joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4218b0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x483908
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
push 1
push 1
push 1
push 0x300
push str.e:_tvt5_kure_rnrp1_tvt5_lib_1.2.0_tvtinclude_tvt_policy_setting.h
push 0x4906ac
mov esi, ecx
push 0x48e968
lea ecx, [esp + 0x24]
call fcn.0040e269
mov edi, dword [esp + 0x1c]
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov ecx, dword [edi + 8]
lea edx, [edi + 0xc]
mov dword [esi + 8], ecx
push edx
lea ecx, [esi + 0xc]
mov dword [esp + 0x18], 0
call fcn.00412790
lea eax, [edi + 0x18]
push eax
lea ecx, [esi + 0x18]
call fcn.00412790
lea ecx, [edi + 0x24]
push ecx
lea ecx, [esi + 0x24]
call fcn.00412790
lea edx, [edi + 0x30]
push edx
lea ecx, [esi + 0x30]
call fcn.00412790
lea eax, [edi + 0x3c]
push eax
lea ecx, [esi + 0x3c]
call fcn.00412790
mov ecx, dword [edi + 0x48]
mov dword [esi + 0x48], ecx
mov edx, dword [edi + 0x4c]
mov dword [esi + 0x4c], edx
mov al, byte [edi + 0x54]
mov byte [esi + 0x54], al
mov ecx, dword [edi + 0x48]
mov dword [esi + 0x58], ecx
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x42196c
mov dword [ecx + 0x24], 1
mov byte [ecx + 0x2c], 1
test ecx, ecx
mov dword [esp + 0x14], 0xffffffff
je 0x42197e
mov edx, dword [ecx]
push 1
call dword [edx]
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x4219a0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x483908
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
push edi
push 1
push 1
push 1
push 0x300
push str.e:_tvt5_kure_rnrp1_tvt5_lib_1.2.0_tvtinclude_tvt_policy_setting.h
push 0x4906ac
mov esi, ecx
push 0x48e968
lea ecx, [esp + 0x28]
call fcn.0040e269
mov edi, dword [esp + 0x20]
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov ecx, dword [edi + 8]
lea edx, [edi + 0xc]
mov dword [esi + 8], ecx
push edx
lea ecx, [esi + 0xc]
mov dword [esp + 0x1c], 0
call fcn.00412790
lea eax, [edi + 0x18]
push eax
lea ecx, [esi + 0x18]
call fcn.00412790
lea ecx, [edi + 0x24]
push ecx
lea ecx, [esi + 0x24]
call fcn.00412790
lea edx, [edi + 0x30]
push edx
lea ecx, [esi + 0x30]
call fcn.00412790
lea eax, [edi + 0x3c]
push eax
lea ecx, [esi + 0x3c]
call fcn.00412790
lea ebp, [edi + 0x48]
push ebp
lea ecx, [esi + 0x48]
call fcn.00412790
mov ecx, dword [edi + 0x54]
mov dword [esi + 0x54], ecx
mov dl, byte [edi + 0x5c]
push ebp
lea ecx, [esi + 0x60]
mov byte [esi + 0x5c], dl
call fcn.00412790
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x421a66
mov dword [ecx + 0x24], 1
mov byte [ecx + 0x2c], 1
test ecx, ecx
mov dword [esp + 0x18], 0xffffffff
je 0x421a78
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x427790
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x484170
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x9c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push 1
push 1
push 1
push 0x7d
push str.._tvt_environment_variable.cpp
push str.getValue
mov esi, ecx
push str.CTVTEnvironmentVariable
lea ecx, [ebp - 0x18]
call fcn.0040e269
mov eax, dword [esi + 4]
mov edi, dword [esi + 8]
xor bl, bl
xor ecx, ecx
test eax, eax
sete cl
xor edx, edx
test edi, edi
sete dl
mov dword [ebp - 4], 0
mov byte [ebp - 0x11], bl
mov byte [ebp - 4], 1
xor ecx, edx
jne 0x427805
test eax, eax
jne 0x427866
test edi, edi
jne 0x427866
push 0
push 1
lea ecx, [ebp - 0x68]
call fcn.00402612
push 0
push 0
push 0x85
push str.._tvt_environment_variable.cpp
push 0
push 0
push 0
push 0xffffffffffffffff
push str.The_environment_variable_name_has_not_been_initialized
push 2
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 2
mov dword [ebp - 0x68], 0x48aee4
call fcn.00410e60
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 3
call fcn.00402681
push 0x4b833c
lea eax, [ebp - 0x68]
push eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x68], 0x491dc4
call sub.MSVCR71.dll__CxxThrowException
push 0x7fff
lea ecx, [ebp - 0x24]
call fcn.00413bb0
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
mov esi, dword [esi + 4]
push ecx
push edx
push esi
mov byte [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x42789e
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
call fcn.00414840
mov bl, 1
mov byte [ebp - 0x11], bl
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
call fcn.004034a5
jmp 0x4278c4
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x4278d5
mov dword [ecx + 0x24], 2
mov byte [ecx + 0x2c], bl
test ecx, ecx
mov dword [ebp - 4], 0xffffffff
je 0x4278e6
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov al, bl
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x42cd30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4849d3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov eax, dword [esp + 0x30]
push ebx
push esi
mov esi, ecx
mov dword [esi + 0xc], eax
xor eax, eax
push edi
mov dword [esp + 0xc], esi
mov dword [esi + 4], eax
mov dword [esi + 8], eax
push 0x48b000
lea ecx, [esp + 0x20]
mov dword [esp + 0x34], eax
mov dword [esi], 0x492b84
call fcn.00414780
push 0x48b000
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 1
call fcn.00414780
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x14]
lea edi, [esi + 0x10]
push edx
mov ecx, edi
mov byte [esp + 0x38], 2
call fcn.00428090
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 5
call fcn.004034a5
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 4
call fcn.004034a5
mov ebx, dword [esp + 0x38]
push ebx
mov ecx, edi
call fcn.00412790
add ebx, 0xc
push ebx
lea ecx, [edi + 0xc]
call fcn.00412790
mov ecx, dword [esp + 0x28]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 8

Function at 0x42d580
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x484af0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x11], bl
mov dword [ebp - 4], ebx
call fcn.00414090
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x20]
push ecx
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0042c820
cmp al, bl
je 0x42d624
cmp byte [ebp + 0x10], bl
je 0x42d620
mov edx, dword [ebp - 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push ebx
push ebx
push edx
call edi
mov esi, eax
cmp esi, ebx
je 0x42d624
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00413bb0
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
push esi
push ecx
push edx
mov byte [ebp - 4], 2
call edi
cmp esi, eax
jne 0x42d612
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x2c]
push eax
call fcn.00414840
mov byte [ebp - 0x11], 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.004034a5
jmp 0x42d624
mov byte [ebp - 0x11], 1
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], bl
call fcn.004034a5
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp - 0x11]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42e800
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x484d72
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb4
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push 1
push 1
push 1
push 0x184
push str.._tvt_ini.cpp
push str.getProfileString
mov edi, ecx
xor ebx, ebx
push str.CTVTIni
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
call fcn.0040e269
mov dword [ebp - 4], ebx
push 0x400
lea ecx, [ebp - 0x24]
mov byte [ebp - 0x11], bl
mov byte [ebp - 4], 1
mov dword [ebp - 0x24], 0x48b664
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
call fcn.00403504
test al, al
jne 0x42e897
push 1
push 0x2e4
push str.e:_tvt5_kure_rnrp1_tvt5_lib_1.2.0_tvtinclude_tvt_buffer.h
lea ecx, [ebp - 0x80]
call fcn.00411500
push 0x4afe04
lea eax, [ebp - 0x80]
push eax
call sub.MSVCR71.dll__CxxThrowException
mov eax, dword [edi + 8]
mov esi, dword [ebp - 0x1c]
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx + 4]
mov edx, dword [ebp + 8]
mov edx, dword [edx + 4]
push eax
mov eax, dword [ebp - 0x20]
push esi
push eax
push str.Not_Found
push ecx
push edx
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [esi - 1]
cmp eax, ecx
je 0x42e918
add esi, 0xfffffffe
cmp eax, esi
je 0x42e918
test eax, eax
jbe 0x42e918
push str.Not_Found
lea ecx, [ebp - 0x34]
call fcn.00414780
lea edx, [ebp - 0x24]
push edx
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 3
mov dword [ebp - 0x18], 1
call fcn.00416550
lea ecx, [ebp - 0x34]
push ecx
mov ebx, 3
mov ecx, eax
mov dword [ebp - 4], 4
mov dword [ebp - 0x18], ebx
call fcn.00412990
test al, al
mov byte [ebp + 0xf], 1
jne 0x42e91c
mov byte [ebp + 0xf], 0
test bl, 2
mov dword [ebp - 4], 3
je 0x42e936
and ebx, 0xfffffffd
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x18], ebx
call fcn.004034a5
test bl, 1
mov dword [ebp - 4], 2
je 0x42e94a
lea ecx, [ebp - 0x34]
call fcn.004034a5
