joyce8/EMBER2024-capa huggingface dataset:
Function at 0x436a80
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x579630]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
mov dword [ebp - 0x18], 0
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x20], eax
cmp byte [eax + 0x2c], 0
mov dword [ebp - 0x1c], edi
jne 0x436abf
mov eax, 0x3f0
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401590
mov esp, ebp
pop ebp
ret 4
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea ecx, [ebp - 8]
push ecx
push 0
push 0
push 2
push dword [eax + 0x24]
mov dword [ebp - 8], 0
call esi
mov eax, dword [ebp - 8]
test eax, eax
jne 0x436afb
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401590
mov esp, ebp
pop ebp
ret 4
push ebx
push eax
call fcn.00425c1e
add esp, 4
mov ebx, eax
lea eax, [ebp - 8]
mov dword [ebp - 0x18], ebx
push eax
push dword [ebp - 8]
mov eax, dword [ebp - 0x20]
push ebx
push 2
push dword [eax + 0x24]
call esi
test eax, eax
jne 0x436b42
push ebx
call fcn.0041d0a7
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebx
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401590
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0x18]
xor ebx, ebx
mov dword [ebp - 0x10], ebx
cmp dword [eax], ebx
jbe 0x436c0e
lea esi, [eax + 4]
mov eax, dword [esi + 4]
test al, 0x20
jne 0x436bfc
test eax, 0xc0000000
jne 0x436bfc
xor al, al
mov byte [ebp - 9], al
test edi, edi
je 0x436bdf
mov ebx, dword [edi]
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov eax, 0x78787879
mov ecx, dword [edi + 4]
sub ecx, ebx
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x436bd9
xor edi, edi
push dword [esi]
lea ecx, [edi + ebx]
call fcn.00407530
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x436bd2
mov eax, dword [ebp - 0x1c]
add edi, 0x44
inc dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov ebx, dword [eax]
sub ecx, ebx
mov eax, 0x78787879
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [ebp - 0x14], eax
jb 0x436b95
jmp 0x436bd6
mov byte [ebp - 9], 1
mov edi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x10]
mov al, byte [ebp - 9]
test al, al
jne 0x436bfc
push dword [esi]
lea ecx, [ebp - 0x64]
call fcn.0040ec60
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x64]
push eax
lea ecx, [ecx + 0x18]
call fcn.00436650
mov eax, dword [ebp - 0x18]
inc ebx
add esi, 8
mov dword [ebp - 0x10], ebx
cmp ebx, dword [eax]
jb 0x436b55
push eax
call fcn.0041d0a7
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
xor eax, eax
pop ebx
pop esi
pop edi
call fcn.00401590
mov esp, ebp
pop ebp
ret 4
Function at 0x436c30
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x579630]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
mov dword [ebp - 0x20], 0
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x24], eax
cmp byte [eax + 0x2c], 0
mov dword [ebp - 0x1c], ebx
jne 0x436c6f
mov eax, 0x3f0
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401590
mov esp, ebp
pop ebp
ret 4
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0
push 3
push dword [eax + 0x24]
mov dword [ebp - 0x10], 0
call esi
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x436cab
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401590
mov esp, ebp
pop ebp
ret 4
push edi
push eax
call fcn.00425c1e
add esp, 4
mov edi, eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], edi
push eax
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
push edi
push 3
push dword [eax + 0x24]
call esi
test eax, eax
jne 0x436cf2
push edi
call fcn.0041d0a7
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401590
mov esp, ebp
pop ebp
ret 4
cmp dword [edi], 0
mov dword [ebp - 0x20], 0
jbe 0x436db7
lea esi, [edi + 4]
test ebx, ebx
je 0x436d91
mov edi, dword [ebx]
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov eax, 0x2aaaaaab
mov ecx, dword [ebx + 4]
sub ecx, edi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x436d8e
xor ebx, ebx
mov edi, edi
lea eax, [ebx + edi]
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
cmp dword [eax + 0x14], 8
jb 0x436d49
mov eax, dword [eax]
lea ecx, [ebp - 0xc]
push ecx
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [esi + 4]
cmp eax, dword [ebp - 8]
jne 0x436d65
mov eax, dword [esi]
