joyce8/EMBER2024-capa huggingface dataset:
Function at 0x452574
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x694
push ebx
xor ebx, ebx
push ebp
mov ebp, dword [esp + 0x6ac]
push esi
mov esi, dword [esp + 0x6a4]
mov edx, dword [esi + 4]
push edi
xor eax, eax
push ebx
mov word [esp + 0x50], ax
mov eax, dword [esi]
push edx
xor ecx, ecx
push eax
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov word [esp + 0x262], cx
mov dword [esp + 0x488], ebx
mov dword [esp + 0x2c], 1
call fcn.0041557c
mov edx, dword [esp + 0x6b8]
add esp, 0xc
lea ecx, [esp + 0x490]
push ecx
push edx
push esi
call fcn.004523ce
test eax, eax
je 0x45260c
lea eax, [ebx + 6]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x694
ret 0x10
mov eax, dword [esi]
push eax
push 1
lea ecx, [esp + 0x1f]
push 1
push ecx
call fcn.004151b0
mov edx, dword [esi]
push edx
push 1
lea eax, [esp + 0x30]
push 4
push eax
call fcn.004151b0
mov ecx, dword [esi]
mov edi, dword [esp + 0x38]
push ecx
push 1
lea edx, [esp + 0x40]
push 4
push edx
xor edi, 0x87bc
call fcn.004151b0
mov ecx, dword [esi]
mov eax, dword [esp + 0x48]
push ecx
push 1
lea edx, [esp + 0x50]
xor eax, 0x87bc
push 4
push edx
mov dword [ebp], eax
call fcn.004151b0
mov eax, dword [esp + 0x58]
add esp, 0x40
xor eax, 0xa685
push 1
mov dword [esp + 0x28], eax
mov eax, dword [esi]
push 0x10
push eax
call fcn.0041557c
mov ecx, dword [ebp]
add esp, 0xc
push ecx
call fcn.004138ba
add esp, 4
push edi
mov dword [esp + 0x20], eax
call fcn.004138ba
mov edx, dword [esi]
add esp, 4
push edx
push 1
mov ebp, eax
push edi
push ebp
call fcn.004151b0
mov eax, dword [esi + 8]
add esp, 0x10
add eax, 0x5ed6036b
push eax
push edi
push ebp
call fcn.0044afdc
push edi
push ebp
lea ecx, [esp + 0x28]
push ecx
call fcn.0043535d
mov edx, dword [esp + 0x24]
cmp edx, dword [esp + 0x20]
je 0x4526fd
mov eax, dword [esp + 0x1c]
push eax
call fcn.00413a88
add esp, 4
push ebp
call fcn.00413a88
add esp, 4
mov eax, 0xa
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x694
ret 0x10
cmp byte [esp + 0x17], 1
jne 0x45275b
xor ecx, ecx
mov eax, 1
mov word [esp + 0x4c], cx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x28]
xor edx, edx
push ecx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov word [esp + 0x25a], dx
mov dword [esp + 0x480], ebx
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], eax
call fcn.0044b195
push ebp
call fcn.00413a88
jmp 0x452769
mov edx, dword [esp + 0x1c]
push edx
call fcn.00413a88
mov dword [esp + 0x20], ebp
mov eax, dword [esp + 0x6b4]
mov ecx, dword [esp + 0x20]
add esp, 4
pop edi
pop esi
pop ebp
mov dword [eax], ecx
xor eax, eax
pop ebx
add esp, 0x694
ret 0x10
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..data
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x1eae3130
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..text
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x69bd3392
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x10009c60
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x14
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0xec085d00
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
sub eax, 0x90eb1fb6
je 0x10009dc6
jmp 0x10009c93
mov eax, dword [ebp - 0x18]
nop word cs:[eax + eax]
sub eax, 0x9b0793f3
je 0x10009dfa
jmp 0x10009cb0
mov eax, dword [ebp - 0x18]
sub eax, 0xa5a6566b
je 0x10009e28
nop
jmp 0x10009cc5
mov eax, dword [ebp - 0x18]
sub eax, 0xb79c87c4
je 0x10009e71
jmp 0x10009cd8
mov eax, dword [ebp - 0x18]
nop dword [eax + eax]
sub eax, 0xb88ed36f
je 0x10009da5
jmp 0x10009cf0
mov eax, dword [ebp - 0x18]
sub eax, 0xd5c1a410
je 0x10009ea5
nop
jmp 0x10009d05
