joyce8/EMBER2024-capa huggingface dataset:
Function at 0x488ed0
Capabilities:
Hash data using sha1

Disassembly:
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov edi, dword [esi + 0x18]
and edi, 0x3f
mov eax, edi
mov ebx, edx
and eax, 3
xor ebp, ebp
shr edi, 2
xor edx, edx
cmp eax, ebp
je 0x488ef2
mov edx, dword [esi + edi*4 + 0x20]
lea ecx, [eax*8]
mov eax, SysReAllocStringLen
shr eax, cl
inc edi
or eax, edx
mov dword [esi + edi*4 + 0x1c], eax
cmp edi, 0xe
je 0x488f2a
lea esp, [esp]
and edi, 0xf
jne 0x488f20
push esi
lea edx, [esi + 0x20]
mov ecx, esi
call fcn.00488760
mov dword [esi + edi*4 + 0x20], ebp
inc edi
cmp edi, 0xe
jne 0x488f10
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
shld ecx, eax, 3
add eax, eax
add eax, eax
add eax, eax
mov dword [esi + 0x58], ecx
push esi
lea edx, [esi + 0x20]
mov ecx, esi
mov dword [esi + 0x5c], eax
call fcn.00488760
xor eax, eax
lea ecx, [ecx]
mov ecx, dword [esi + eax*4]
bswap ecx
mov dword [ebx], ecx
inc eax
add ebx, 4
cmp eax, 5
jb 0x488f50
pop edi
mov dword [esi + 0x18], ebp
mov dword [esi + 0x1c], ebp
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
pop esi
pop ebp
pop ebx
ret

Function at 0x489030
Capabilities:
Hash data using sha1

Disassembly:
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov edi, dword [esi + 0x18]
and edi, 0xf
mov dword [esi + edi*4 + 0x20], SysReAllocStringLen
inc edi
xor ebx, ebx
mov ebp, edx
cmp edi, 0xe
je 0x48906a
mov edi, edi
and edi, 0xf
jne 0x489060
push esi
lea edx, [esi + 0x20]
mov ecx, esi
call fcn.00488760
mov dword [esi + edi*4 + 0x20], ebx
inc edi
cmp edi, 0xe
jne 0x489050
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
shld ecx, eax, 5
shl eax, 5
mov dword [esi + 0x58], ecx
push ebp
lea edx, [esi + 0x20]
mov ecx, esi
mov dword [esi + 0x5c], eax
call fcn.00488760
pop edi
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
pop esi
pop ebp
pop ebx
ret

Function at 0x4890c0
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
mov dword [ecx], 0x6a09e667
mov dword [ecx + 4], 0xbb67ae85
mov dword [ecx + 8], 0x3c6ef372
mov dword [ecx + 0xc], 0xa54ff53a
mov dword [ecx + 0x10], 0x510e527f
mov dword [ecx + 0x14], 0x9b05688c
mov dword [ecx + 0x18], 0x1f83d9ab
mov dword [ecx + 0x1c], 0x5be0cd19
mov dword [ecx + 0x20], eax
mov dword [ecx + 0x24], eax
ret
Function at 0x489c90
Capabilities:
Hash data using sha256

Disassembly:
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov edi, dword [esi + 0x20]
and edi, 0x3f
mov byte [edi + esi + 0x28], 0x80
inc edi
xor ebx, ebx
mov ebp, edx
cmp edi, 0x38
je 0x489cc5
jmp 0x489cb0
and edi, 0x3f
jne 0x489cbb
push esi
call fcn.00489100
mov byte [esi + edi + 0x28], bl
inc edi
cmp edi, 0x38
jne 0x489cb0
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
shld ecx, eax, 3
add eax, eax
add eax, eax
add eax, eax
bswap ecx
bswap eax
push esi
mov dword [esi + 0x60], ecx
mov dword [esi + 0x64], eax
call fcn.00489100
xor eax, eax
mov ecx, dword [esi + eax*4 + 4]
mov edx, dword [esi + eax*4]
bswap edx
bswap ecx
mov dword [ebp], edx
mov dword [ebp + 4], ecx
add eax, 2
add ebp, 8
cmp eax, 8
jb 0x489ce7
pop edi
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
pop esi
pop ebp
pop ebx
ret