cmp eax, dword [ebp - 0xc]
je 0x436d9f
mov eax, dword [ebp - 0x1c]
add ebx, 0x18
inc dword [ebp - 0x18]
mov ecx, dword [eax + 4]
mov edi, dword [eax]
sub ecx, edi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [ebp - 0x18], eax
jb 0x436d30
mov ebx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x24]
push esi
lea ecx, [ecx + 0xc]
call fcn.00436de0
jmp 0x436da5
mov ebx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
add esi, 0xc
inc eax
mov dword [ebp - 0x20], eax
cmp eax, dword [edi]
jb 0x436d05
push edi
call fcn.0041d0a7
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
xor eax, eax
pop edi
pop esi
pop ebx
call fcn.00401590
mov esp, ebp
pop ebp
ret 4
Function at 0x437300
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x579630]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x30], ecx
xor bl, bl
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x28], eax
push ecx
push 0
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x20], ebx
push ecx
push 0
push 0
push 4
push 6
push eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
call dword [sym.imp.ADVAPI32.dll_GetSecurityInfo]
test eax, eax
jne 0x437461
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
test eax, eax
je 0x437461
push 2
push 0xc
lea ecx, [ebp - 0x10]
mov dword [ebp - 8], 0
push ecx
xorps xmm0, xmm0
push eax
movq qword [ebp - 0x10], xmm0
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
je 0x437461
push esi
mov esi, dword [ebp - 0xc]
add esi, 8
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
je 0x43745d
push 2
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
je 0x437455
mov eax, dword [ebp - 0x10]
push edi
xor edi, edi
test eax, eax
je 0x437429
jmp 0x4373c0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push edi
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x437426
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x437426
cmp byte [ecx], 0
mov eax, ecx
mov dword [ebp - 0x2c], eax
jne 0x437407
lea esi, [ecx + 8]
mov ecx, dword [ebp - 0x30]
call fcn.00407530
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x43741c
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
movzx eax, word [eax + 2]
push eax
push ecx
push 0xffffffffffffffff
push 2
push ebx
call dword [sym.imp.ADVAPI32.dll_AddAce]
test eax, eax
je 0x437426
mov eax, dword [ebp - 0x10]
inc edi
cmp edi, eax
jb 0x4373c0
jmp 0x437429
mov eax, dword [ebp - 0x10]
cmp edi, eax
pop edi
jne 0x437455
push 0
push ebx
push 0
push 0
push 4
push 6
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
mov ecx, dword [ebp - 0x20]
test eax, eax
movzx ecx, cl
mov edx, 1
cmove ecx, edx
mov dword [ebp - 0x20], ecx
mov eax, dword [sym.imp.KERNEL32.dll_LocalFree]
push ebx
call eax
mov ebx, dword [ebp - 0x20]
pop esi
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x43746f
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.00401590
mov esp, ebp
pop ebp
ret
Function at 0x437c70
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push edi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, dword [ebp + 8]
mov ecx, edi
push eax
call fcn.00437de0
test eax, eax
jne 0x437dd8
movdqa xmm0, xmmword [0x550230]
push ebx
mov ebx, dword [sym.imp.USER32.dll_LoadIconW]
push esi
movdqu xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0xc], 0x7f03
xor esi, esi
mov dword [ebp - 8], 0x7f01
mov dword [ebp - 4], 0x7f04
lea esp, [esp]
push dword [ebp + esi*4 - 0x1c]
push 0
call ebx
push eax
mov ecx, edi
call fcn.00437de0
test eax, eax
jne 0x437dd6
inc esi
cmp esi, 7
jb 0x437cc0
movdqa xmm0, xmmword [0x550220]
xor esi, esi
mov ebx, dword [sym.imp.USER32.dll_LoadCursorW]
movdqu xmmword [ebp - 0x38], xmm0
mov dword [ebp - 8], 0x7f84
movdqa xmm0, xmmword [0x550250]
movdqu xmmword [ebp - 0x28], xmm0
mov dword [ebp - 4], 0x7f04
movdqa xmm0, xmmword [0x550240]
movdqu xmmword [ebp - 0x18], xmm0
jmp 0x437d20
push dword [ebp + esi*4 - 0x38]
push 0
call ebx
push eax
mov ecx, edi
call fcn.00437de0
test eax, eax
jne 0x437dd6
inc esi
cmp esi, 0xe
jb 0x437d20
push str._AcroAppTimer
push str.apptimer.exe
call fcn.00437e20
add esp, 8
test eax, eax
je 0x437d60
push eax
mov ecx, edi
call fcn.00437de0
test eax, eax
jne 0x437dd6
push str.SafeNet_Borderless_Single_Sign_On.....