mov eax, dword [ebp - 0x18]
sub eax, 0xe2f4a98b
je 0x10009e90
jmp 0x10009d18
mov eax, dword [ebp - 0x18]
nop dword [eax + eax]
sub eax, 0xe901092b
je 0x10009de7
jmp 0x10009d30
mov eax, dword [ebp - 0x18]
sub eax, 0xec085d00
je 0x10009d8a
nop
jmp 0x10009d45
mov eax, dword [ebp - 0x18]
sub eax, 0x4e6d54ca
je 0x10009e65
jmp 0x10009d58
mov eax, dword [ebp - 0x18]
nop dword [eax + eax]
sub eax, 0x6441d9a5
je 0x10009e4f
jmp 0x10009d70
mov eax, dword [ebp - 0x18]
sub eax, 0x687b9ddb
je 0x10009e0d
nop
jmp 0x10009d85
jmp 0x10009eae
mov edx, dword [ebp - 8]
mov eax, 0x9b0793f3
mov ecx, 0xb88ed36f
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x14], eax
jmp 0x10009eae
mov eax, dword [ebp + 8]
movzx edx, byte [eax]
mov eax, 0x9b0793f3
mov ecx, 0x90eb1fb6
cmp edx, 0x90
cmovne eax, ecx
mov dword [ebp - 0x14], eax
jmp 0x10009eae
mov eax, dword [ebp + 8]
movzx edx, byte [eax]
mov eax, 0x9b0793f3
mov ecx, 0xe901092b
cmp edx, 0xcc
cmovne eax, ecx
mov dword [ebp - 0x14], eax
jmp 0x10009eae
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 0xd5c1a410
jmp 0x10009eae
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x14], 0x687b9ddb
jmp 0x10009eae
mov edx, dword [ebp - 0x10]
mov eax, 0xe2f4a98b
mov ecx, 0xa5a6566b
cmp edx, dword [ebp + 0xc]
cmovb eax, ecx
mov dword [ebp - 0x14], eax
jmp 0x10009eae
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
movzx edx, byte [eax + ecx]
mov eax, dword [ebp + 8]
movzx esi, byte [eax]
mov eax, 0x4e6d54ca
mov ecx, 0x6441d9a5
cmp edx, esi
cmovne eax, ecx
mov dword [ebp - 0x14], eax
jmp 0x10009eae
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 0xd5c1a410
nop dword [eax]
jmp 0x10009eae
mov dword [ebp - 0x14], 0xb79c87c4
jmp 0x10009eae
mov eax, dword [ebp - 0x10]
add eax, 0x219f02a8
add eax, 1
sub eax, 0x219f02a8
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0x687b9ddb
jmp 0x10009eae
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x14], 0xd5c1a410
nop
jmp 0x10009eae
mov eax, dword [ebp - 0xc]
add esp, 0x14
pop esi
pop ebp
ret
jmp 0x10009c7d
Function at 0x10027500
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0x1505
mov dword [ebp - 0xc], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0xa9cc96a1
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
sub eax, 0xa9cc96a1
je 0x100275aa
jmp 0x1002753e
mov eax, dword [ebp - 0x14]
sub eax, 0xe5d8bcef
je 0x10027631
jmp 0x10027551
mov eax, dword [ebp - 0x14]
sub eax, 0x283a8923
je 0x100275f9
nop
jmp 0x10027565
mov eax, dword [ebp - 0x14]
sub eax, 0x2eee7257
je 0x100275c5
jmp 0x10027578
mov eax, dword [ebp - 0x14]
nop dword [eax + eax]
sub eax, 0x43cc4973
je 0x100275ed
jmp 0x10027590
mov eax, dword [ebp - 0x14]
sub eax, 0x5701c26f
je 0x10027650
nop
jmp 0x100275a5
jmp 0x10027658
mov edx, dword [ebp - 0xc]
mov eax, 0x5701c26f
mov ecx, 0x2eee7257
cmp edx, dword [ebp + 0xc]
cmovb eax, ecx
mov dword [ebp - 0x10], eax
jmp 0x10027658
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov al, byte [eax + ecx]
mov byte [ebp - 5], al
movzx edx, byte [ebp - 5]
mov eax, 0x283a8923
mov ecx, 0x43cc4973
cmp edx, 0
cmove eax, ecx
mov dword [ebp - 0x10], eax
jmp 0x10027658
mov dword [ebp - 0x10], 0x5701c26f
jmp 0x10027658
mov eax, dword [ebp - 4]
shl eax, 5
mov edx, dword [ebp - 4]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
movzx edx, byte [ebp - 5]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0xe5d8bcef
jmp 0x10027658
mov eax, dword [ebp - 0xc]
add eax, 0x39a4653f
add eax, 1
sub eax, 0x39a4653f
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0xa9cc96a1
jmp 0x10027658
mov eax, dword [ebp - 4]
add esp, 0x14
pop ebp
ret
jmp 0x10027528
Function at 0x100467ac
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100467eb
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100467eb
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100467eb
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x100467eb
cmp dword [ecx + 0x74], 0xe
jbe 0x100467eb
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x1004ab90
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1004abbd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1004abbd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x1004aee0
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1005bd40
push 0x1005bd38
push str.FlsAlloc
push 0x1f
call fcn.1004b1c3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1004af14
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
jmp 0x1004af1a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1004af5e
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1005bd50
push 0x1005bd48
push str.FlsGetValue
push 0x21
call fcn.1004b1c3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1004af95
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1004af9d
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1005bd58
push 0x1005bd50
push str.FlsSetValue
push 0x22
call fcn.1004b1c3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1004afd7
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1004f380
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1004f41d
push ebx
push esi
call fcn.1004f420
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1004f284
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1004f3ca
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1004f41c
push edi
push eax
call fcn.1004ceb2
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1004f3ea
call fcn.1004c38d
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1004f41b
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1004f284
add esp, 0x20
test eax, eax
jne 0x1004f409
push edi
call fcn.1004c38d
jmp 0x1004f411
push ebx
call fcn.1004c38d
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x4040c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
sub esp, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x1e94c8ae
jmp 0x404100
mov dword [ebp - 0x18], 0x3fbf56
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x18]
cmp eax, 0x7d805f09
jg 0x404130
cmp eax, 0x4f5745f5
jg 0x404140
cmp eax, 0xb0c369b8
jg 0x404150
cmp eax, 0x93754e33
jne 0x404100
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], 0x706691e
jmp 0x404100
cmp eax, 0x7d805f0a
jne 0x404100
jmp 0x4040f1
cmp eax, 0x4f5745f6
jne 0x404100
mov dword [ebp - 0x18], 0x9f381b6
jmp 0x404100
cmp eax, 0x1e94c8ad
jg 0x40416a
cmp eax, 0xbec5085c
jg 0x404189
cmp eax, 0xb0c369b9
jne 0x404100
jmp 0x404216
cmp eax, 0x1e94c8ae
jne 0x404100
mov eax, 0xd556e8cc
cmp dword [ebp - 8], 0
je 0x404181
mov eax, 0xbec5085d
mov dword [ebp - 0x18], eax
jmp 0x404100
cmp eax, 0xd556e8cb
jg 0x4041a7
cmp eax, 0xbec5085d
jne 0x404100
mov dword [ebp - 0x18], 0x706691e
jmp 0x404100
cmp eax, 0x3fbf55
jg 0x4041cc
cmp eax, 0xd556e8cc
jne 0x404100
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0x18], 0x9f381b6
jmp 0x404100
cmp eax, 0x3fbf56
je 0x4041ed
cmp eax, 0x706691e
jne 0x4041ff
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], 0x4f5745f6
jmp 0x404100
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], 0xb0c369b9
jmp 0x404100
cmp eax, 0x9f381b6
jne 0x404100
mov dword [ebp - 0x18], 0x3fbf56
jmp 0x404100
mov eax, dword [ebp - 4]
add esp, 0x20
pop ebp
ret

Function at 0x404220
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
sub esp, 8
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 0xf3562e3d
