joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10024586
Capabilities:
Print debug messages

Disassembly:
push ebx
push 8
call dword [sym.imp.MSVCR120.dll_malloc]
mov ebx, eax
pop ecx
test ebx, ebx
je 0x100245a3
push 8
push 0
push ebx
call sub.MSVCR120.dll_memset
add esp, 0xc
cmp byte [0x10036ee8], 0
je 0x10024692
push esi
mov esi, dword [sym.imp.MSVCR120.dll_sprintf]
push edi
push 0x64
push str.sizeof__t_ASMBlock____d
mov edi, 0x100386f8
push edi
call esi
add esp, 0xc
cmp byte [0x10036ee8], 0
je 0x10024690
push edi
mov edi, dword [sym.imp.kernel32.dll_OutputDebugStringA]
call edi
cmp byte [0x10036ee8], 0
je 0x10024690
push 4
push str.sizeof_Uns32____d
push 0x100386f8
call esi
add esp, 0xc
cmp byte [0x10036ee8], 0
je 0x10024690
push 0x100386f8
call edi
cmp byte [0x10036ee8], 0
je 0x10024690
push 4
push str.sizeof_HANDLE____d
push 0x100386f8
call esi
add esp, 0xc
cmp byte [0x10036ee8], 0
je 0x10024690
push 0x100386f8
call edi
cmp byte [0x10036ee8], 0
je 0x10024690
push 4
push str.sizeof_Handle32____d
push 0x100386f8
call esi
add esp, 0xc
cmp byte [0x10036ee8], 0
je 0x10024690
push 0x100386f8
call edi
cmp byte [0x10036ee8], 0
je 0x10024690
push 4
push str.sizeof_void____d
push 0x100386f8
call esi
add esp, 0xc
cmp byte [0x10036ee8], 0
je 0x10024690
push 0x100386f8
call edi
pop edi
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x10024713
Capabilities:
Print debug messages

Disassembly:
push 0x1c
mov eax, 0x10028feb
call fcn.100265a9
cmp byte [0x10036ee8], 0
mov esi, dword [ebp + 8]
je 0x10024753
lea eax, [esi + 4]
mov edi, 0x100386f8
push eax
push str.ASM_Release__s
push edi
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0xc
cmp byte [0x10036ee8], 0
je 0x10024753
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
lea eax, [esi + 4]
push eax
lea ecx, [ebp - 0x28]
call fcn.1001e142
push dword [esi + 0x48]
lea eax, [ebp - 0x28]
xor edi, edi
push eax
mov dword [ebp - 4], edi
call fcn.1000229e
pop ecx
pop ecx
test eax, eax
je 0x1002477e
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
push edi
push 1
lea ecx, [ebp - 0x28]
call fcn.1001e142
mov dword [esi + 0x4c], edi
mov dword [esi + 0x44], edi
call fcn.10026558
ret
Function at 0x10024795
Capabilities:
Print debug messages

Disassembly:
push 0x28
mov eax, 0x10029018
call fcn.100265a9
cmp byte [0x10036ee8], 0
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov edi, dword [sym.imp.MSVCR120.dll_sprintf]
mov dword [ebp - 0x30], esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x2c], esi
mov esi, dword [sym.imp.kernel32.dll_OutputDebugStringA]
je 0x100247f9
call fcn.1001e142
test al, al
mov edx, 0x1002a665
mov ecx, str._in_AppContaner
cmove ecx, edx
push ecx
push str.ASM_Retrieve_retrieving_shared_memory_in_Plug_in_s
push 0x100386f8
call edi
add esp, 0xc
cmp byte [0x10036ee8], 0
je 0x100247f9
push 0x100386f8
call esi
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x28]
and dword [eax], 0
mov eax, dword [ebp - 0x30]
and dword [eax], 0
lea eax, [ebx + 4]
push eax
call fcn.1001e142
push dword [ebx + 0x48]
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.1000229e
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x34], eax
call fcn.1001e142
mov ecx, dword [ebp - 0x34]
test ecx, ecx
jne 0x10024862
cmp byte [0x10036ee8], cl
je 0x100248ae
push str.ASM_Retrieve_ERROR__finding_memory_mapped_file_
mov ebx, 0x100386f8
push ebx
call edi
cmp byte [0x10036ee8], 0
pop ecx
pop ecx
je 0x100248ae
push ebx
call esi
jmp 0x100248ae
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [ebx + 0x44], eax
test eax, eax
jne 0x1002487d
cmp byte [0x10036ee8], al
je 0x100248ae
push str.ASM_Retrieve_ERROR__getting_memory_mapped_file_handle_
jmp 0x1002484a
mov ecx, dword [ebp - 0x34]
push dword [ebx + 0x48]
mov eax, dword [ecx]
call dword [eax + 0xc]
mov dword [ebx + 0x4c], eax
test eax, eax
jne 0x1002489e
cmp byte [0x10036ee8], al
je 0x100248ae
push str.ASM_Retrieve_ERROR__mapping_for_writing_
jmp 0x1002484a
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebx + 0x48]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebx + 0x4c]
mov dword [ecx], eax
call fcn.10026558
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x101d0d6d
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
push esp
pushfd
push eax
pop dword [esp]
mov byte [esp], dl
jmp 0x101d0d73
pop word [esp]
jmp 0x101d0d57
push word [esp + 1]
jp 0x101d0e22
lea esp, [esp + 2]
mov dword [esp], ebp
pushfd
mov dword [esp], esi
jmp 0x101d0dc4
pushfd
mov dword [esp], esi
call 0x101d0daa
lea esp, [esp + 2]
mov dword [esp], ebp
jmp 0x101d0dc0