push str.DKAXSvr.exe
call fcn.00437e20
add esp, 8
test eax, eax
je 0x437d82
push eax
mov ecx, edi
call fcn.00437de0
test eax, eax
jne 0x437dd6
push 0
call fcn.00416fc0
add esp, 4
test al, al
je 0x437dd4
push str.PrivateOutputChannelHelperWindow
push str.QTPro.exe
call fcn.00437e20
add esp, 8
test eax, eax
je 0x437db2
push eax
mov ecx, edi
call fcn.00437de0
test eax, eax
jne 0x437dd6
push str.ZinorKnisaPatuach
push str.QTPro.exe
call fcn.00437e20
add esp, 8
test eax, eax
je 0x437dd4
push eax
mov ecx, edi
call fcn.00437de0
test eax, eax
jne 0x437dd6
xor eax, eax
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x438470
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51f30e
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x579630]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.00438450
push dword [ebp + 0xc]
lea ecx, [esi + 0x10]
mov dword [ebp - 4], 0
mov dword [ecx], 0
call fcn.00438520
push dword [ebp + 8]
lea ecx, [esi + 0x14]
mov byte [ebp - 4], 1
mov dword [ecx], 0
call fcn.00438520
push dword [ebp + 0x10]
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 2
mov dword [ecx], 0
call fcn.00438520
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], eax
mov eax, esi
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x439310
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x579630]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0x28], eax
xor bl, bl
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x15], bl
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x24], esi
test eax, eax
je 0x439451
mov dword [eax], 0
test esi, esi
je 0x439451
push 2
push 0xc
lea eax, [ebp - 0x10]
mov dword [ebp - 8], 0
push eax
xorps xmm0, xmm0
push esi
movq qword [ebp - 0x10], xmm0
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
je 0x439451
push edi
mov edi, dword [ebp - 0xc]
add edi, 8
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
je 0x43943d
push 2
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
je 0x439436
mov eax, dword [ebp - 0x10]
xor edi, edi
test eax, eax
je 0x43941a
lea ebx, [ebx]
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x439417
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x439417
cmp byte [ecx], 0
mov eax, ecx
mov dword [ebp - 0x1c], eax
jne 0x4393f5
lea esi, [ecx + 8]
mov ecx, dword [ebp - 0x28]
call fcn.00407530
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x43940a
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax + 2]
push eax
push ecx
push 0xffffffffffffffff
push 2
push ebx
call dword [sym.imp.ADVAPI32.dll_AddAce]
test eax, eax
je 0x439417
mov eax, dword [ebp - 0x10]
inc edi
mov esi, dword [ebp - 0x24]
cmp edi, eax
jb 0x4393b0
jmp 0x43941a
mov eax, dword [ebp - 0x10]
cmp edi, eax
jne 0x439436
mov ecx, dword [ebp - 0x20]
mov al, 1
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401590
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov al, byte [ebp - 0x15]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401590
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.00401590
mov esp, ebp
pop ebp
ret
Function at 0x43e4e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x579630]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [ebp + 8], 0
push ebx
mov ebx, ecx
mov dword [ebp - 0xc], 0
jne 0x43e519
cmp dword [ebx + 8], 0
jne 0x43e54b
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401590
mov esp, ebp
pop ebp
ret 4
push 0
push 0x401730
push 1
push str.NtMapViewOfSection
push 0x534ce0
call fcn.0043aaf0
push 1
push 0x405160
push 1
push str.NtUnmapViewOfSection
push 0x534ce0
mov ecx, ebx
call fcn.0043aaf0
mov eax, dword [ebx]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov eax, dword [eax]
push 1
push 0x2000
push 0x10000
push 0
push eax
mov dword [ebp - 0x60], eax
call edi
mov esi, eax
mov eax, dword [ebx + 8]
