joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42d2bc
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp + 4], eax
mov dword [esp + 8], edx
xor esi, esi
xor edi, edi
xor eax, eax
mov ebp, ecx
test ebp, ebp
jns 0x42d2d9
add ebp, 3
sar ebp, 2
test ebp, ebp
jle 0x42d3eb
mov edx, 4
mov eax, esp
mov ecx, dword [esp + 4]
movzx ecx, byte [ecx + esi]
cmp ecx, 0x3d
jg 0x42d30c
je 0x42d358
sub ecx, 0x2b
je 0x42d34e
sub ecx, 4
je 0x42d353
dec ecx
sub ecx, 0xa
jb 0x42d33d
jmp 0x42d35b
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x42d31e
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x42d32c
jmp 0x42d35b
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x42d35b
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x42d35b
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x42d35b
mov byte [eax], 0x3e
jmp 0x42d35b
mov byte [eax], 0x3f
jmp 0x42d35b
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x42d2eb
mov al, byte [esp]
shl eax, 2
xor edx, edx
mov dl, byte [esp + 1]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi], al
lea eax, [edi + 1]
mov dl, byte [esp + 2]
cmp dl, 0xff
je 0x42d3ab
cmp byte [esp + 3], 0xff
jne 0x42d3ab
mov al, byte [esp + 1]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi + 1], al
lea eax, [edi + 2]
inc edi
jmp 0x42d3e3
cmp dl, 0xff
je 0x42d3e3
mov al, byte [esp + 1]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi + 1], al
mov eax, dword [esp + 8]
mov dl, byte [esp + 2]
shl edx, 6
or dl, byte [esp + 3]
mov byte [eax + edi + 2], dl
lea eax, [edi + 3]
add edi, 2
inc edi
dec ebp
jne 0x42d2e4
add esp, 0xc
pop ebp
pop edi
pop esi
ret

Function at 0x436818
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x1c
call fcn.00402dac
lea eax, [ebx + 0x14]
push eax
push 0
lea eax, [ebx + 0x10]
push eax
lea eax, [ebx + 0xc]
push eax
lea eax, [ebx + 8]
push eax
push 0
lea eax, [ebx + 4]
push eax
push ebx
push 0
push 0
push 0
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
sete al
mov edx, dword [0x52d400]
cmp byte [edx + 0xc], 0
je 0x43687c
mov edx, dword [0x52d3f0]
cmp dword [edx], 2
jne 0x43687c
mov edx, dword [ebx + 4]
add dword [ebx + 4], edx
mov edx, dword [ebx + 0xc]
add dword [ebx + 0xc], edx
pop esi
pop ebx
ret
Function at 0x436880
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x436938
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.00436818
test al, al
je 0x43691a
mov ecx, dword [ebp - 0x24]
inc ecx
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.004042a4
mov ebx, dword [ebp - 0x28]
dec ebx
test ebx, ebx
jl 0x43691a
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404674
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumKeyExA
mov eax, dword [ebp - 0xc]
call fcn.00404674
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.004043ac
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x4368d3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43693f
lea eax, [ebp - 0x2c]
call fcn.004041b4
lea eax, [ebp - 0xc]
call fcn.004041b4
ret

Function at 0x436948
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x436a00
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.00436818
test al, al
je 0x4369e2
mov ecx, dword [ebp - 0x1c]
inc ecx
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.004042a4
mov ebx, dword [ebp - 0x20]
dec ebx
test ebx, ebx
jl 0x4369e2
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404674
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumValueA
mov eax, dword [ebp - 0xc]
call fcn.00404674
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.004043ac
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x43699b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x436a07
lea eax, [ebp - 0x2c]
call fcn.004041b4
lea eax, [ebp - 0xc]
call fcn.004041b4
ret
Function at 0x436b94
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.0043655c
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00404674
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x436bf2
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x52d07c]
mov dl, 1
mov eax, dword [0x436454]
call fcn.0040c8a0
call fcn.00403b4c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x436bfc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404674
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x436c54
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x52d40c]
mov dl, 1
mov eax, dword [0x436454]
call fcn.0040c8a0
call fcn.00403b4c
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0043658c
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x446518
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404664
xor eax, eax
push ebp
push 0x446646
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x446619
xor eax, eax
push ebp
push 0x446612
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404474
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4465e7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
xor eax, eax
push ebp
push 0x4465d6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404474
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.00404674
mov edx, ebx
pop ecx
call fcn.004029a4
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4465dd
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x52ccbc]
mov dl, 1
mov eax, dword [0x407a04]
call fcn.0040c864
call fcn.00403b4c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44664d
lea eax, [ebp - 4]
call fcn.004041b4
ret
Function at 0x446654
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x446805
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00404864
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x44681c
call fcn.004044c0
mov eax, ebx
call fcn.00420754
mov edi, eax
dec edi
test edi, edi
jl 0x44670c
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.00420728
mov edx, dword [0x4422e4]
call fcn.0040354c
test al, al
je 0x446708
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.00420728
lea edx, [ebp - 0x14]
call fcn.0047b890
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00404864
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404534
inc esi
dec edi
jne 0x4466ba
mov al, byte [0x446820]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x44682c
mov eax, dword [ebp - 0xc]
call fcn.0040dcb8
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.0040424c
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.0047b890
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x44681c
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.0047b890
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x44681c
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x44681c
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x446838
call fcn.00409ce8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44680c
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.004041d8
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004041d8
lea eax, [ebp - 0x14]
call fcn.004041b4
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004041d8
ret
Function at 0x44ee68
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x416294]
call fcn.00404c84
xor eax, eax
push ebp
push 0x44efac
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x5293d4], 0
jne 0x44eebb
mov ecx, dword [0x52cc28]
mov dl, 1
mov eax, dword [0x407a04]
call fcn.0040c864
call fcn.00403b4c
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00402dac
mov eax, ebx
call fcn.00404a3c
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x44efbc
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00405d3c
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404a4c
test eax, eax
jle 0x44ef53
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x44ef4c
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.0040443c
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404424
mov eax, dword [ebp - 0x48]
pop edx
call fcn.004088b0
test eax, eax
jne 0x44ef4c
mov ebx, 0x15
jmp 0x44ef58
mov ebx, 0x10
jmp 0x44ef58
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x5293d4]
call fcn.0044ed64
mov eax, dword [ebp - 8]
call fcn.0044ed64
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00405d54
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44efb3
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.004041d8
lea eax, [ebp - 0x10]
mov edx, dword [0x416294]
call fcn.00404d54
ret