jmp 0x404260
mov dword [ebp - 0x14], 0x54e5c47c
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x14]
cmp eax, 0x66f4a6c9
jg 0x4042a0
cmp eax, 0x54e5c47b
jg 0x4042b0
cmp eax, 0x4f30c90f
jg 0x4042b9
cmp eax, 0xf3562e3c
jg 0x4042d0
cmp eax, 0x91113346
je 0x4042ef
cmp eax, 0x91e2461b
jne 0x404302
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0x14], 0x66f4a6ca
jmp 0x404260
cmp eax, 0x66f4a6ca
jne 0x404260
jmp 0x404251
cmp eax, 0x54e5c47c
jne 0x404260
jmp 0x404319
cmp eax, 0x4f30c910
jne 0x404260
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0x14], 0x91e2461b
jmp 0x404260
cmp eax, 0xf3562e3d
jne 0x404260
mov eax, 0xeebd09d6
cmp dword [ebp - 4], 0
je 0x4042e7
mov eax, 0x91113346
mov dword [ebp - 0x14], eax
jmp 0x404260
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0x54e5c47c
jmp 0x404260
cmp eax, 0xeebd09d6
jne 0x404260
mov dword [ebp - 0x14], 0x91e2461b
jmp 0x404260
mov eax, dword [ebp - 8]
add esp, 0x1c
pop ebp
ret
Function at 0x4055c0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x138
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], eax
mov dword [esp], eax
call fcn.00404a30
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x134], 0xdd9a08ba
lea esi, [ebp - 0x129]
mov edi, 0x1a51b0e1
jmp 0x405620
mov dword [ebp - 0x134], 0xafaf4249
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x134]
cmp eax, 0xafaf4248
jg 0x405640
cmp eax, 0x8f1a4bd6
jne 0x405620
jmp 0x405611
cmp eax, 0xdd9a08b9
jg 0x405670
cmp eax, 0xafaf4249
jne 0x405620
cmp dword [ebp - 0x130], 0
sete byte [ebp - 0xd]
mov dword [ebp - 0x134], 0x342808b7
jmp 0x405620
cmp eax, 0x342808b6
jg 0x40568a
cmp eax, 0xdd9a08ba
jne 0x405620
mov dword [ebp - 0x134], 0xafaf4249
jmp 0x405620
cmp eax, 0x342808b7
je 0x405763
cmp eax, 0x77321e9b
jne 0x40577f
mov dword [esp], esi
mov dword [esp + 8], 0x105
mov dword [esp + 4], 0
call fcn.00403dc0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov dword [esp + 8], eax
mov dword [esp], ecx
mov dword [esp + 4], 0
call fcn.00403dc0
mov dword [esp], esi
mov dword [esp + 4], 0x105
call fcn.00404ce0
mov dword [esp], esi
call fcn.00404a30
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x18]
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], ebx
call fcn.00404330
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x14]
add edx, edi
sub edx, ecx
add edx, 0xe5ae4f1f
add ecx, dword [ebp - 0x18]
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp + 4], edx
mov dword [esp], ecx
call fcn.00404330
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
sub esp, 8
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x134], 0xdd9a08ba
jmp 0x405620
mov al, byte [ebp - 0xd]
test al, al
mov eax, 0x77321e9b
jne 0x405774
mov eax, 0x61ad8ec9
mov dword [ebp - 0x134], eax
jmp 0x405620
cmp eax, 0x61ad8ec9
jne 0x405620
add esp, 0x138
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41f62a
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4c83e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.0041c487
mov dword [ebp - 0x14], eax
cmp dword [0x4c9c7c], edi
jne 0x41f71b
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x41f6a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x41f7fb
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x41f7fb
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41f7fb
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x4c9c7c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x4c9c80], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x4c9c84], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4c9c8c], eax
test eax, eax
je 0x41f718
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4c9c88], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x41f740
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41f733
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x41f755
push 4
pop eax
jmp 0x41f7fd
cmp dword [ebp - 0x14], edi
je 0x41f755
push dword [0x4c9c7c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x41f73a
mov eax, dword [0x4c9c88]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x41f7b3
cmp dword [0x4c9c8c], esi
je 0x41f7b3
push eax
call ebx
push dword [0x4c9c8c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x41f7b3
test eax, eax
je 0x41f7b3
call ecx
test eax, eax
je 0x41f7a8
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x41f7a8
test byte [ebp - 8], 1
jne 0x41f7b3
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x41f7e3
mov eax, dword [0x4c9c80]
cmp eax, esi
je 0x41f7e0
push eax
call ebx
test eax, eax
je 0x41f7e0
call eax
mov edi, eax
test edi, edi
je 0x41f7e0
mov eax, dword [0x4c9c84]
cmp eax, esi
je 0x41f7e0
push eax
call ebx
test eax, eax
je 0x41f7e0
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x4c9c7c]
call ebx
test eax, eax
je 0x41f7fb
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x41f7fd
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00419599
leave
ret
Function at 0x4013f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push edi
push 0x3c
lea eax, [ebp - 0x3c]
mov esi, edx
push 0
push eax
mov edi, ecx
call fcn.004026c0
add esp, 0xc
mov dword [ebp - 0x3c], 0x3c
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x38], 0x440
mov dword [ebp - 0x30], str.runas
mov dword [ebp - 0x2c], edi
push eax
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x20], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x401469
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str._s_could_not_be_launched:__d_n
push 2
call fcn.00402fff
add esp, 4
push eax
call fcn.00401270
add esp, 0x10
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
cmp dword [ebp + 8], 0
je 0x40147a
push 0xffffffffffffffff
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x401490
Capabilities:
Get comspec environment variable
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
mov eax, dword [0x41a004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi], 0
je 0x4014c9
push str._c__2007___Johannes_Passing___http:__int3.de__n_nExecute_a_process_on_the_command_line_with_elevated_rights_on_Vista_n_nUsage:_Elevate_____wait_k__prog__args__n________Shows_this_help_n_wait___Waits_until_prog_terminates_n_k______Starts_the_the___COMSPEC___environment_variable_value_and_n_t_texecutes_prog_in_it__CMD.EXE__4NT.EXE__etc.__nprog____The_program_to_execute_nargs____Optional_command_line_arguments_to_prog_n
call fcn.004012a0
add esp, 4
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401821
mov esp, ebp
pop ebp
ret
cmp dword [esi + 8], 0
je 0x401553
push 0x104
lea eax, [ebp - 0x20c]
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x40151a
push str.__COMSPEC___is_not_defined_n
push 2
call fcn.00402fff
add esp, 4
push eax
call fcn.00401270
add esp, 8
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401821
mov esp, ebp
pop ebp
ret
push dword [esi + 0x10]
lea eax, [ebp - 0x20c]
push str._K___s_
mov dword [esi + 0xc], eax
lea eax, [ebp - 0x61c]
push 0x208
push eax
call fcn.00401360
add esp, 0x10
test eax, eax
jns 0x40154a
push str.Creating_command_line_failed_n
jmp 0x4014f3
lea eax, [ebp - 0x61c]
mov dword [esi + 0x10], eax
push dword [esi + 4]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
call fcn.004013f0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00401821
mov esp, ebp
pop ebp
ret