mov al, byte [ebp + 0xf]
test al, al
je 0x42e961
mov ecx, dword [ebp + 0x10]
lea edx, [ebp - 0x24]
push edx
call fcn.00414840
mov byte [ebp - 0x11], 1
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
call fcn.004034a5
mov ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x42e981
mov al, byte [ebp - 0x11]
mov dword [ecx + 0x24], 1
mov byte [ecx + 0x2c], al
test ecx, ecx
mov dword [ebp - 4], 0xffffffff
je 0x42e992
mov edx, dword [ecx]
push 1
call dword [edx]
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp - 0x11]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4300d0
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x485080
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
push esi
xor bl, bl
mov esi, ecx
mov byte [esp + 0xb], bl
call fcn.00430000
test al, al
jne 0x43027b
mov eax, dword [esi + 4]
xor ecx, ecx
test eax, eax
sete cl
push edi
mov edi, dword [esi + 8]
xor edx, edx
test edi, edi
sete dl
xor ecx, edx
jne 0x43027a
test eax, eax
jne 0x430128
test edi, edi
je 0x43027a
push esi
lea ecx, [esp + 0x20]
call fcn.004140e0
push 0x48d1e8
lea ecx, [esp + 0x2c]
mov dword [esp + 0x4c], 0
call fcn.00414780
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x4c], 1
call fcn.00412d50
mov bl, al
neg bl
sbb bl, bl
lea ecx, [esp + 0x28]
inc bl
mov byte [esp + 0x48], 0
call fcn.004034a5
test bl, bl
je 0x4301a4
push 0x48d1e8
lea ecx, [esp + 0x2c]
call fcn.00414780
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x20]
mov byte [esp + 0x4c], 2
call fcn.004129b0
lea ecx, [esp + 0x28]
mov byte [esp + 0x48], 0
call fcn.004034a5
lea ecx, [esp + 0x10]
call fcn.00414090
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov byte [esp + 0x48], 3
mov esi, 1
lea ecx, [ecx]
push 0x48d1e8
lea ecx, [esp + 0x38]
call fcn.00414780
push 1
push 1
push esi
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x5c], 4
call fcn.004166d0
lea ecx, [esp + 0x34]
mov bl, al
inc esi
mov byte [esp + 0x48], 3
call fcn.004034a5
test bl, bl
je 0x430257
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x2c]
call fcn.0042fa30
lea ecx, [esp + 0x28]
mov byte [esp + 0x48], 5
call fcn.00430000
test al, al
jne 0x430232
mov edx, dword [esp + 0x14]
push 0
push edx
call edi
test eax, eax
je 0x430245
mov byte [esp + 0xf], 1
lea ecx, [esp + 0x28]
mov byte [esp + 0x48], 3
call fcn.0042fba0
jmp 0x4301c0
lea ecx, [esp + 0x28]
xor bl, bl
mov byte [esp + 0x48], 3
call fcn.0042fba0
jmp 0x43025b
mov bl, byte [esp + 0xf]
lea ecx, [esp + 0x10]
mov byte [esp + 0x48], 0
call fcn.004034a5
lea ecx, [esp + 0x1c]
mov dword [esp + 0x48], 0xffffffff
call fcn.004034a5
pop edi
mov ecx, dword [esp + 0x3c]
pop esi
mov al, bl
pop ebx
mov dword fs:[0], ecx
add esp, 0x40
ret
Function at 0x432820
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x485394
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
lea ecx, [esi + 0xc]
mov dword [esp + 0xc], esi
mov dword [esi], 0x493fe4
call fcn.00414090
xor ebx, ebx
lea ecx, [esi + 0x18]
mov dword [esp + 0x1c], ebx
call fcn.00414090
lea ecx, [esi + 0x24]
mov byte [esp + 0x1c], 1
call fcn.00414090
lea ecx, [esi + 0x38]
mov byte [esp + 0x1c], 2
call fcn.00414090
push 1
push 1
push 1
push 0x3f
push str.._tvt_userinfo.cpp
push str.Default_Constructor
push str.CTVTUserInfo
lea ecx, [esp + 0x24]
mov byte [esp + 0x38], 3
call fcn.0040e269
mov ecx, dword [esp + 8]
cmp ecx, ebx
mov eax, dword [esp + 0x24]
mov byte [esi + 0x31], bl
mov byte [esi + 0x32], bl
mov byte [esi + 0x30], bl
mov dword [esi + 0x48], eax
mov byte [esi + 0x45], bl
mov byte [esi + 0x44], bl
mov dword [esi + 0x34], ebx
mov dword [esp + 0x1c], 4
je 0x4328cf
mov dword [ecx + 0x24], 1
mov byte [ecx + 0x2c], 1
cmp ecx, ebx
mov byte [esp + 0x1c], 3
je 0x4328de
mov edx, dword [ecx]
push 1
call dword [edx]
mov ecx, dword [esp + 0x14]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 4
Function at 0x433770
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4855d4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xfc
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push 1
push 1
push 1
push 0x19c
push str.._tvt_userinfo.cpp
push str.storeSIDInINIFile
mov esi, ecx
push str.CTVTUserInfo
lea ecx, [ebp - 0x18]
call fcn.0040e269
mov dword [ebp - 4], 0
xor bl, bl
lea ecx, [ebp - 0x30]
mov byte [ebp - 0x11], bl
mov byte [ebp - 4], 1
call fcn.00414090