shl eax, 6
add eax, 0x50
push eax
mov dword [ebp - 0x64], eax
call fcn.0043e690
add esp, 4
mov ecx, eax
and ecx, 0xfffff000
and eax, 0xfff
add esi, ecx
mov dword [ebp - 0x68], eax
mov ecx, dword [ebp - 0x64]
push 0x40
push 0x1000
add ecx, 0xfff
and ecx, 0xfffff000
push ecx
push esi
push dword [ebp - 0x60]
call edi
mov esi, eax
test esi, esi
jne 0x43e5bc
call fcn.004103b0
mov eax, dword [ebp - 0x68]
lea edi, [eax + esi]
test edi, edi
je 0x43e66e
mov esi, dword [ebp - 0x64]
push 0x4c0
push 0
push 0x57f698
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x58], 0x10
call fcn.004f9050
add esp, 0xc
lea eax, [ebp - 0x5c]
mov ecx, ebx
push eax
push esi
push edi
call fcn.0043e710
test al, al
je 0x43e66e
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x10
lea eax, [ebp - 0x5c]
push eax
push edi
push dword [ebp - 0x60]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x43e66e
cmp dword [ebp - 8], 0x10
jne 0x43e66e
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
push 0x20
push esi
push edi
push dword [ebp - 0x60]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov ecx, dword [ebx]
push 0x4c0
push 0x57f698
push str.g_originals
call fcn.00439a90
pop edi
test eax, eax
pop esi
sete al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401590
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401590
mov esp, ebp
pop ebp
ret 4
Function at 0x43f660
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51f8fb
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x579630]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
push 0
mov dword [ebp - 0x1c], eax
add eax, dword [ebp + 0x14]
push eax
push 0
push 0x8000004
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
lea ecx, [edi + 0x1c]
call fcn.00438520
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x43f852
cmp eax, 0xffffffff
je 0x43f852
push 0
push 0
push 6
lea ecx, [ebp - 0x14]
push ecx
push dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x43f705
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
mov eax, 0x1a
jmp 0x43f85f
push 0
push 0
push 0
push 6
push dword [edi + 0x1c]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x24], eax
test eax, eax
jne 0x43f72f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
mov eax, 0x1b
jmp 0x43f85f
add eax, dword [ebp - 0x1c]
push eax
push dword [ebp + 0x14]
push dword [ebp - 0x18]
call fcn.0043f880
mov eax, dword [ebp - 0x14]
add esp, 0xc
mov ecx, edi
mov dword [0x57f540], eax
push 4
push 0x57f540
push str.g_shared_section
call fcn.00439a90
mov dword [ebp - 0x18], eax
mov dword [0x57f540], 0
test eax, eax
je 0x43f77d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
mov eax, dword [ebp - 0x18]
jmp 0x43f85f
mov eax, dword [ebp - 0x1c]
mov ecx, edi
push 4
push 0x57f628
push str.g_shared_IPC_size
mov dword [0x57f628], eax
call fcn.00439a90
mov dword [ebp - 0x18], eax
mov dword [0x57f628], 0
test eax, eax
jne 0x43f76d
mov eax, dword [ebp + 0x14]
mov ecx, edi
push 4
push 0x57f62c
push str.g_shared_policy_size
mov dword [0x57f62c], eax
call fcn.00439a90
mov dword [ebp - 0x18], eax
mov dword [0x57f62c], 0
test eax, eax
jne 0x43f76d
push 0x20
call fcn.00405f2d
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x43f810
push dword [ebp - 0x20]
xorps xmm0, xmm0
mov ecx, eax
movdqu xmmword [eax], xmm0
movdqu xmmword [eax + 0x10], xmm0
push dword [edi + 0x28]
push dword [edi + 0x20]
push dword [edi + 8]
push dword [edi]
call fcn.0043f8c0
jmp 0x43f812
xor eax, eax
push eax
lea ecx, [edi + 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.0043f990
mov ecx, dword [edi + 0x24]
push 0x20000
push dword [ebp - 0x1c]
push dword [ebp - 0x24]
call fcn.0043f9c0
test al, al
jne 0x43f840
mov eax, 4
jmp 0x43f85f
mov ecx, edi
call fcn.0043fd10