Function at 0x45237c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404664
xor eax, eax
push ebp
push 0x452412
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
mov eax, dword [ebp - 4]
call fcn.00404674
push eax
call sub.kernel32.dll_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
jne 0x4523cd
xor ebx, ebx
jmp 0x4523fc
xor eax, eax
mov dword [ebp - 8], eax
push 2
push 0
push 0
push esi
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 8]
push eax
push edi
push ebx
push esi
call sub.kernel32.dll_WriteFile_1
test eax, eax
je 0x4523f4
mov bl, 1
jmp 0x4523f6
xor ebx, ebx
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452419
lea eax, [ebp - 4]
call fcn.004041b4
ret
Function at 0x4572ec
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x45731a
mov eax, ebx
call fcn.00457da0
cmp dword [ebx + 0x40], 0
je 0x457313
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x45738b
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x45737d
cmp dword [ebx + 8], 0
je 0x45733c
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x45734e
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x45737d
cmp dword [ebx + 8], 0
je 0x45732f
cmp eax, 3
je 0x457361
dec eax
jne 0x45732f
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x45732f
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x45732f
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4573a9
cmp dword [ebx + 0x14], 0xcc
je 0x4573a9
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004573b4
pop ebx
ret

Function at 0x4681dc
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.004073b8
ret