lea eax, [ebp - 0x30]
push eax
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.00433450
test al, al
je 0x43396e
push 0x48d1e8
lea ecx, [ebp - 0x3c]
call fcn.00414780
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x68]
push edx
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 3
call fcn.004141c0
lea ecx, [esi + 0xc]
push ecx
lea edx, [ebp - 0x24]
push edx
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.004141c0
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 7
call fcn.004034a5
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 6
call fcn.004034a5
lea ecx, [ebp - 0x24]
call fcn.00411c40
sub esp, 0xc
lea eax, [ebp - 0x30]
mov ecx, esp
mov dword [ebp - 0x4c], esp
push eax
call fcn.004140e0
lea ecx, [ebp - 0x5c]
call fcn.0042e6b0
mov ecx, dword [0x4c5bb0]
push ecx
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 8
call fcn.00414780
push 0
push 0x20
push str.Some_serious_security_goin_on_er
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 9
call fcn.00413690
push 2
push eax
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 0xa
call fcn.004352c0
push eax
lea edx, [ebp - 0x98]
push edx
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 0xb
call fcn.00415870
mov esi, eax
push 0
push 0x20
push str.Some_serious_security_goin_on_er
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 0xc
call fcn.00413690
push 2
push eax
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0xd
call fcn.004352c0
mov byte [ebp - 4], 0xe
push eax
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x24]
call fcn.00415870
push esi
lea ecx, [ebp - 0x48]
push ecx
push eax
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0xf
call fcn.0042e530
mov bl, al
lea ecx, [ebp - 0x74]
mov byte [ebp - 0x11], bl
mov byte [ebp - 4], 0xe
call fcn.004034a5
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0xd
call fcn.00435360
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 0xc
call fcn.00413880
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 0xb
call fcn.004034a5
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 0xa
call fcn.00435360
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 9
call fcn.00413880
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 8
call fcn.004034a5
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 6
call fcn.0042e770
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 2
call fcn.004034a5
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.004034a5
jmp 0x4339b2
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x4339c3
mov dword [ecx + 0x24], 1
mov byte [ecx + 0x2c], bl
test ecx, ecx
mov dword [ebp - 4], 0xffffffff
je 0x4339d4
mov edx, dword [ecx]
push 1
call dword [edx]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov al, bl
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4339f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x485654
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xfc
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push 1
push 1
push 1
push 0x1b3
push str.._tvt_userinfo.cpp
push str.storeStoragePathInINIFile
mov esi, ecx
push str.CTVTUserInfo
lea ecx, [ebp - 0x18]
call fcn.0040e269
mov dword [ebp - 4], 0
xor bl, bl
lea ecx, [ebp - 0x30]
mov byte [ebp - 0x11], bl
mov byte [ebp - 4], 1
call fcn.00414090
lea eax, [ebp - 0x30]
push eax
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.00433450
test al, al
je 0x433bee
push 0x48d1e8
lea ecx, [ebp - 0x3c]
call fcn.00414780
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x68]
push edx
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 3
call fcn.004141c0
lea ecx, [esi + 0xc]
push ecx
lea edx, [ebp - 0x24]
push edx
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.004141c0
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 7
call fcn.004034a5
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 6
call fcn.004034a5
lea ecx, [ebp - 0x24]
call fcn.00411c40
sub esp, 0xc
lea eax, [ebp - 0x30]
mov ecx, esp
mov dword [ebp - 0x4c], esp
push eax
call fcn.004140e0
lea ecx, [ebp - 0x5c]
call fcn.0042e6b0
mov ecx, dword [str.PATH]
push ecx
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 8
call fcn.00414780
push 0
push 0x20
push str.Some_serious_security_goin_on_er
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 9