Function at 0x101d840e
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
jmp 0x101be96f
xor ecx, ecx
cmp dword [esp + 4], ecx
jbe 0x101be989
push esi
movzx esi, byte [ecx + edx]
rol eax, 7
xor eax, esi
inc ecx
cmp ecx, dword [esp + 8]
jb 0x101be978
pop esi
jmp 0x101be994
ret 4
lea esp, [esp + 4]
jmp 0x101be962
jmp 0x101d83f8

Function at 0x101d8504
Capabilities:
Check for trap flag exception

Disassembly:
push ebx
jmp 0x101bf1fa
pushfd
or dword [esp], reloc.MSVFW32.dll_DrawDibDraw
popfd
cpuid
nop
jmp 0x101bf211
pop ebx
ret
jmp 0x101bf1ee
Function at 0x1025214c
Capabilities:
Execute anti-debugging instructions

Disassembly:
rcl dx, cl
jmp 0x1025219c
setge dl
push dword [esp]
js 0x10252136
jns 0x1025215e
xchg edx, eax
adc byte [esi + 0xdaf10e1], al
pushfd
rcl dx, cl
jmp 0x1025219c
bswap edx
mov dx, bx
lea edx, [ebp*4]
push ecx
jmp 0x102521e5
bswap edx
mov dx, bx
lea edx, [ebp*4]
jmp 0x102521a8
lea esp, [esp + 8]
xor al, 0xe3
inc dx
jae 0x10252163
jb 0x10252186
push ecx
jmp 0x102521e5
mov dx, bx
not dl
btc edx, ebp
mov dx, 0xadd6
mov dh, ah
mov dh, byte [esp]
jmp 0x10252221
mov dx, bx
not dl
btc edx, ebp
jmp 0x10252269
lea esp, [esp + 4]
sub al, 0x59
stc
jo 0x102521ab
jno 0x102521cb
jns 0x10252206
js 0x10252206
xchg esp, eax
lcall 0xa12d, 0x66e1899e
cmpsd dword [esi], dword es:[edi]
mov dh, 0xba
mov dh, 0x35
pushfd
invalid
dec al
dec dh
jge 0x10252245
jl 0x1025222f
mov bl, byte [ebp + 2]
xchg esp, eax
scasd eax, dword es:[edi]
sub dh, al
pop ecx
xor byte [edx - 8], bh
test byte [esi - 0x4f4e1671], 0xb3
stosb byte es:[edi], al
sub al, 0x7d
mov dl, byte [esp]
sete dl
mov dh, 4
inc dx
jmp 0x102521f0
mov edx, dword [esp]
mov dl, byte [esp]
or dx, 0x5f6a
jmp 0x10252250
mov edx, dword [esp]
mov dl, byte [esp]
or dx, 0x5f6a
jmp 0x1025228a
add bl, al
jns 0x10252274
mov dx, word [esp]
mov ah, 0xf8
mov dl, ah
jmp 0x1025229a
mov dx, 0xadd6
mov dh, ah
jmp 0x102521b9
mov dx, word [esp]
mov ah, 0xf8
jmp 0x10252298
sub al, 0xea
setl dh
lea edx, [edi + edi]
bswap edx
mov dh, 0x93
jmp 0x10252252
mov dl, ah
dec esi
sets dh
adc ax, 0xf9c1
jmp 0x102522c7
jnp 0x102522e8
mov dx, 0x36ae
mov edx, 0x195ce626
jmp 0x1025232d
mov dx, 0x36ae
mov edx, 0x195ce626
lea edx, [ebx - 0xcb]
sete dl
rdtsc
xchg dl, ah
jmp 0x10252304
neg al
jbe 0x1025236c
lea edx, [esi*4]
jmp 0x10252373
mov ax, 0x7755
push ax
bsr ax, di
jns 0x10252350
xchg word [esp], ax
lea esp, [esp + 2]
jmp 0x10252356
lea edx, [ebx - 0xcb]
sete dl
rdtsc
jmp 0x102522fc
lea esp, [esp + 2]
jmp 0x10252356
xchg word [esp], ax
jmp 0x1025233a
rol cl, 0
jnp 0x1025238e
not dx
jmp 0x10252378
lea edx, [esi*4]
add cl, 0x2e
jmp 0x10252311
bsf dx, di
lea eax, [esi + 0xa5]
rdtsc
jmp 0x102523bb
not dx
bsf dx, di
lea eax, [esi + 0xa5]
rdtsc
mov ah, bh
and dl, ah
call fcn.102523bf
and dword ss:[eax - 0x5d], esp
add esi, dword [edx - reloc.MSVFW32.dll_DrawDibDraw]
sub ebx, ecx
cli
rcr dword [eax - 0x32], cl
test eax, 0x2435e958
mov ah, bh
jmp 0x1025239f