Function at 0x489e50
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
push 0
mov esi, ecx
mov ecx, dword [esp + 0x10]
push ecx
push edx
push 0
push 0
call sub.MSVCRT.dll__beginthreadex
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x489e78
xor eax, eax
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x489e87
mov eax, 1
ret 4

Function at 0x48a0e0
Capabilities:
Hash data using sha256

Disassembly:
mov eax, edx
mov dword [ecx], eax
dec eax
je 0x48a103
sub eax, 3
je 0x48a0f9
sub eax, 6
jne 0x48a10a
add ecx, 0x10
jmp fcn.004890c0
or eax, 0xffffffff
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
ret
mov dword [ecx + 4], 0xffffffff
ret
Function at 0x48f130
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
lea ebp, [ebx + 0x1c]
shr ebx, 2
mov eax, ebx
shr eax, 1
push esi
add eax, 3
xor esi, esi
mov dword [esp + 0xc], ebp
mov dword [ecx], eax
test ebx, ebx
je 0x48f15f
mov eax, dword [edx]
mov dword [ecx + esi*4 + 0x10], eax
inc esi
add edx, 4
cmp esi, ebx
jb 0x48f151
cmp esi, ebp
jae 0x48f250
mov edx, esi
sub edx, ebx
lea eax, [ecx + edx*4 + 0x10]
mov dword [esp + 0x14], eax
push edi
xor edx, edx
mov eax, esi
div ebx
mov edi, dword [ecx + esi*4 + 0xc]
test edx, edx
jne 0x48f1dd
movzx eax, byte [eax + 0x4a0b40]
mov edx, edi
and edx, 0xff
movzx edx, byte [edx + str.cw]
mov ebp, edi
shr ebp, 0x18
movzx ebp, byte [ebp + str.cw]
shl edx, 8
or edx, ebp
mov ebp, edi
shr ebp, 0x10
shr edi, 8
and ebp, 0xff
movzx ebp, byte [ebp + str.cw]
and edi, 0xff
movzx edi, byte [edi + str.cw]
shl edx, 8
or edx, ebp
mov ebp, dword [esp + 0x10]
shl edx, 8
xor edi, eax
or edi, edx
jmp 0x48f233
cmp ebx, 6
jbe 0x48f233
cmp edx, 4
jne 0x48f233
mov edx, edi
shr edx, 0x10
and edx, 0xff
movzx eax, byte [edx + str.cw]
mov edx, edi
shr edx, 0x18
movzx edx, byte [edx + str.cw]
shl edx, 8
or eax, edx
mov edx, edi
shr edx, 8
and edx, 0xff
movzx edx, byte [edx + str.cw]
shl eax, 8
and edi, 0xff
movzx edi, byte [edi + str.cw]
or eax, edx
shl eax, 8
or edi, eax
mov eax, dword [esp + 0x18]
mov edx, dword [eax]
xor edx, edi
mov dword [ecx + esi*4 + 0x10], edx
inc esi
add eax, 4
mov dword [esp + 0x18], eax
cmp esi, ebp
jb 0x48f174
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
Function at 0x403af0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ecx, dword [esp + 0x1c]
cmp ecx, 0
je 0x403cd5
call fcn.00403b06

Function at 0x405b40
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x2c]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
push ebx
cmp ecx, 0
je 0x405c24
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x405bbf
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.004056e0
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x405b8d
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x405cdd
call fcn.00405bd1
and ebp, 0xfffffff8
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
je 0x405c7c
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.00405810
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x405c35
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x405cdd
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.00405810
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x405cd8
jmp 0x405cdd
mov ecx, dword [esp + 0x4c]
add esp, 0x20
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407620
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x40763e
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
ret
Function at 0x407680
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x40769e
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
ret

Function at 0x4076e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x407702
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
ret

Function at 0x407760
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x407782
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
ret

Function at 0x4077e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x40780a
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
ret
Function at 0x407870
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x40789a
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
ret

Function at 0x407900
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesenc xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x40795f