Function at 0x468678
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push ecx
mov ebx, edx
mov esi, eax
cmp dword [esi + 0x1c], 0
je 0x46868c
mov eax, esi
call fcn.00468724
mov eax, dword [esi + 8]
mov dword [esi + 0x1c], eax
test bl, bl
je 0x4686ae
mov eax, dword [esi + 8]
cmp word [eax], 0x25ff
jne 0x4686ae
add dword [esi + 0x1c], 2
mov eax, dword [esi + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 0x1c]
sub eax, 5
mov byte [esi + 0x10], 0xe9
mov edx, eax
and dl, 0xff
mov byte [esi + 0x11], dl
mov edx, eax
shr edx, 8
and dl, 0xff
mov byte [esi + 0x12], dl
mov edx, eax
shr edx, 0x10
and dl, 0xff
mov byte [esi + 0x13], dl
shr eax, 0x18
and al, 0xff
mov byte [esi + 0x14], al
mov eax, dword [esi + 0x1c]
mov al, byte [eax]
mov byte [esi + 0x15], al
mov eax, dword [esi + 0x1c]
mov al, byte [eax + 1]
mov byte [esi + 0x16], al
mov eax, dword [esi + 0x1c]
mov al, byte [eax + 2]
mov byte [esi + 0x17], al
mov eax, dword [esi + 0x1c]
mov al, byte [eax + 3]
mov byte [esi + 0x18], al
mov eax, dword [esi + 0x1c]
mov al, byte [eax + 4]
mov byte [esi + 0x19], al
push esp
push 0x40
push 5
mov eax, dword [esi + 0x1c]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
pop edx
pop esi
pop ebx
ret
Function at 0x47391c
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff3c
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0xc4], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404664
xor eax, eax
push ebp
push 0x473b14
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
call fcn.004041b4
push 0
lea eax, [ebp - 0xa4]
push eax
mov eax, dword [ebp - 4]
call fcn.00404674
push eax
call sub.kernel32.dll_OpenFile
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x47398d
mov eax, dword [ebp - 8]
mov edx, 0x473b2c
call fcn.00404208
jmp 0x473aeb
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetFileSize
mov esi, eax
mov eax, esi
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.00408ddc
cmp esi, 0x3e8
jae 0x4739d1
lea eax, [esi + 0xa]
call fcn.004027a8
mov dword [ebp - 0x14], eax
push 0
lea eax, [ebp - 0x10]
push eax
push esi
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadFile
jmp 0x473a27
push 0
push 0
mov dword [ebp - 0xc0], esi
xor eax, eax
mov dword [ebp - 0xbc], eax
fild qword [ebp - 0xc0]
fdiv dword [0x473b3c]
call fcn.00402ba4
add eax, 0x1f4
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetFilePointer
mov esi, 0x3e8
lea eax, [esi + 0xa]
call fcn.004027a8
mov dword [ebp - 0x14], eax
push 0
lea eax, [ebp - 0x10]
push eax
push esi
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadFile
cmp dword [ebp - 0x10], 0xc8
jbe 0x473a47
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
cmp byte [eax + edx - 0xc7], 0x5a
jne 0x473a47
sub dword [ebp - 0x10], 0xc8
xor ecx, ecx
mov dl, 1
mov eax, dword [0x42d720]
call fcn.00420130
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
call dword [edx + 0x40]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0x4c]
lea edx, [ebp - 0xb8]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 8]
call fcn.004041b4
mov esi, 0x10
lea ebx, [ebp - 0xb8]
lea ecx, [ebp - 0xc4]
xor eax, eax
mov al, byte [ebx]
mov edx, 2
call fcn.00408e04
mov edx, dword [ebp - 0xc4]
mov eax, dword [ebp - 8]
call fcn.0040447c
mov eax, dword [ebp - 8]
inc ebx
dec esi
jne 0x473a8f
mov eax, dword [ebp - 8]
push dword [eax]
push 0x473b48
push dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
mov edx, 3
call fcn.00404534
mov eax, dword [ebp - 0x18]
call fcn.004033c0
mov eax, dword [ebp - 0x14]
call fcn.004027c8
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x473b1b
lea eax, [ebp - 0xc4]
call fcn.004041b4
lea eax, [ebp - 0x1c]
call fcn.004041b4
lea eax, [ebp - 4]
call fcn.004041b4
ret
Function at 0x473cf0
Capabilities:
Acquire debug privileges

Disassembly:
push ebx
add esp, 0xffffffd0
lea eax, [esp + 4]
push eax
push 0x20
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
lea eax, [esp + 8]
push eax
push 0x473d8c
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov eax, dword [esp + 8]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x28], eax
mov dword [esp + 0x20], 1
xor ebx, ebx
mov dword [esp + 0x2c], ebx
push esp
lea eax, [esp + 0x14]
push eax
push 0x10
lea eax, [esp + 0x2c]
push eax
push 0
mov eax, dword [esp + 0x18]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
mov eax, dword [esp + 8]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], 1
or ebx, 2
mov dword [esp + 0x1c], ebx
push esp
push 0
mov eax, dword [esp + 8]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
mov eax, dword [esp + 0x18]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
add esp, 0x30
pop ebx
ret

Function at 0x4745f4
Capabilities:
Get graphical window text
Terminate process

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x47473c
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00473cf0
call sub.user32.dll_GetForegroundWindow
mov ebx, eax
push 0
push ebx
call sub.user32.dll_GetWindow
mov ebx, eax
test ebx, ebx
jbe 0x474719
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.user32.dll_GetWindowThreadProcessId
mov eax, pe_nt_image_headers32
call fcn.004027a8
mov esi, eax
mov eax, pe_nt_image_headers32
call fcn.004027a8
mov edi, eax
push 0xff
push esi
push ebx
call sub.user32.dll_GetWindowTextA
push 0xff
push edi
push ebx
call sub.user32.dll_GetClassNameA
lea eax, [ebp - 8]
mov edx, esi
call fcn.004043ac
lea eax, [ebp - 0xc]
mov edx, edi
call fcn.004043ac
push dword [ebp - 0xc]
push 0x474754
push dword [ebp - 8]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404534
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x10]
call fcn.00473850
mov eax, dword [ebp - 0x10]
mov edx, 0x474760
call fcn.004045c0
je 0x4746cc
mov eax, dword [ebp - 0x10]
mov edx, 0x47478c
call fcn.004045c0
je 0x4746cc
mov eax, dword [ebp - 0x10]
mov edx, 0x4747b8
call fcn.004045c0
jne 0x4746f9
mov eax, dword [ebp - 0x14]
push eax
push 0
push 0x411
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4746f9
push 0
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_TerminateProcess
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle
push 2
push ebx
call sub.user32.dll_GetWindow
mov ebx, eax
mov eax, esi
call fcn.004027c8
mov eax, edi
call fcn.004027c8
test ebx, ebx
ja 0x47462e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474743
lea eax, [ebp - 0x18]
call fcn.004041b4
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004041d8
ret