Function at 0x10316c2d
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsf edi, eax
xchg word [esp + 1], dx
push word [esp + 3]
jmp 0x10316c36
cmc
add esp, 0
mov dword [esp], edx
jmp 0x10316c17
mov ecx, 0x30b65c77
mov dl, 0x16
cpuid
lea esp, [esp + 5]
rdtsc
jmp 0x10316c63
sub esp, 0x1f
xchg byte [esp + 0xa], bh
bsf eax, ebp
push word [esp + 0xe]
lea esp, [esp + 0x1f]
neg bh
jmp 0x10316d05
bts edi, ecx
not bx
call fcn.10316cc3
xchg edx, eax
add byte [esi + 0x3de200f1], dl
or al, 0x9f
out 0x11, al
dec dl
neg ax
xchg ecx, esi
mov dword [esp], ebx
lea ebx, [edx*4]
mov dword [esp], esp
jmp 0x10316c97
mov bx, di
mov di, word [esp]
mov byte [esp], dl
mov esi, 0x501c1d0c
pushfd
xchg dh, cl
jmp 0x10316cad
rdtsc
xchg bp, di
rdtsc
add esp, 4
mov ecx, 0x9b70909e
add esp, 0
jmp 0x10316cd9
Function at 0x10317119
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg bx, di
xchg byte [esp + 9], bh
sub esp, 9
cmp bp, cx
push dword [esp + 4]
jmp 0x103170e6

Function at 0x103174e8
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ebx, [esi*4]
mov dx, 0xa5c4
mov dword [esp + 7], ebx
stc
jmp 0x1031761b
dec ebx
add esp, 6
mov ah, byte [esp + 6]
xchg word [esp + 7], dx
jmp 0x103174d2
mov eax, 0xb029439d
bsr ebp, esp
lea ebx, reloc.MSVFW32.dll_DrawDibDraw
pop bx
sub esp, 1
setns dh
jmp 0x1031751d
rdtsc
lea ebx, [edi + 0xc6]
mov word [esp + 5], si
mov byte [esp + 6], ch
neg ah
add esp, 6
jmp 0x1031753d
pop dword [esp + 2]
rdtsc
lea eax, [ecx + 0x97]
lea esi, [esi*4]
mov cx, word [esp + 4]
mov dword [esp + 1], esi
jmp 0x10317585

Function at 0x1031790e
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp + 4]
mov dword [esp + 3], edx
mov word [esp], bp
mov ax, word [esp + 8]
mov dword [esp + 5], ecx
jmp 0x103177c3

Function at 0x1031c62e
Capabilities:
Access peb ldr_data
Packed with generic packer

Disassembly:
push word [esp]
mov dword [esp], ecx
jmp 0x1031c618
Function at 0x403b55
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x403b64
pop dword [ebp - 0x18]
mov eax, 0x403b64
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xedccc591
sub dword [ebp - 0x28], 0x9f7a8046
mov dword [ebp - 0x24], 0x6e549367
sub dword [ebp - 0x24], 0x3c214722
mov dword [ebp - 0x20], 0x89d859ec
sub dword [ebp - 0x20], 0x3d8c15be
mov dword [ebp - 0x1c], 0x36ac78ed
add dword [ebp - 0x1c], 0xc9538713
lea eax, [ebp - 0x28]
push eax
mov eax, 0xf4bf3091
add eax, 0xb813f8b
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x39077c55
sub dword [ebp - 0x28], 0xc49512ff
mov dword [ebp - 0x24], 0xc80cb28e
sub dword [ebp - 0x24], 0x86a05119
mov dword [ebp - 0x20], 0x376cee75
sub dword [ebp - 0x20], 0xd3fd8209
mov dword [ebp - 0x1c], 0xecbbcec2
add dword [ebp - 0x1c], 0x1344313e
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x35412
push 0
call eax
mov ecx, 0x3ef1
mov edx, eax
mov edi, 0xc758ca82
add edi, 0x38e7fd7e
add edi, dword [ebp - 0x18]
mov esi, 0x9fba5647
sub esi, 0x1567fc93
sub dword [ebp - 0x10], 0xc1af1eeb
mov ebx, dword [edi]
mov dword [ebp - 0x10], 0x3a73296d
xor ebx, esi
sub dword [ebp - 8], 0x10ebc482
mov dword [edx], ebx
mov dword [ebp - 0x10], 0x6cec0d0e
add edx, 4
add edi, 0x6ca1c759
add edi, 0x935e38ab
loop 0x403c76
add eax, 0x6360da70
sub eax, 0x635febd9
mov ebx, eax
add eax, 0x7d9d649
sub eax, 0x7d9d644
mov ecx, 0x1d686dc0
add ecx, 0xe2d79240
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x404837
Capabilities:
Check if file exists

Disassembly:
push 0x1c
mov eax, 0x40649c
call fcn.00405674
cmp dword [0x40a01c], 0
mov esi, dword [ebp + 8]
jne 0x404856
mov al, 1
jmp 0x404926
test esi, esi
je 0x404924
xor ebx, ebx
cmp word [esi], bx
je 0x404924
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x404924
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x404924
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.00403b55
pop ecx
pop ecx
and dword [ebp - 4], ebx
xor edi, edi
mov esi, dword [0x40a01c]
inc edi
cmp dword [ebp - 0x18], ebx
je 0x404911
lea eax, [ebp - 0x28]
push eax
call fcn.00403b55
pop ecx
test al, al
jne 0x404911
cmp dword [ebp - 0x18], esi
jbe 0x404911
cmp dword [0x40a020], 8
lea eax, [ebp - 0x28]
mov ecx, 0x40a00c
cmovae ecx, dword [0x40a00c]
cmp dword [ebp - 0x14], 8
push esi
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.MSVCR120.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x404911
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
test eax, eax
je 0x404911
push 0x4075e0
push eax
call dword [sym.imp.MSVCR120.dll__wcsicmp]
test eax, eax
movzx ebx, bl
pop ecx
pop ecx
cmovne ebx, edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
push 0
push edi
call fcn.00403b55
mov al, bl
jmp 0x404926
xor al, al
call fcn.00405632
ret
Function at 0x40594a
Capabilities:
Terminate process