Function at 0x4079e0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x407a3f
Function at 0x4093c0
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
push ebx
test eax, eax
je 0x4098e0
test edx, edx
je 0x4098e0
call fcn.004093d7
mov eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x409920
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.004093c0
mov edx, dword [esp + 0xc]
shl ecx, 4
test eax, eax
jne 0x409991
lea eax, [edx + ecx + 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
movups xmmword [eax], xmm0
movups xmmword [edx], xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmmword [edx - 0x10], xmm1
cmp eax, edx
ja 0x409956
movups xmm0, xmmword [edx]
aesimc xmm0, xmm0
movups xmmword [edx], xmm0
pxor xmm0, xmm0
pxor xmm1, xmm1
xor eax, eax
ret
Function at 0x41a5b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c3170
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x64], eax
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
push esi
push dword [edi + 0x4c]
call dword [sym.imp.USER32.dll_KillTimer]
cmp esi, 0x3f6
jne 0x41a6c0
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0x70
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push str.C2149F633507CCE4C4859A36EC17C6CA2FFF40AD623BAE31450266B169900009CC15A16B9A3538A71D357D9DD48ABECDDEB6749EA5084E5A
mov word [ecx], ax
call fcn.00419ca0
lea ecx, [esp + 0x28]
call fcn.00422f00
add esp, 0x18
lea ecx, [esp + 0x10]
cmp dword [esp + 0x24], 8
cmovae ecx, dword [esp + 0x10]
call fcn.0041c150
mov esi, eax
call fcn.00421300
test esi, esi
je 0x41a68e
test eax, eax
je 0x41a68e
mov esi, dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0x3e8
push 0x3f0
push dword [edi + 0x4c]
call esi
push 0
push 0x493e0
push 0x3ea
push dword [edi + 0x4c]
call esi
push 0
push 0x927c0
push 0x3e9
push dword [edi + 0x4c]
call esi
jmp 0x41a6a3
push 0
push 0x2710
push 0x3f6
push dword [edi + 0x4c]
call dword [sym.imp.USER32.dll_SetTimer]
cmp dword [esp + 0x24], 8
jb 0x41a7d5
push dword [esp + 0x10]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
jmp 0x41a7d5
cmp esi, 0x3ea
jne 0x41a6d4
mov ecx, edi
call fcn.0041a800
jmp 0x41a7d5
cmp esi, 0x3e9
jne 0x41a6f9
mov ecx, edi
call fcn.0041ae90
push 0
push 0x2932e00
push esi
push dword [edi + 0x4c]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x41a7d5
cmp esi, 0x3eb
jne 0x41a770
lea ecx, [esp + 0x40]
call fcn.0041a370
push str.SimpleNotepadUpdater.exe
mov edx, eax
mov dword [esp + 0x84], 0
lea ecx, [esp + 0x14]
call fcn.0041b310
add esp, 4
lea ecx, [esp + 0x40]
mov byte [esp + 0x80], 2
call fcn.00419750
cmp dword [esp + 0x24], 8
lea eax, [esp + 0x10]
cmovae eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41a76a
test al, 0x10
jne 0x41a76a
cmp dword [esp + 0x24], 8
lea ecx, [esp + 0x10]
cmovae ecx, dword [esp + 0x10]
call fcn.0041b660
lea ecx, [esp + 0x10]
jmp 0x41a7d0
cmp esi, 0x3f0
jne 0x41a7d5
lea ecx, [esp + 0x58]
call fcn.0041a370
push str.SimpleNotepadHelperTools.exe
mov edx, eax
mov dword [esp + 0x84], 3
lea ecx, [esp + 0x2c]
call fcn.0041b310
add esp, 4
lea ecx, [esp + 0x58]
mov byte [esp + 0x80], 5
call fcn.00419750
cmp dword [esp + 0x3c], 8
lea ecx, [esp + 0x28]
mov edx, str._optstart
cmovae ecx, dword [esp + 0x28]
push ecx
call fcn.0041c020
add esp, 4
lea ecx, [esp + 0x28]
call fcn.00419750
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.0046bea8
mov esp, ebp
pop ebp
ret 4
Function at 0x41ae90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c3290
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea ecx, [ebp - 0x40]
call fcn.0041a370
push ecx
lea edx, [ebp - 0x40]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0041b3b0
add esp, 4
mov byte [ebp - 4], 1
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41af70
test al, 0x10
jne 0x41af70
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
call fcn.0041b660
cmp dword [ebp - 0x14], 8
lea edi, [ebp - 0x28]
cmovae edi, dword [ebp - 0x28]
call fcn.0041c080
mov esi, eax
mov dword [ebp - 0x44], 0
lea eax, [ebp - 0x44]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_ProcessIdToSessionId]
push dword [ebp - 0x44]
push esi
push str.CreateProcessAsUserExplorer_dwPid_d_dwSid_d_n
push 0xb4
push str.ProcessCommon.cpp
call fcn.004c27e0
mov ecx, dword [ebp - 0x44]
add esp, 0x10
mov edx, edi
push str._optmoduleup
call fcn.0041bcb0
add esp, 8
push 0
push 0xdbba0
push 0x3eb
push dword [ebx + 0x4c]
call dword [sym.imp.USER32.dll_SetTimer]
cmp dword [ebp - 0x14], 8
mov esi, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
jb 0x41af84
push dword [ebp - 0x28]
call esi
add esp, 4
xor eax, eax
mov dword [ebp - 0x14], 7
cmp dword [ebp - 0x2c], 8
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
jb 0x41afa6
push dword [ebp - 0x40]
call esi
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046bea8
mov esp, ebp
pop ebp
ret
Function at 0x41ba80
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, edx
mov dword [ebp - 0x18], 0
mov esi, 1
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
lea ecx, [ebp - 0x18]
push ecx
push 0x20
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x41babb
xor esi, esi
jmp 0x41bb21
lea eax, [ebp - 0x20]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x41bad4
xor esi, esi
jmp 0x41bb21
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
xor eax, eax
test edi, edi
mov dword [ebp - 0x14], esi
push 0
sete al
push 0
push 0x10
lea eax, [eax*2 + 2]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x41bb11
xor esi, esi
jmp 0x41bb21
call dword [sym.imp.KERNEL32.DLL_GetLastError]
xor ecx, ecx
cmp eax, 0x514
cmove esi, ecx
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x41bb2f
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0046bea8
mov esp, ebp
pop ebp
ret