call fcn.00413690
push 2
push eax
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 0xa
call fcn.004352c0
push eax
lea edx, [ebp - 0x98]
push edx
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 0xb
call fcn.00415870
mov esi, eax
push 0
push 0x20
push str.Some_serious_security_goin_on_er
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 0xc
call fcn.00413690
push 2
push eax
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0xd
call fcn.004352c0
mov byte [ebp - 4], 0xe
push eax
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x24]
call fcn.00415870
push esi
lea ecx, [ebp - 0x48]
push ecx
push eax
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0xf
call fcn.0042e530
mov bl, al
lea ecx, [ebp - 0x74]
mov byte [ebp - 0x11], bl
mov byte [ebp - 4], 0xe
call fcn.004034a5
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0xd
call fcn.00435360
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 0xc
call fcn.00413880
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 0xb
call fcn.004034a5
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 0xa
call fcn.00435360
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 9
call fcn.00413880
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 8
call fcn.004034a5
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 6
call fcn.0042e770
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 2
call fcn.004034a5
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.004034a5
jmp 0x433c32
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x433c43
mov dword [ecx + 0x24], 1
mov byte [ecx + 0x2c], bl
test ecx, ecx
mov dword [ebp - 4], 0xffffffff
je 0x433c54
mov edx, dword [ecx]
push 1
call dword [edx]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov al, bl
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x434c40
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4858c6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xdc
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push 1
push 1
push 1
push 0x81
push str.._tvt_process_info.cpp
push str.closeProcess
mov edi, ecx
push 0x4947a4
lea ecx, [ebp - 0x18]
call fcn.0040e269
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
test eax, eax
mov dword [ebp - 4], 0
mov byte [ebp - 0x11], 0
mov byte [ebp - 4], 1
je 0x434d6a
cmp eax, 0xffffffff
je 0x434d6a
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x434ce8
push str.SeDebugPrivilege
lea ecx, [ebp - 0x24]
mov dword [ebp + 0xc], 4
call fcn.00414780
lea ecx, [ebp + 0xc]
push ecx
lea edx, [ebp - 0x24]
push edx
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.00434960
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
call fcn.004034a5
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x434d02
mov dword [esi], 0
mov bl, 1
jmp 0x434e29
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 1
lea ecx, [ebp - 0x68]
mov esi, eax
call fcn.00402612
push 0
push 0
push 0x96
push str.._tvt_process_info.cpp
push 0
push 0
push 0
push esi
push 0x494780
push 2
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 3
mov dword [ebp - 0x68], 0x48aee4
call fcn.00410e60
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 4
call fcn.00402681
push 0x4bbde0
lea ecx, [ebp - 0x68]
push ecx
mov byte [ebp - 4], 1
mov dword [ebp - 0x68], 0x494778
call sub.MSVCR71.dll__CxxThrowException
push 0
push 1
lea ecx, [ebp - 0xa8]
call fcn.00402612
push 0
push 0
push 0x9b
push str.._tvt_process_info.cpp
push 0
push 0
push 0
push 0xffffffffffffffff
push 0x494758
push 2
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 5
mov dword [ebp - 0xa8], 0x48aee4
call fcn.00410e60
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 6
call fcn.00402681
push 0x4bbda0
lea edx, [ebp - 0xa8]
push edx
mov byte [ebp - 4], 1
mov dword [ebp - 0xa8], 0x494750
call sub.MSVCR71.dll__CxxThrowException
mov ecx, dword [ebp - 0x28]
mov al, byte [ecx + 0xa]
test al, al
jne 0x434dec
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, 0x434e26
ret
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x434e3a
mov dword [ecx + 0x24], 1
mov byte [ecx + 0x2c], bl
test ecx, ecx
mov dword [ebp - 4], 0xffffffff
je 0x434e4b
mov edx, dword [ecx]
push 1
call dword [edx]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov al, bl
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8