joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404a88
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
mov eax, ebx
call fcn.00401a50
cmp dword [ebp - 0xc], 0
je 0x404b2e
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x14], eax
push ebp
call fcn.00404a4c
pop ecx
test al, al
je 0x404b2e
cmp dword [ebp - 4], 1
je 0x404acb
cmp dword [ebp - 4], 2
jne 0x404b2e
mov eax, dword [ebp - 8]
call fcn.00401154
mov dword [ebp - 0x14], eax
push ebp
call fcn.00404a4c
pop ecx
test al, al
je 0x404b26
cmp dword [ebp - 4], 2
jne 0x404b1c
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov edi, eax
mov eax, edi
call fcn.00401154
mov esi, eax
push edi
push esi
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov eax, ebx
mov edx, esi
call fcn.00401b94
mov eax, esi
call fcn.0040116c
jmp 0x404b26
mov eax, ebx
mov edx, dword [ebp - 0x14]
call fcn.00401b94
mov eax, dword [ebp - 0x14]
call fcn.0040116c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x404bbc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov esi, edx
mov ebx, eax
test ebx, ebx
je 0x404be9
lea eax, [esp + 4]
push eax
push 0
lea eax, [esp + 8]
push eax
push 0
mov eax, esi
call fcn.00401dd4
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x404bed
xor eax, eax
jmp 0x404bef
mov al, 1
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x404c2c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x404cec
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 4]
call fcn.0040b478
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
push edi
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
jne 0x404cd6
cmp dword [ebp - 8], 0
jbe 0x404cd4
mov eax, dword [ebp - 8]
inc eax
call fcn.00401154
mov ebx, eax
xor esi, esi
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 0xc], eax
jmp 0x404cb2
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00401b94
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0040b468
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 0xc], eax
inc esi
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
push edi
call sub.advapi32.dll_RegEnumKeyExA
cmp eax, 0x103
jne 0x404c95
mov eax, ebx
call fcn.0040116c
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404cf3
lea eax, [ebp - 0x10]
call fcn.00401a50
ret
Function at 0x405528
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffffc
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edi, dword [ebp + 8]
cmp byte [ebx + 0x18], 0
jne 0x4055a4
mov byte [ebp - 0x1004], 0
mov eax, dword [ebx + 0x19]
call fcn.00401dd4
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
mov eax, esi
call fcn.00401dd4
push eax
mov eax, dword [ebp - 4]
call fcn.00401dd4
push eax
mov eax, dword [ebx + 0x1d]
call fcn.00401dd4
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
test eax, eax
je 0x40559b
mov eax, edi
lea edx, [ebp - 0x1004]
mov ecx, 0x1000
call fcn.00401bc4
jmp 0x4055d5
mov eax, edi
call fcn.00401a50
jmp 0x4055d5
mov eax, edi
mov edx, esi
call fcn.00401aa4
mov eax, dword [ebx + 0x19]
call fcn.00401dd4
push eax
mov eax, esi
call fcn.00401dd4
push eax
mov eax, dword [ebp - 4]
call fcn.00401dd4
push eax
mov eax, dword [ebx + 0x1d]
call fcn.00401dd4
push eax
call sub.kernel32.dll_WritePrivateProfileStringA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x409258
Capabilities:
Get file attributes

Disassembly:
call fcn.00403260
push eax
call sub.kernel32.dll_GetFileAttributesA
inc eax
je 0x40926c
dec eax
and al, 0x10
sete al
ret

Function at 0x4092dc
Capabilities:
Get file attributes

Disassembly:
push ebx
push eax
push 0x8001
call sub.kernel32.dll_SetErrorMode
xchg ebx, eax
call sub.kernel32.dll_GetFileAttributesA
inc eax
je 0x4092f7
dec eax
and al, 0x10
setne al
xchg ebx, eax
push eax
call sub.kernel32.dll_SetErrorMode
xchg ebx, eax
pop ebx
ret

Function at 0x40a83c
Capabilities:
Hide graphical window

Disassembly:
and byte [eax + 0x37], 0xef
test dl, dl
je 0x40a848
or byte [eax + 0x37], 0x10
mov byte [eax + 0x52], dl
mov ecx, dword [eax + 0x28]
jecxz 0x40a864
push eax
je 0x40a865
call dword [0x418110]
pop eax
push 5
push dword [eax + 0x28]
call sub.user32.dll_ShowWindow
ret
mov byte [eax + 0x177], dl
push 0
push ecx
call sub.user32.dll_ShowWindow
pop eax
call dword [0x418110]
ret

Function at 0x40bd2c
Capabilities:
Capture screenshot

Disassembly:
push ebx
mov ebx, eax
call fcn.0040bc28
je 0x40bd5e
mov eax, ebx
push edx
call fcn.00407908
pop edx
cmp eax, edx
je 0x40bd5e
test edx, edx
mov eax, ebx
jne 0x40bd50
pop ebx
inc edx
jmp fcn.004078f8
mov byte [ebx + 0x49], dl
xor edx, edx
call fcn.004078f8
xchg ebx, eax
cmp eax, 0
pop ebx
jne fcn.0040bd7c
ret
Function at 0x40cbdc
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov word [ebp - 2], cx
mov edi, edx
mov esi, eax
push 0
push 0x8000080
push 3
push 0
push 1
push 0xc0000000
push esi
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40cc10
xor eax, eax
jmp 0x40cc61
lea eax, [ebp - 0xc]
push eax
mov ax, word [ebp - 2]
push eax
push edi
call sub.kernel32.dll_DosDateTimeToFileTime
test eax, eax
je 0x40cc44
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
call sub.kernel32.dll_LocalFileTimeToFileTime
test eax, eax
je 0x40cc44
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.kernel32.dll_SetFileTime
push ebx
call sub.kernel32.dll_CloseHandle
mov ax, word [ebp + 8]
and ax, 0x27
movzx eax, ax
push eax
push esi
call sub.kernel32.dll_SetFileAttributesA
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40dee0
Capabilities:
Identify system language via api

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], eax
mov edx, dword [0x4186a0]
mov edx, dword [edx]
mov eax, dword [esp]
mov eax, dword [eax + 0x18]
call fcn.0040a7e0
mov ebp, 0xff
mov eax, 0x1a
call fcn.00415474
mov esi, eax
dec esi
test esi, esi
jl 0x40df52
inc esi
xor ebx, ebx
mov edi, ebx
shl edi, 2
mov eax, dword [0x418638]
mov eax, dword [eax]
mov edx, dword [eax + edi*4]
mov eax, dword [esp]
mov eax, dword [eax + 0x24]
call fcn.0040b0d0
mov eax, dword [0x418638]
mov eax, dword [eax]
mov eax, dword [eax + edi*4 + 4]
call fcn.0040901c
push eax
call sub.kernel32.dll_GetUserDefaultLangID
movzx eax, ax
pop edx
cmp edx, eax
jne 0x40df4e
mov ebp, ebx
inc ebx
dec esi
jne 0x40df14
cmp ebp, 0xff
jne 0x40df92
mov eax, 0x1a
call fcn.00415474
mov esi, eax
dec esi
test esi, esi
jl 0x40df92
inc esi
xor ebx, ebx
mov eax, ebx
shl eax, 2
mov edx, dword [0x418638]
mov edx, dword [edx]
mov eax, dword [edx + eax*4]
mov edx, 0x40dfb8
call fcn.00401d20
jne 0x40df8e
mov ebp, ebx
jmp 0x40df92
inc ebx
dec esi
jne 0x40df6e
cmp ebp, 0xff
jne 0x40df9c
xor ebp, ebp
mov eax, dword [esp]
mov eax, dword [eax + 0x24]
mov edx, ebp
call fcn.0040b374
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x410210
Capabilities:
Get hostname
Get session user name

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, edx
mov dword [esp], pe_nt_image_headers32
test al, al
je 0x410231
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameA
jmp 0x41023c
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
mov eax, ebx
lea edx, [esp + 4]
mov ecx, pe_nt_image_headers32
call fcn.00401bc4
add esp, 0x104
pop ebx
ret