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x43f85f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
mov eax, 0x19
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401590
mov esp, ebp
pop ebp
ret 0x14
Function at 0x440170
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x579630]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.004f9050
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
dec eax
cmp eax, 0x101
ja 0x4401dc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x4401dc
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401590
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
call fcn.00401590
mov esp, ebp
pop ebp
ret
Function at 0x443870
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x579630]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor bl, bl
cmp esi, 0x804
ja 0x4438ad
je case.0x4438a6.1027
lea eax, [esi - 0x403]
cmp eax, 0x2a
ja case.0x4438a6.1032
movzx eax, byte [eax + 0x443900]
jmp dword [eax*4 + 0x4438f8]
cmp esi, 0xc0a
je case.0x4438a6.1027
push 0x400
lea eax, [ebp - 0x404]
push 0
push eax
call fcn.004f9050
add esp, 0xc
lea eax, [ebp - 0x404]
push 0x200
push eax
push 3
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4438e6
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.00401590
mov esp, ebp
pop ebp
ret

Function at 0x4438b5
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x579630]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor bl, bl
cmp esi, 0x804
ja 0x4438ad
je case.0x4438a6.1027
lea eax, [esi - 0x403]
cmp eax, 0x2a
ja case.0x4438a6.1032
movzx eax, byte [eax + 0x443900]
jmp dword [eax*4 + 0x4438f8]
cmp esi, 0xc0a
je case.0x4438a6.1027
push 0x400
lea eax, [ebp - 0x404]
push 0
push eax
call fcn.004f9050
add esp, 0xc
lea eax, [ebp - 0x404]
push 0x200
push eax
push 3
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4438e6
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.00401590
mov esp, ebp
pop ebp
ret
Function at 0x445ed0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51c828
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x579630]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push edi
mov dword [ebp - 0x10], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [edi + 0x28], 0
mov dword [ebp - 4], 0
jne 0x445f97
mov al, byte [ebp + 0x10]
mov ecx, dword [ebp + 8]
mov byte [edi + 0x2a], al
mov eax, dword [ebp + 0xc]
mov byte [edi + 0x28], 1
mov dword [edi + 0x18], ecx
mov dword [edi + 0x1c], eax
mov dword [edi + 0x34], 0
test ecx, ecx
je 0x445f97
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
push 0
call esi
push 0
push 0
push 0
push 0
mov dword [edi + 0x2c], eax
call esi
cmp dword [edi + 0x2c], 0
mov dword [edi + 0x30], eax
je 0x445f97
test eax, eax
je 0x445f97
cmp byte [edi + 0x2a], 0
lea esi, [edi + 0x20]
push esi
push 0
push edi
mov ecx, 0x4d9f70
mov dword [esi], 0
mov eax, 0x4460c0
cmovne eax, ecx
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [esi], 0
mov dword [edi + 0x24], eax
je 0x445f97
test eax, eax
je 0x445f97
mov byte [edi + 0x29], 1
mov bl, byte [edi + 0x29]
push edi
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x446560
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52018e
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x579630]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.00405fb0
mov dword [edi], eax
lea ecx, [edi + 0x10]
mov dword [ebp - 4], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
call fcn.00405fb0
mov dword [edi + 0x10], eax
mov dword [edi + 0x30], 0xf
mov dword [edi + 0x2c], 0
mov byte [edi + 0x1c], 0
lea eax, [edi + 0x38]
mov byte [ebp - 4], 2
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [edi + 8], 0
mov eax, edi
mov dword [edi + 0xc], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x18], 0
mov byte [edi + 0x50], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret