20], esp
mov eax, 5
call fcn.00428525
cmp dword [ebp - 0x20], esp
je 0x40144f
push 6
call fcn.0042851f
add esp, 4
mov dword [ebp - 4], eax
mov eax, str.SeDebugPrivilege
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x401468
push ebx
call fcn.00428513
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x20], esp
lea eax, [ebp - 0xc]
push eax
push 0x28
push dword [ebp - 4]
mov eax, 6
call fcn.00428525
cmp dword [ebp - 0x20], esp
je 0x401497
push 6
call fcn.0042851f
add esp, 4
mov dword [ebp - 0x20], esp
push dword [ebp - 0x10]
push dword [ebp - 8]
push 0x4aa38d
mov eax, 7
call fcn.00428525
cmp dword [ebp - 0x20], esp
je 0x4014c1
push 6
call fcn.0042851f
add esp, 4
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x20]
mov dword [ebx], 1
mov ebx, dword [ebp - 0x14]
add ebx, 8
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x10]
add ebx, 4
mov dword [ebp - 0x24], ebx
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x20]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x14]
add ebx, 4
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x24], ebx
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x20]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x14]
add ebx, 0xc
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x20]
mov dword [ebx], 2
mov dword [ebp - 0x20], esp
mov eax, 0
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x1c]
push 0x1c
push dword [ebp - 0x14]
push 0
push dword [ebp - 0xc]
mov eax, 8
call fcn.00428525
cmp dword [ebp - 0x20], esp
je 0x401555
push 6
call fcn.0042851f
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], esp
push dword [ebp - 0xc]
mov eax, 9
call fcn.00428525
cmp dword [ebp - 0x20], esp
je 0x40157a
push 6
call fcn.0042851f
add esp, 4
mov eax, dword [ebp - 0x18]
jmp 0x401582
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x401593
push ebx
call fcn.00428513
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.00428513
add esp, 4
mov ebx, dword [ebp - 0x14]
push ebx
call fcn.00428513
add esp, 4
mov ebx, dword [ebp - 0x1c]
push ebx
call fcn.00428513
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x42ec50
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4a42ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004990cb
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x42ecd2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0049701a
mov eax, dword [eax]
push 0x4c6234
push eax
call fcn.00489124
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00499356
test bl, bl
je 0x42ecd2
push 0x4c6234
lea ecx, [esp + 0xc]
call fcn.004996e6
push 0x4c9d88
lea ecx, [esp + 0xc]
call fcn.004996e6
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x42ed0e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00499356
jmp 0x42edd9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x42ed92
lea edx, [esp + 0x7c]
push 0x4c9d84
push edx
call fcn.00489124
add esp, 8
test eax, eax
je 0x42ed92
lea eax, [esp + 0x7c]
push 0x4c9d80
push eax
call fcn.00489124
add esp, 8
test eax, eax
je 0x42ed92
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x42ed22
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00499356
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x42f5d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x42f632
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc