joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f47e4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4f4842
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xfe
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
lea edx, [ebp - 4]
lea eax, [ebp - 0x104]
call fcn.00429574
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00424234
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f4849
lea eax, [ebp - 4]
call fcn.004241e0
ret

Function at 0x4f4850
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00424690
mov eax, dword [ebp - 8]
call fcn.00424690
xor eax, eax
push ebp
push 0x4f491a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004291c8
test al, al
jne 0x4f48ff
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4a2c30]
call fcn.004a3118
mov ebx, eax
push 0xffff
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x43b944]
call fcn.00440648
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4f48f8
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004a3240
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f48ff
mov eax, dword [ebp - 0x10]
call fcn.004232ec
xor ebx, ebx
mov eax, ebx
call fcn.004232ec
push 1
mov eax, dword [ebp - 8]
call fcn.004246a0
push eax
call sub.KERNEL32.DLL_WinExec
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f4921
lea eax, [ebp - 8]
mov edx, 2
call fcn.00424204
ret
Function at 0x401e3c
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
mov edx, 1
cmp dword [esi + 0x1c], edx
jbe 0x401f47
push ebx
push edi
lea eax, [esi + 0x32]
xor ebx, ebx
xor ecx, ecx
mov bl, byte [eax - 1]
mov cl, byte [eax + 1]
add eax, 0x10
mov edi, dword [ebx*4 + 0x411630]
mov ecx, dword [ecx*4 + 0x411e30]
xor ebx, ebx
xor ecx, edi
mov bl, byte [eax - 0x10]
mov edi, dword [ebx*4 + 0x411a30]
xor ebx, ebx
mov bl, byte [eax - 0x12]
xor ecx, edi
mov edi, dword [ebx*4 + 0x411230]
xor ebx, ebx
xor ecx, edi
mov dword [eax - 0x12], ecx
mov bl, byte [eax - 0xc]
xor ecx, ecx
mov cl, byte [eax - 0xb]
mov edi, dword [ebx*4 + 0x411a30]
xor ebx, ebx
mov ecx, dword [ecx*4 + 0x411e30]
mov bl, byte [eax - 0xd]
xor ecx, edi
mov edi, dword [ebx*4 + 0x411630]
xor ebx, ebx
mov bl, byte [eax - 0xe]
xor ecx, edi
mov edi, dword [ebx*4 + 0x411230]
xor ebx, ebx
xor ecx, edi
mov dword [eax - 0xe], ecx
mov bl, byte [eax - 8]
xor ecx, ecx
mov cl, byte [eax - 7]
mov edi, dword [ebx*4 + 0x411a30]
xor ebx, ebx
mov ecx, dword [ecx*4 + 0x411e30]
mov bl, byte [eax - 9]
xor ecx, edi
mov edi, dword [ebx*4 + 0x411630]
xor ebx, ebx
mov bl, byte [eax - 0xa]
xor ecx, edi
mov edi, dword [ebx*4 + 0x411230]
xor ebx, ebx
xor ecx, edi
mov dword [eax - 0xa], ecx
mov bl, byte [eax - 4]
xor ecx, ecx
mov cl, byte [eax - 3]
mov edi, dword [ebx*4 + 0x411a30]
xor ebx, ebx
mov ecx, dword [ecx*4 + 0x411e30]
mov bl, byte [eax - 5]
xor ecx, edi
mov edi, dword [ebx*4 + 0x411630]
xor ebx, ebx
mov bl, byte [eax - 6]
xor ecx, edi
mov edi, dword [ebx*4 + 0x411230]
xor ecx, edi
inc edx
mov dword [eax - 6], ecx
mov ecx, dword [esi + 0x1c]
cmp edx, ecx
jb 0x401e52
pop edi
pop ebx
pop esi
ret
Function at 0x402c40
Capabilities:
Accept command line arguments
Encode data using xor

Disassembly:
sub esp, 8
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
xor ecx, ecx
mov dl, byte [eax]
inc eax
test dl, dl
mov byte [esp + 4], dl
je 0x402c76
mov edx, ecx
shr edx, 0x16
shl ecx, 0xa
or edx, ecx
mov ecx, dword [esp + 4]
xor edx, 0x5e58b
and ecx, 0xff
sub edx, ecx
mov ecx, edx
jmp 0x402c4b
cmp ecx, 0x1d0f0487
je 0x402dc1
cmp ecx, 0xaf667bfc
je 0x402dc1
cmp ecx, 0xa7def8a1
je 0x402dc1
cmp ecx, 0xa7315d78
je 0x402dc1
cmp ecx, 0x7ae91e19
je 0x402dc1
cmp ecx, 0x9194ac6a
je 0x402dc1
cmp ecx, 0x8caf47f
je 0x402dc1
test ecx, ecx
je 0x402dc1
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0xce
je 0x402dc1
mov eax, dword [0x46f040]
mov edx, dword [esp + 4]
mov cl, byte [edx + 0x46c9b0]
mov byte [esp + 3], cl
mov dl, byte [esp + 3]
mov byte [esp + 3], dl
mov cl, byte [0x4c9814]
mov dl, byte [esp + 3]
sub dl, cl
mov byte [esp + 3], dl
mov cl, byte [esp + 4]
mov dl, byte [esp + 3]
add cl, dl
mov byte [esp + 3], cl
mov cl, byte [esp + 3]
add cl, al
mov byte [esp + 3], cl
mov dl, byte [esp + 3]
xor dl, 2
mov byte [esp + 3], dl
mov cl, byte [esp + 3]
xor cl, al
mov byte [esp + 3], cl
mov ecx, dword [esp + 4]
add eax, ecx
mov edx, dword [esp + 4]
sub eax, edx
mov dx, word [0x4c9814]
sub edx, eax
mov word [0x4c9814], dx
mov ecx, dword [esp + 4]
sub eax, ecx
mov cx, word [0x4c9814]
mov edx, dword [esp + 4]
sub ecx, edx
mov word [0x4c9814], cx
mov cx, word [0x4c9814]
and ecx, 0xffff
sub eax, ecx
mov dx, word [0x4c9814]
and edx, 0xffff
xor eax, edx
mov cl, byte [esp + 3]
mov edx, dword [esp + 4]
mov byte [edx + 0x46f044], cl
mov ecx, dword [esp + 4]
inc ecx
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
cmp ecx, 0xce
jne 0x402cee
mov dword [0x46f040], eax
mov dword [0x46f038], 0x46f114
mov dword [esp + 4], 0x46f0dc
push 0x46f114
push 0x4122b0
mov edx, dword [esp + 0xc]
call edx
add esp, 0x10
ret

Function at 0x402dec
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46ca82
push 0x40a318
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
mov word [0x4c9814], 0x5b9d
mov esi, dword [ebp + 0x10]
push esi
call fcn.00402b3c
add esp, 4
push 0x46f03c
push 0x40
mov ecx, dword [0x4122a8]
mov eax, dword [str.cw]
sub ecx, eax
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
mov edx, dword [ebp + 0xc]
push edx
push esi
call fcn.00402c40
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00402de8
add esp, 0x10
jmp 0x402e6f
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4035d8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
lea eax, [ebp - 0x208]
push 0x104
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
test eax, eax
jne 0x403600
mov eax, 0x8000ffff
leave
ret
cmp eax, 3
jne 0x40360d
and word [ebp - 0x204], 0
lea eax, [ebp - 0x208]
push 0x5c
push eax
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
pop ecx
test eax, eax
pop ecx
je 0x403626
and word [eax], 0
push dword [0x46f014]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
pop ecx
lea eax, [ebp - 0x208]
pop ecx
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
cmp eax, 0xffffffff
jne fcn.00404100
mov eax, 0x80070002
leave
ret

Function at 0x4038d8
Capabilities:
Accept command line arguments

Disassembly:
push esi
mov esi, ecx
and dword [esi + 8], 0
lea eax, [esi + 0xc]
push eax
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov ecx, 0x46caa8
call fcn.00405424
and dword [esi + 0x24], 0
and byte [esi + 0x28], 0
mov eax, esi
pop esi
ret

Function at 0x403900
Capabilities:
Accept command line arguments

Disassembly:
push esi
mov esi, ecx
and dword [esi + 8], 0
lea eax, [esi + 0xc]
push eax
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov ecx, 0x46cad4
call fcn.00405424
and dword [esi + 0x24], 0
and byte [esi + 0x28], 0
mov eax, esi
pop esi
ret

Function at 0x403cb0
Capabilities:
Accept command line arguments

Disassembly:
mov dword [ecx], 0x4050dc
mov dword [ecx + 4], 1
call fcn.00404a80
push 0x46caf0
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
mov ecx, 0x46cac0
jmp 0x405444

Function at 0x4041d8
Capabilities:
Accept command line arguments

Disassembly:
mov dword [ecx], fcn.00403b46
mov dword [ecx + 4], 1
call fcn.0040525c
push 0x46caf0
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
mov ecx, 0x46cad4
jmp 0x405444
push esi
push edi
mov edi, 0x4cbf68
mov esi, ecx
push edi
call dword [pe_dos_header]
dec dword [esi + 0x10]
jne 0x40546a
mov eax, dword [esi + 0xc]
test eax, eax
je 0x405466
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [esi + 0xc], 0
push edi
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
pop edi
pop esi
ret
Function at 0x404bf4
Capabilities:
Accept command line arguments
Get common file path
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa08
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.004057d0
mov esi, dword [sym.imp.KERNEL32.DLL_GetUserDefaultLangID]
mov ebx, eax
test ebx, ebx
jne 0x404cb1
cmp edi, 0x80040200
jb 0x404c7b
cmp edi, 0x80040502
ja 0x404c7b
lea eax, [ebp - 0x208]
push 0x104
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
lea eax, [ebp - 0x208]
push 0x5c
push eax
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
pop ecx
test eax, eax
pop ecx
je 0x404c54
and word [eax], 0
lea eax, [ebp - 0x208]
push 0x40483b
push eax
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
pop ecx
lea eax, [ebp - 0x208]
pop ecx
push 0
push edi
push eax
call fcn.00404dd4
test eax, eax
jne 0x404cd3
call esi
push eax
push edi
push 0
call fcn.00404dd4
test eax, eax
jne 0x404cd3
cmp edi, 0x800c0002
jl 0x404cac
cmp edi, 0x800c0017
jg 0x404cac
call esi
push eax
push edi
push 0x405692
call fcn.00404dd4
test eax, eax
jne 0x404cd3
mov ebx, 0x2789
call esi
push eax
lea eax, [ebp - 0xa08]
push 0x400
push eax
push ebx
call fcn.00404a2f
lea eax, [ebp - 0xa08]
push eax
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x404e4c
Capabilities:
Accept command line arguments

Disassembly:
test bl, 0x20
je 0x404e53
or al, 4
push dword [ebp - 4]
push dword [ebp - 8]
push eax
push ecx
mov ecx, dword [edi + 0xc]
push esi
call fcn.00404ff0
push esi
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4051f0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
push edi
push dword [ebp + 0xc]
mov edi, dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
and dword [esi + 4], 0
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x14]
mov dword [esi], fcn.004035c7
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x18], eax
call edi
push dword [ebp + 0x10]
mov dword [esi + 0xc], eax
call edi
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x18]
push eax
mov ecx, dword [eax]
call dword [ecx + 4]
mov eax, esi
pop edi
pop esi
pop ebp
ret 0x14