Function at 0x41bb50
Capabilities:
Check os version
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x11c
lea eax, [ebp - 0x128]
mov esi, ecx
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x128], 0x11c
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
test eax, eax
je 0x41bbd0
cmp dword [ebp - 0x124], 5
jbe 0x41bbd0
push 1
push 0
push 0x4e8c60
push esi
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp eax, 0x20
setg cl
mov eax, ecx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046bea8
mov esp, ebp
pop ebp
ret
xor eax, eax
push 0x20a
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call sub.MSVCR120.dll_memset
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x218]
push 0x106
push eax
call dword [sym.imp.MSVCR120.dll_wcsncpy_s]
mov esi, dword [sym.imp.MSVCR120.dll_wcsncat_s]
lea eax, [ebp - 0x218]
push 0xffffffffffffffff
push 0x4e9210
push 0x106
push eax
call esi
push 0xffffffffffffffff
push 0x4e8c60
lea eax, [ebp - 0x218]
push 0x106
push eax
call esi
push 0x40
lea eax, [ebp - 0x26c]
mov dword [ebp - 0x270], 0x44
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0x48
lea eax, [ebp - 0x270]
push eax
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoW]
lea eax, [ebp - 0x228]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0x270]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x218]
push eax
push 0
movdqu xmmword [ebp - 0x228], xmm0
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
mov ecx, dword [ebp - 4]
dec eax
neg eax
pop esi
sbb eax, eax
xor ecx, ebp
inc eax
call fcn.0046bea8
mov esp, ebp
pop ebp
ret
Function at 0x41c080
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 2
mov dword [ebp - 0x234], 0
call dword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
mov esi, eax
test esi, esi
je 0x41c13d
push ebx
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_Process32FirstW]
test eax, eax
je 0x41c102
mov edi, dword [sym.imp.KERNEL32.DLL_Process32NextW]
mov ebx, dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
lea esp, [esp]
push 0xc
lea eax, [ebp - 0x20c]
push eax
push str.EXPLORER.EXE
call ebx
test eax, eax
je 0x41c12b
lea eax, [ebp - 0x230]
push eax
push esi
call edi
test eax, eax
jne 0x41c0e0
mov edi, dword [ebp - 0x234]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [ebp - 0x234], 1
pop ebx
jne 0x41c13d
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046bea8
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x228]
mov dword [ebp - 0x234], 1
jmp 0x41c108
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0046bea8
mov esp, ebp
pop ebp
ret