Disassembly:
call fcn.00403b55
jmp 0x405954
push 0x14
push 0x408248
call fcn.00405cc0
xor esi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
call dword [sym.imp.MSVCR120.dll___crtGetShowWindowMode]
movzx ebx, ax
mov dword [ebp - 4], esi
mov eax, dword fs:[0x18]
mov edx, dword [eax + 4]
mov edi, esi
mov esi, 0x40a648
mov ecx, edx
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
je 0x40599b
cmp eax, edx
jne 0x405984
xor esi, esi
inc esi
mov edi, esi
jmp 0x40599e
xor esi, esi
inc esi
cmp dword [0x40a64c], esi
jne 0x4059b0
push 0x1f
call sub.MSVCR120.dll__amsg_exit
pop ecx
jmp 0x4059eb
cmp dword [0x40a64c], 0
jne 0x4059e5
mov dword [0x40a64c], esi
push 0x407260
push 0x407250
call sub.MSVCR120.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x4059eb
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x405b02
mov dword [0x40a2f4], esi
cmp dword [0x40a64c], esi
jne 0x405a0e
push 0x40724c
push 0x407228
call sub.MSVCR120.dll__initterm
pop ecx
pop ecx
mov dword [0x40a64c], 2
test edi, edi
jne 0x405a1b
xor eax, eax
mov ecx, 0x40a648
xchg dword [ecx], eax
cmp dword [0x40a650], 0
je 0x405a3f
push 0x40a650
call fcn.00403b55
pop ecx
test eax, eax
je 0x405a3f
push 0
push 2
push 0
call dword [0x40a650]
mov eax, dword [sym.imp.MSVCR120.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x1c], esi
mov edi, dword [ebp - 0x20]
mov cl, byte [esi]
cmp cl, 0x20
ja 0x405a8e
test cl, cl
je 0x405a5b
test edi, edi
jne 0x405a8e
mov al, byte [esi]
test al, al
je 0x405a6b
cmp al, 0x20
ja 0x405a6b
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x405a5b
push ebx
push esi
push 0
push 0x400000
call main
mov dword [0x40a2f8], eax
cmp dword [0x40a2fc], 0
jne 0x405ae7
push eax
call dword [sym.imp.MSVCR120.dll_exit]
cmp cl, 0x22
jne 0x405a9f
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [ebp - 0x20], edi
movzx eax, cl
push eax
call dword [sym.imp.MSVCR120.dll__ismbblead]
pop ecx
test eax, eax
je 0x405ab2
inc esi
mov dword [ebp - 0x1c], esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x405a4c
cmp dword [0x40a2f4], 0
jne 0x405afb
call dword [sym.imp.MSVCR120.dll__cexit]
mov eax, dword [0x40a2f8]
mov dword [ebp - 4], 0xfffffffe
call fcn.00405d05
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x402e40
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
push ebx
test eax, eax
je 0x403360
test edx, edx
je 0x403360
call fcn.00402e57
mov eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x406b40
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
call fcn.00406b49

Function at 0x42dbb0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x21c
mov edi, edx
mov ebx, ecx
mov eax, dword [0x591014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x577d50
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42dc4b
mov esi, eax
xor eax, eax
mov edi, ebx
lea ebx, [ebp - 0x21c]
mov dword [ebx], eax
mov ecx, esi
call dword [section..00cfg]
push ebx
xor eax, eax
push eax
push eax
push edi
call esi
test eax, eax
jns 0x42dc26
cmp byte [ebp + 0xc], 0
je 0x42dc26
mov ecx, esi
call dword [section..00cfg]
lea eax, [ebp - 0x21c]
push eax
push 0
push 0x8800
push edi
call esi
test eax, eax
setns bl
jns 0x42dcf0
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x42dcd9
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x42dcd9
lea esi, [ebp - 0x216]
push 0x206
push 0xff
push esi
call fcn.004c9370
add esp, 0xc
mov word [esi - 2], 0
lea esi, [ebp - 0x218]
xor eax, eax
push esi
push eax
push eax
push edi
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ebx, eax
test eax, eax
jns 0x42dca6
cmp ebx, 0x80070057
je 0x42dca6
cmp byte [ebp + 0xc], 0
je 0x42dca6
or edi, 0xa000
xor eax, eax
push esi
push eax
push eax
push edi
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ebx, eax
test ebx, ebx
js 0x42dcd4
push esi
call fcn.004e2704
add esp, 4
mov edx, esi
lea esi, [ebp - 0x228]
mov ecx, esi
push eax
push edx
call fcn.004a1cc0
mov ecx, dword [ebp + 8]
push esi
call fcn.00449840
mov ecx, esi
call fcn.004a1da0
test ebx, ebx
setns bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c66e3
mov eax, ebx
add esp, 0x21c
pop esi
pop edi
pop ebx
pop ebp
ret
lea esi, [ebp - 0x228]
mov ecx, esi
push dword [ebp - 0x21c]
call fcn.004f7310
movzx eax, byte [esi + 0xb]
test al, al
jns 0x42dd19
mov esi, dword [ebp - 0x228]
mov eax, dword [ebp - 0x224]
jmp 0x42dd1c
and eax, 0x7f
lea edi, [ebp - 0x218]
mov ecx, edi
push eax
push esi
call fcn.004a1cc0
mov ecx, dword [ebp + 8]
push edi
call fcn.00449840
mov ecx, edi
call fcn.004a1da0
cmp byte [ebp - 0x21d], 0
jns 0x42dc31
push dword [ebp - 0x228]
call fcn.004c5c98
add esp, 4
jmp 0x42dc31
Function at 0x4323b0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20c
mov eax, dword [0x591014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x218]
mov dword [esi], 0x101
lea edi, [ebp - 0x212]
push 0x202
push 0xff
push edi
call fcn.004c9370
add esp, 0xc
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov esi, eax
test eax, eax
je 0x432402
mov ecx, dword [ebp + 8]
push edi
call fcn.004457a0
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c66e3
mov eax, ebx
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x447160
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [0x597f84]
test ebx, ebx
jne 0x4471dc
push 0x28
call fcn.004c5c68
add esp, 4
mov esi, eax
xor edi, edi
mov dword [eax], edi
mov dword [eax + 4], edi
mov byte [eax + 8], 0
push 0xc
call fcn.004c5c68
add esp, 4
mov dword [esi + 0xc], eax
lea ecx, [eax + 0xc]
mov dword [esi + 0x14], ecx
mov dword [eax + 8], edi
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [esi + 0x10], ecx
lea eax, [esi + 0x1c]
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x18], eax
mov dword [esi + 0x24], 1
mov dword [0x597f84], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
je 0x4471e6
mov edi, eax
push eax
call fcn.004e2704
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.004471f0
test ebx, ebx
sete al
pop esi
pop edi
pop ebx
pop ebp
ret
int3
Function at 0x4471f0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov ebx, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [0x591014]
xor edx, ebp
mov dword [ebp - 0x10], edx
lea esi, [ebp - 0x20]
push 3
push ecx
push eax
push esi
call fcn.00455140
add esp, 0x10
mov eax, dword [esi + 4]
test eax, eax
je 0x447319
mov esi, dword [ebp - 0x20]
mov dword [ebx], esi
mov dword [ebx + 4], eax
xor edi, edi
mov dword [ebp - 0x14], edi
push 0x800
push edi
push 0x57bd20
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
mov dword [ebp - 0x30], eax
je 0x447356
push 0x57bd70
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x447271
mov ecx, eax
call dword [section..00cfg]
lea eax, [ebp - 0x14]
push eax
push esi
call ecx
mov edi, eax
mov dword [ebp - 0x28], edi
mov ecx, dword [ebp - 0x14]
xor esi, esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov edi, 0
mov dword [ebp - 0x24], 0
test ecx, ecx
je 0x4472eb
mov eax, ecx
mov dword [ebp - 0x34], ebx
shl ecx, 2
mov eax, ecx
mov dword [ebp - 0x2c], ecx
cmp ecx, 0x55555555
jae 0x447366
mov eax, dword [ebp - 0x2c]
lea edi, [eax + eax*2]
push edi
call fcn.004c5c68
add esp, 4
mov dword [ebp - 0x20], eax
mov ecx, eax
add ecx, edi
mov dword [ebp - 0x18], ecx
xor ebx, ebx
mov dword [ebp - 0x24], eax
mov edi, eax
mov esi, dword [ebp - 0x28]
mov ecx, edi
push dword [esi + ebx]
call fcn.004f7310
add edi, 0xc
add ebx, 4
cmp dword [ebp - 0x2c], ebx
jne 0x4472ce
mov dword [ebp - 0x1c], edi
mov ebx, dword [ebp - 0x34]
xor esi, esi
mov ecx, ebx
lea eax, [ebp - 0x20]
push eax
call fcn.00446e40
mov dword [ebx], esi
mov dword [ebx + 4], esi
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x447312
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebx, dword [ebp - 0x24]
test ebx, ebx
jne 0x44732d
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c66e3
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret 8
cmp edi, ebx
je 0x44734b
lea esi, [edi - 0xc]
cmp byte [edi - 1], 0
jns 0x447345
push dword [edi - 0xc]
call fcn.004c5c98
add esp, 4
mov edi, esi
cmp esi, ebx
jne 0x447331
push ebx
call fcn.004c5c98
add esp, 4
jmp 0x447319
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x44726f
call fcn.004da990
int3