Function at 0x40539c
Capabilities:
Accept command line arguments

Disassembly:
push 2
jmp 0x4053a2
pop edx
cmp edx, ebx
je 0x4053b5
mov eax, dword [edi]
push ebx
add esi, 8
push edx
push esi
push edi
call dword [eax + 0xc]
jmp fcn.0040541b
push edi
lea ecx, [ebp - 4]
mov dword [ebp - 4], ebx
call fcn.0040532c
mov edi, eax
cmp edi, ebx
jge 0x4053cc
push dword [ebp - 4]
jmp 0x4053f1
mov eax, dword [ebp - 4]
cmp word [ebp - 8], 8
mov word [esi], 8
mov dword [ebp - 4], ebx
mov dword [esi + 8], eax
je 0x4053ee
push ebx
mov ecx, esi
push dword [ebp - 8]
call fcn.00405380
mov edi, eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov eax, edi
jmp fcn.0040541b
Function at 0x405474
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
and dword [ebx], 0
mov esi, ecx
push 0x4cbf68
mov edi, 0x80004005
call dword [pe_dos_header]
cmp dword [esi + 0xc], 0
jne 0x4054dc
lea eax, [ebp + 0xc]
push eax
mov ax, word [esi + 0xa]
push dword [ebp + 8]
push eax
mov ax, word [esi + 8]
push eax
push dword [esi + 4]
call dword [pe_dos_header]
mov edi, eax
test edi, edi
jl 0x4054dc
mov eax, dword [ebp + 0xc]
lea edx, [ebp + 8]
push edx
push dword [esi]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov edi, eax
test edi, edi
jl fcn.004054d3
mov eax, dword [ebp + 8]
mov dword [esi + 0xc], eax

Function at 0x4054d3
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esi + 0xc]
mov dword [ebx], eax
mov esi, dword [esi + 0xc]
test esi, esi
je 0x4054f0
mov eax, dword [esi]
push esi
call dword [eax + 4]
xor edi, edi
push 0x4cbf68
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x406934
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x46cb08]
jne 0x406940
ret
jmp 0x406942
push ebp
lea ebp, [esp - 0x2a8]
sub esp, 0x328
mov eax, dword [0x46cb08]
push edi
mov dword [ebp + 0x2a4], eax
xor eax, eax
push 0x13
pop ecx
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
mov ecx, 0xb2
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x2ac]
mov dword [ebp - 0x74], eax
mov dword [ebp + 0x90], eax
lea eax, [ebp + 0x2ac]
mov dword [ebp - 0x80], 0xc0000409
mov dword [ebp - 0x28], 0x10001
mov dword [ebp + 0x9c], eax
push ss
pop dword [ebp + 0xa0]
lea eax, [ebp - 0x80]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
push 0
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.DLL_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.DLL_UnhandledExceptionFilter]
push 0x502
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
mov ecx, dword [ebp + 0x2a4]
call fcn.00406934
pop edi
add ebp, 0x2a8
leave
ret

Function at 0x406fd4
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
push ecx
mov ebx, 0x411130
mov ecx, dword [ebp + 8]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], eax
mov dword [ebx + 0xc], ebp
pop ecx
pop ebx
ret 4

Function at 0x4077b0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x4077c4
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x4077bf
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
mov eax, ecx
pop ebp
ret
Function at 0x4077e0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x40781f
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x407815
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x407821
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x407805
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407a1c
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x254
call fcn.0040a2b4
mov esi, eax
test esi, esi
pop ecx
jne 0x407a3d
mov eax, 0x8007000e
jmp 0x407b2c
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_lstrcpyW]
push edi
push dword [ebp + 0xc]
push esi
call ebx
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
and eax, 1
mov dword [esi + 0x248], eax
lea eax, [edi + 8]
push eax
lea eax, [esi + 0x42]
push eax
call ebx
mov eax, dword [edi + 0x4c]
cmp eax, 3
mov dword [esi + 0x250], eax
jne 0x407a81
lea eax, [edi + 0xb4]
push eax
lea eax, [esi + 0x140]
push eax
call ebx
lea eax, [edi + 0x1cc8]
push eax
lea eax, [esi + 0x84]
push eax
call ebx
lea eax, [edi + 0x1e80]
push eax
lea eax, [esi + 0xc6]
push eax
call ebx
cmp dword [esi + 0x250], 2
jne 0x407ab2
mov eax, dword [edi + 0xb4]
jmp 0x407ab5
or eax, 0xffffffff
mov dword [esi + 0x24c], eax
mov eax, dword [edi + 4]
mov edi, dword [ebp + 8]
add edi, 0x28
mov ecx, edi
mov dword [esi + 0x244], eax
xor ebx, ebx
call fcn.0040a140
test eax, eax
mov dword [ebp + 0xc], eax
jle 0x407af6
push ebx
mov ecx, edi
call fcn.0040a144
mov eax, dword [eax]
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
jg 0x407b16
inc ebx
cmp ebx, dword [ebp + 0xc]
jl 0x407ada
push esi
mov ecx, edi
call fcn.00405b3e
test eax, eax
jne 0x407b23
push esi
call sub.KERNEL32.DLL_GetCommandLineA
mov eax, dword [ebp + 0x14]
and dword [eax], 0
pop ecx
mov eax, 0x8007000e
jmp 0x407b2a
push 1
push esi
push ebx
mov ecx, edi
call fcn.0040a0b0
jmp 0x407afe
mov eax, dword [ebp + 0x14]
mov dword [eax], esi
xor eax, eax
pop edi
pop ebx
pop esi
pop ebp
ret 0x10
Function at 0x4087f8
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
lea ebx, [ecx + 0x10]
mov ecx, ebx
call fcn.0040a140
test eax, eax
jle 0x408897
push esi
push edi
push dword [ebp - 4]
mov ecx, ebx
call fcn.0040a144
mov esi, dword [eax]
test esi, esi
je 0x408886
mov eax, dword [esi + 0xdcc]
test eax, eax
je 0x408838
push eax
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
add esi, 0xdf8
mov ecx, esi
xor edi, edi
call fcn.0040a140
test eax, eax
jle 0x408874
push edi
mov ecx, esi
call fcn.0040a144
cmp dword [eax], 0
je 0x408868
push edi
mov ecx, esi
call fcn.0040a144
push dword [eax]
call sub.KERNEL32.DLL_GetCommandLineA
pop ecx
mov ecx, esi
inc edi
call fcn.0040a140
cmp edi, eax
jl 0x40884b
push dword [ebp - 4]
mov ecx, ebx
call fcn.0040a144
push dword [eax]
call sub.KERNEL32.DLL_GetCommandLineA
pop ecx
inc dword [ebp - 4]
mov ecx, ebx
call fcn.0040a140
cmp dword [ebp - 4], eax
jl 0x408817
pop edi
pop esi
mov ecx, ebx
call fcn.0040394c
pop ebx
leave
ret

Function at 0x40908c
Capabilities:
Get user security identifier

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
push edi
lea eax, [ebp - 0x18]
push eax
xor edi, edi
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp + 8]
mov dword [ebp - 0xc], edi
push edi
mov dword [ebp - 8], edi
call ebx
test eax, eax
jne 0x4090ca
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp eax, 0x7a
mov dword [ebp - 4], eax
jne 0x40913b
push esi
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.DLL_LocalAlloc]
push edi
mov dword [ebp - 4], edi
call esi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
lea eax, [eax + eax + 2]
push eax
push edi
call esi
mov esi, dword [ebp - 0x10]
cmp esi, edi
mov dword [ebp - 0x14], eax
je 0x40911a
cmp eax, edi
je 0x40911a
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 8]
push ecx
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 8]
push edi
call ebx
test eax, eax
je 0x40911a
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov dword [ebp - 0x10], edi
mov esi, edi
jmp 0x409123
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
mov dword [ebp - 4], eax
cmp dword [ebp - 0x14], edi
mov ebx, dword [sym.imp.KERNEL32.DLL_LocalFree]
je 0x409133
push dword [ebp - 0x14]
call ebx
cmp esi, edi
je 0x40913a
push esi
call ebx
pop esi
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret 8
Function at 0x409144
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
xor ebx, ebx
push eax
push dword [ebp + 0xc]
mov edi, ecx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ADVAPI32.dll_GetExplicitEntriesFromAclW]
mov esi, eax
cmp esi, ebx
jne 0x409255
cmp dword [ebp - 8], ebx
jne 0x40918a
push 2
pop esi
jmp 0x409255
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
mov ecx, edi
call fcn.0040908c
mov esi, eax
cmp esi, ebx
jne 0x409239
mov eax, dword [ebp - 8]
shl eax, 5
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_LocalAlloc]
cmp eax, ebx
mov dword [ebp - 0x10], eax
jne 0x4091bf
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
jmp 0x409237
cmp dword [ebp - 8], ebx
mov dword [ebp + 0xc], ebx
jbe 0x409227
xor esi, esi
lea edi, [eax + 8]
mov eax, dword [ebp - 4]
add eax, esi
cmp dword [eax + 0x14], ebx
jne 0x409219
push dword [eax + 0x1c]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x409219
mov eax, dword [ebp - 4]
mov eax, dword [esi + eax]
mov dword [edi - 8], eax
mov eax, dword [ebp - 4]
mov eax, dword [esi + eax + 4]
mov dword [edi - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [esi + eax + 8]
mov dword [edi], eax
mov eax, dword [ebp - 4]
push dword [esi + eax + 0x1c]
lea eax, [edi + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_BuildTrusteeWithSidW]
inc dword [ebp - 0x14]
add edi, 0x20
inc dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
add esi, 0x20
cmp eax, dword [ebp - 8]
jb 0x4091cc
push dword [ebp + 0x10]
push ebx
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
mov esi, eax
cmp dword [ebp - 0xc], ebx
je 0x409247
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_LocalFree]
cmp dword [ebp - 0x10], ebx
je 0x409255
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.DLL_LocalFree]
cmp dword [ebp - 4], ebx
je 0x409263
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_LocalFree]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
Function at 0x40a158
Capabilities:
Accept command line arguments

Disassembly:
push 0x4cbfe0
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
lea eax, [ebp - 0x54]
push eax
call dword [esi + 0x908]
cmp dword [ebp - 0x34], 0x8876021c
je 0x406da0
cmp dword [ebp - 0x34], 0x8876021d
jne 0x406de1
push 0xffffffffffffffff
lea eax, [esi + 0x824]
push eax
call sub.KERNEL32.DLL_VirtualProtect
mov eax, dword [0x46ca90]
mov dword [ebp - 0x24], eax
test eax, eax
je 0x406de1
mov dword [eax + 8], 1
mov eax, dword [eax]
jmp 0x406dcf
push 0x4cbfe0
call dword [pe_dos_header]
cmp dword [ebp - 0x34], 0x8876021d
je 0x406d95
cmp dword [ebp - 0x34], 0x887601c2
jne 0x406e6a
lea eax, [esi + 4]
mov dword [ebp - 0x58], eax
lea ecx, [ebp - 0x1c]
push ecx
push eax
call sub.KERNEL32.DLL_VirtualProtect
test eax, eax
jne 0x406e1b
mov dword [ebp - 0x28], 0xfffffff0
jmp 0x406e6a
push esi
call fcn.00405739
test eax, eax
jne 0x406e4b
push esi
call fcn.00406d10
push esi
call fcn.00406c81
test eax, eax
je 0x406e4b
push 0xffffffffffffffff
lea eax, [esi + 0x824]
push eax
call sub.KERNEL32.DLL_VirtualProtect
test eax, eax
jne 0x406d95
mov dword [esi], 1
mov dword [ebp - 0x28], 0xfffffffd
push esi
call fcn.00406d10
test eax, eax
je 0x406e6a
push dword [ebp - 0x58]
call fcn.004036d3
cmp dword [ebp - 0x34], 0
jne 0x406e96
and word [edi + 0x2c], 0
mov eax, dword [edi + 0x20]
imul eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x38]
sub ecx, eax
mov eax, dword [edi + 0x24]
shr eax, 3
imul eax, ebx
sub ecx, eax
mov dword [edi + 0x28], ecx
mov dword [ebp - 0x28], 1
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x28]
jmp 0x406e9f
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 0x14
cmp ecx, dword [0x46cb5c]
jne 0x406d95
test ecx, 0xffff0000
jne 0x406d95
ret