Function at 0x410254
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffc10
mov ebx, edx
push esp
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, dword [esp]
push eax
call sub.ole32.dll_CoTaskMemFree
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x3e9
call fcn.00401bc4
add esp, 0x3f0
pop ebx
ret
Function at 0x411d04
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x411ea5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x41864c]
mov eax, dword [eax]
mov edx, dword [eax + 0xe4]
mov eax, dword [0x4197c0]
mov eax, dword [eax + 0x5c]
call fcn.0040a7e0
mov eax, dword [0x41868c]
mov eax, dword [eax]
call fcn.0040ad48
mov eax, 0x28
call fcn.00415474
mov edi, eax
dec edi
test edi, edi
jl 0x411e82
inc edi
xor ebx, ebx
mov esi, ebx
add esi, esi
lea esi, [esi + esi*2]
mov eax, dword [0x418648]
mov eax, dword [eax]
mov eax, dword [eax + esi*4 + 0x10]
call fcn.0040901c
xor edx, edx
mov dl, byte [ebp - 1]
cmp eax, edx
jne 0x411e7a
mov eax, dword [0x418648]
mov eax, dword [eax]
mov eax, dword [eax + esi*4 + 4]
lea ecx, [ebp - 8]
xor edx, edx
call fcn.004107c8
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x3c
call fcn.00401338
mov dword [ebp - 0x44], 0x3c
xor eax, eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
call fcn.00401dd4
mov dword [ebp - 0x34], eax
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 8]
call fcn.004040bc
mov eax, dword [ebp - 0x48]
call fcn.00401dd4
mov dword [ebp - 0x2c], eax
mov eax, dword [0x418648]
mov eax, dword [eax]
mov eax, dword [eax + esi*4 + 8]
lea ecx, [ebp - 0x4c]
xor edx, edx
call fcn.004107c8
mov eax, dword [ebp - 0x4c]
call fcn.00401dd4
mov dword [ebp - 0x30], eax
mov eax, dword [0x418648]
mov eax, dword [eax]
mov eax, dword [eax + esi*4 + 0xc]
call fcn.0040901c
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x40], 0x400
mov eax, dword [0x418648]
mov eax, dword [eax]
mov eax, dword [eax + esi*4 + 0x14]
call fcn.0040901c
dec eax
jne 0x411e37
mov eax, dword [ebp - 0x40]
or eax, 0x40
or eax, 0x200
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x44]
push eax
call sub.shell32.dll_ShellExecuteExA
jmp 0x411e4e
mov eax, dword [0x41868c]
mov eax, dword [eax]
call fcn.0040ad48
push 0x32
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x411e42
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
push 0
push 0x2800
mov eax, dword [0x4197c0]
call fcn.00410990
inc ebx
dec edi
jne 0x411d67
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x411eac
lea eax, [ebp - 0x4c]
mov edx, 2
call fcn.00401a74
lea eax, [ebp - 8]
call fcn.00401a50
ret
Function at 0x41237c
Capabilities:
Delete file

Disassembly:
push ebx
add esp, 0xfffffff0
mov ebx, eax
cmp dword [0x4197e0], 0
jle 0x41239b
mov eax, dword [0x4197ec]
call fcn.00401dd4
push eax
call sub.kernel32.dll_DeleteFileA
mov eax, ebx
call fcn.004094a8
mov dword [esp], eax
mov eax, dword [esp]
mov edx, 0x412450
call fcn.004052fc
mov eax, 0x75
call fcn.00415474
cmp eax, dword [0x4197e0]
jne 0x4123d9
mov eax, 0x76
call fcn.00415474
cdq
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
jmp 0x4123ec
mov eax, 0x5f
call fcn.00415474
cdq
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
cmp dword [0x4197e8], 1
jne 0x41241b
mov eax, 0x5f
call fcn.00415474
mov edx, eax
imul edx, dword [0x4197e0]
mov eax, dword [0x418678]
add edx, dword [eax]
mov eax, dword [0x4197e4]
xor ecx, ecx
call fcn.00409384
push dword [esp + 0xc]
push dword [esp + 0xc]
mov eax, dword [esp + 8]
call fcn.00412178
mov eax, dword [esp]
call fcn.00408680
mov eax, 0x4197ec
mov edx, ebx
call fcn.00401aa4
add esp, 0x10
pop ebx
ret
Function at 0x4126b8
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov esi, edx
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], ecx
mov esi, eax
xor eax, eax
push ebp
push 0x412876
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x1d], 1
lea eax, [esi + esi*2]
mov edx, dword [0x4186a8]
mov edx, dword [edx]
mov eax, dword [edx + eax*4]
lea ecx, [ebp - 0x24]
xor edx, edx
call fcn.004107c8
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.00401aa4
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00401dd4
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x41280d
test bl, 0x10
jne 0x41280d
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00401dd4
push eax
call sub.kernel32.dll_CreateFileA
mov edi, eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push edi
call sub.kernel32.dll_GetFileTime
push edi
call sub.kernel32.dll_CloseHandle
lea eax, [esi + esi*2]
mov edx, dword [0x4186a8]
mov edx, dword [edx]
mov eax, dword [edx + eax*4 + 4]
call fcn.0040901c
cmp eax, 4
ja case.default.0x41277f
jmp dword [eax*4 + 0x412786]
push ebp
call fcn.004124b8
pop ecx
jmp case.default.0x41277f
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x1c]
call fcn.00403ff4
dec eax
jne 0x4127ba
push ebp
call fcn.004124b8
pop ecx
jmp case.default.0x41277f
mov byte [ebp - 0x1d], 0
jmp case.default.0x41277f
mov byte [ebp - 0x1d], 1
jmp case.default.0x41277f
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x1c]
call fcn.00403ff4
dec eax
sete byte [ebp - 0x1d]
jmp case.default.0x41277f
mov byte [ebp - 0x1d], 0
cmp byte [ebp - 0x1d], 0
je 0x412822
test bl, 1
je 0x4127fb
and ebx, 0xfffffffe
push ebx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00401dd4
push eax
call sub.kernel32.dll_SetFileAttributesA
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00401dd4
push eax
call sub.kernel32.dll_DeleteFileA
jmp 0x412822
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.004040bc
mov eax, dword [ebp - 0x28]
call fcn.00404138
cmp byte [ebp - 0x1d], 0
jne 0x412832
mov eax, dword [ebp - 0xc]
call fcn.00401a50
jmp 0x412858
lea eax, [esi + esi*2]
mov edx, dword [0x4186a8]
mov edx, dword [edx]
mov eax, dword [edx + eax*4 + 8]
call fcn.0040901c
dec eax
jne 0x412858
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
mov eax, dword [0x4197f0]
call fcn.0040b468
mov bl, byte [ebp - 0x1d]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41287d
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00401a74
ret
Function at 0x415548
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x415621
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
lea ecx, [ebp - 4]
xor edx, edx
mov eax, edi
call fcn.00415484
mov eax, dword [ebp - 4]
call fcn.00401dd4
push eax
call sub.kernel32.dll_DeleteFileA
inc edi
cmp edi, 0x12
jne 0x415567
test bl, bl
je 0x4155de
mov eax, 0x1a
call fcn.00415474
mov esi, eax
add esi, 0x14
sub esi, 0x14
jl 0x4155de
inc esi
mov edi, 0x14
lea ecx, [ebp - 8]
xor edx, edx
mov eax, edi
call fcn.00415484
mov eax, dword [ebp - 8]
call fcn.00401dd4
push eax
call sub.kernel32.dll_DeleteFileA
lea ecx, [ebp - 0xc]
lea eax, [edi + 0x1e]
xor edx, edx
call fcn.00415484
mov eax, dword [ebp - 0xc]
call fcn.00401dd4
push eax
call sub.kernel32.dll_DeleteFileA
inc edi
dec esi
jne 0x4155a5
lea ecx, [ebp - 0x14]
xor edx, edx
mov eax, 1
call fcn.00415484
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.004040bc
mov eax, dword [ebp - 0x10]
call fcn.00401dd4
push eax
call sub.kernel32.dll_RemoveDirectoryA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x415628
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00401a74
ret

Function at 0x4159b8
Capabilities:
Compare security identifiers

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov byte [esp], 0
lea eax, [esp + 4]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
mov ebx, eax
test ebx, ebx
jne 0x4159fc
call sub.kernel32.dll_GetLastError
cmp eax, 0x3f0
jne 0x4159fc
lea eax, [esp + 4]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov ebx, eax
test ebx, ebx
je 0x415a93
mov eax, 0x400
call fcn.00401154
mov esi, eax
lea eax, [esp + 8]
push eax
push 0x400
push esi
push 2
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_GetTokenInformation
mov ebx, eax
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_CloseHandle
test ebx, ebx
je 0x415a8c
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
push 0x418624
call sub.advapi32.dll_AllocateAndInitializeSid
mov ebx, dword [esi]
dec ebx
test ebx, ebx
jl 0x415a82
inc ebx
xor edi, edi
mov eax, dword [esi + edi*8 + 4]
push eax
mov eax, dword [esp + 0x10]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x415a7e
mov byte [esp], 1
jmp 0x415a82
inc edi
dec ebx
jne 0x415a65
mov eax, dword [esp + 0xc]
push eax
call sub.advapi32.dll_FreeSid
mov eax, esi
call fcn.0040116c
mov al, byte [esp]
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x415d8c
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00401dc4
xor eax, eax
push ebp
push 0x415dfd
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00409050
mov edx, dword [ebp - 8]
mov eax, 0x419890
call fcn.00401aa4
xor eax, eax
mov dword [0x41988c], eax
push 0
push 0x415ca0
call sub.user32.dll_EnumWindows
mov ebx, dword [0x41988c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x415e04
lea eax, [ebp - 8]
mov edx, 2
call fcn.00401a74
ret

Function at 0x415e0c
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, eax
xor ebx, ebx
test esi, esi
jns 0x415e1d
call fcn.004013f4
push esi
push 0xffffffffffffffff
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov edi, eax
test edi, edi
jns 0x415e35
call fcn.004013f4
push esp
mov esi, edi
test esi, esi
jns 0x415e41
call fcn.004013f4
push esi
call sub.kernel32.dll_GetExitCodeProcess
test edi, edi
je 0x415e64
mov eax, dword [esp]
push eax
test edi, edi
jns 0x415e58
call fcn.004013f4
push esi
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb ebx, ebx
inc ebx
test edi, edi
jns 0x415e6d
call fcn.004013f4
push esi
call sub.kernel32.dll_CloseHandle
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x40341d
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
push esi
push edi
xor edi, edi
cmp dword [0x59c108], 0x5b1
jne 0x4034bc
push edi
lea eax, [ebp - 0x810]
push eax
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_FoldStringW]
push edi
push edi
call dword [sym.imp.USER32.dll_ChangeDisplaySettingsA]
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_OpenJobObjectW]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_EnumSystemCodePagesA]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateHardLinkW]
push 0x402e04
push edi
call fcn.00403c48
pop ecx
pop ecx
lea esi, [ebp - 0x10]
call fcn.00403010
mov ecx, esi
call fcn.00403030
push edi
call fcn.00403a30
push edi
push edi
call fcn.00403a3b
push edi
call fcn.00403b6d
add esp, 0xc
mov dword [esp], edi
call fcn.0040305a
fstp st(0)
push edi
call fcn.00403b6d
pop ecx
call fcn.00403c6a
add dword [0x59c108], 0x1134b
push ebx
push dword [0x59c108]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [0x59b058], eax
call fcn.00403368
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
call ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp esi, 0x206d47
jg 0x4034ff
inc esi
cmp esi, 0x4f6a4
jl 0x4034e6
xor esi, esi
cmp dword [0x59c108], edi
jbe 0x40354b
cmp dword [0x59c108], 0xa8
mov eax, dword [0x59c10c]
mov al, byte [eax + esi + 0x1134b]
mov ecx, dword [0x59b058]
mov byte [ecx + esi], al
jne 0x403542
push edi
call dword [sym.imp.KERNEL32.dll_GetLargestConsoleWindowSize]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
inc esi
cmp esi, dword [0x59c108]
jb 0x403509
xor esi, esi
mov eax, dword [0x59c108]
add eax, esi
cmp eax, 0xe
jne 0x40356a
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
inc esi
cmp esi, 0x39621
jl 0x40354d
mov esi, 0x1e6cc
push edi
push edi
call dword [sym.imp.USER32.dll_LoadMenuW]
push edi
push edi
push edi
call dword [sym.imp.USER32.dll_CharToOemBuffA]
lea eax, [ebp - 0x10]
push eax
push edi
push edi
push edi
call dword [sym.imp.GDI32.dll_GetCharABCWidthsFloatA]
dec esi
jne 0x403578
call fcn.0040329a
call ebx
cmp esi, 0x26
jne 0x4035aa
call fcn.0040334e
inc esi
cmp esi, 0x6753f
jl 0x40359e
push 0x7b
pop esi
pop ebx
cmp dword [0x59c108], 0x86
jne 0x4035f8
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_IsProcessInJob]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
push edi
call dword [sym.imp.KERNEL32.dll_AddAtomW]
push edi
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
call dword [sym.imp.KERNEL32.dll_SetFileApisToANSI]
dec esi
jne 0x4035b7
push 0x402e1c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
pop edi
pop esi
leave
ret
Function at 0x40360a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
push ebx
push esi
xor esi, esi
cmp dword [0x59c108], 0x400
push edi
jne 0x403650
push esi
push esi
call dword [sym.imp.KERNEL32.dll__lopen]
push esi
push esi
call fcn.004039c1
push esi
call fcn.00403933
push esi
push esi
call fcn.004039c1
push esi
push esi
call fcn.00403c48
push esi
call fcn.00403ce5
add esp, 0x20
mov eax, dword [0x428b04]
mov dword [0x59c108], eax
mov eax, dword [0x428adc]
mov dword [0x59c10c], eax
call fcn.0040341d
xor ebx, ebx
mov edi, 0x2b259d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp ebx, edi
jle 0x403696
cmp dword [ebp - 4], 0x785074d5
jne 0x40369f
inc ebx
cmp ebx, 0x1c1b
jl 0x403670
xor ebx, ebx
push esi
lea eax, [ebp - 0x808]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
cmp ebx, edi
jle 0x4036cc
cmp dword [ebp - 4], 0x785074d5
jne 0x4036d5
inc ebx
cmp ebx, 0x11915
jl 0x4036a1
mov eax, dword [0x59b058]
mov dword [0x59b69c], eax
call eax
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10

Function at 0x409251
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x427688]
jne 0x40925b
repz ret
jmp fcn.0040cfe9