joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4274d4
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 0x10], ebx
jne 0x4274ed
or eax, 0xffffffff
jmp 0x42754e
push esi
mov esi, dword [eax]
cmp esi, ebx
mov dword [ebp - 4], esi
je 0x42754a
push 0x3d
push esi
call fcn.0042773c
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
je 0x42754a
cmp esi, eax
je 0x42754a
xor ecx, ecx
cmp byte [eax + 1], bl
mov eax, dword [0xc458d8]
sete cl
cmp eax, dword [0xc458dc]
mov dword [ebp - 8], ecx
jne 0x427530
mov edi, eax
call fcn.00427473
mov dword [0xc458d8], eax
cmp eax, ebx
jne 0x427589
cmp dword [ebp + 0xc], ebx
je 0x427552
cmp dword [0xc458e0], ebx
je 0x427552
call fcn.00426ce4
test eax, eax
je 0x427589
or eax, 0xffffffff
pop esi
pop edi
pop ebx
leave
ret
cmp dword [ebp - 8], ebx
je 0x42755b
xor eax, eax
jmp 0x42754d
push 4
call fcn.0041e42b
cmp eax, ebx
pop ecx
mov dword [0xc458d8], eax
je 0x42754a
mov dword [eax], ebx
cmp dword [0xc458e0], ebx
jne 0x427589
push 4
call fcn.0041e42b
cmp eax, ebx
pop ecx
mov dword [0xc458e0], eax
je 0x42754a
mov dword [eax], ebx
mov edi, dword [ebp - 0xc]
sub edi, dword [ebp - 4]
push dword [ebp - 4]
mov esi, dword [0xc458d8]
call fcn.00427426
mov edi, eax
cmp edi, ebx
pop ecx
jl 0x4275ea
cmp dword [esi], ebx
je 0x4275ea
lea esi, [esi + edi*4]
push dword [esi]
call fcn.0041e43d
cmp dword [ebp - 8], ebx
pop ecx
jne 0x4275cd
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
jmp 0x42762b
mov eax, dword [esi + 4]
mov dword [esi], eax
inc edi
add esi, 4
cmp dword [esi], ebx
jne 0x4275c4
mov eax, edi
shl eax, 2
push eax
push dword [0xc458d8]
call fcn.00420286
cmp eax, ebx
pop ecx
pop ecx
je 0x42762b
jmp 0x427626
cmp dword [ebp - 8], ebx
jne 0x427696
cmp edi, ebx
jge 0x4275f9
neg edi
lea eax, [edi*4 + 8]
push eax
push dword [0xc458d8]
call fcn.00420286
cmp eax, ebx
pop ecx
pop ecx
je 0x42754a
mov edx, dword [ebp - 4]
lea ecx, [eax + edi*4]
mov dword [ecx], edx
mov dword [ecx + 4], ebx
mov ecx, dword [ebp + 8]
mov dword [ecx], ebx
mov dword [0xc458d8], eax
cmp dword [ebp + 0xc], ebx
je 0x427680
push dword [ebp - 4]
call fcn.0041eba0
inc eax
inc eax
push eax
call fcn.0041e42b
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x427680
push dword [ebp - 4]
push esi
call fcn.0041fc70
mov eax, esi
sub eax, dword [ebp - 4]
pop ecx
add eax, dword [ebp - 0xc]
pop ecx
mov ecx, dword [ebp - 8]
mov byte [eax], bl
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x427679
or dword [ebp - 0x10], 0xffffffff
push esi
call fcn.0041e43d
pop ecx
cmp dword [ebp - 8], ebx
je 0x42768e
push dword [ebp - 4]
call fcn.0041e43d
pop ecx
mov eax, dword [ebp - 0x10]
jmp 0x42754d
push dword [ebp - 4]
call fcn.0041e43d
mov eax, dword [ebp + 8]
pop ecx
mov dword [eax], ebx
jmp 0x427557
Function at 0x62a969d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
test eax, eax
je 0x62a96a40
cmp byte [esi + eax - 1], 0xa
mov ebx, eax
je 0x62a96a38
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x62a9d084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp], esi
mov dword [esp + 0xc], eax
mov eax, 1
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
xor eax, eax
jmp 0x62a969fd
lea esp, [ebp - 8]
xor eax, eax
pop ebx
pop esi
pop ebp
ret
Function at 0x62a97110
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0xf0
mov ebx, dword [ebp + 0xc]
mov dword [esp], ebx
call sym.___wine_dbg_get_channel_flags
movzx ecx, byte [ebp + 8]
movzx eax, al
sar eax, cl
test al, 1
je 0x62a972e8
mov edx, dword [0x62a9d084]
mov eax, dword fs:[0x18]
cmp dword [eax + 0x24], edx
je 0x62a972d8
test byte [0x62a98040], 8
jne 0x62a97280
lea edi, [esp + 0x28]
mov esi, edi
test byte [0x62a98050], 8
jne 0x62a97240
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov ecx, str._04x:
mov dword [esp + 4], ecx
mov dword [esp], esi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x62a9719b
cmp dword [ebp + 8], 3
jbe 0x62a97200
mov dword [esp], 2
mov ebx, edi
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov esi, dword [ebx]
add ebx, 4
lea ecx, [esi - 0x1010101]
not esi
and ecx, esi
and ecx, 0x80808080
je 0x62a971aa
mov dword [esp + 0xc], eax
mov esi, ecx
mov eax, 1
mov dword [esp + 4], eax
shr esi, 0x10
test ecx, 0x8080
mov dword [esp], edi
cmove ecx, esi
lea esi, [ebx + 2]
mov dl, cl
cmove ebx, esi
add dl, cl
sbb ebx, 3
sub ebx, edi
mov dword [esp + 8], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [ebp + 0x10]
add eax, esi
inc ebx
mov dword [esp + 0x10], ebx
mov dword [esp], eax
mov dword [esp + 0x14], edx
mov edx, dword [ebp + 8]
mov ecx, dword [edx*4 + str.rbxbb]
mov edx, str._s:_s:_s
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
mov ecx, edi
sub ecx, eax
add ecx, 0xc8
mov dword [esp + 4], ecx
call sym._snprintf.constprop.0
jmp 0x62a9719b
mov dword [esp], 0x62a98050
call sym.___wine_dbg_get_channel_flags
and al, 8
je 0x62a97170
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov ecx, str._04x:
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call sym._sprintf
add esi, eax
jmp 0x62a97170
mov dword [esp], 0x62a98040
call sym.___wine_dbg_get_channel_flags
and al, 8
je 0x62a9715d
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
mov esi, str._3u._03u:
mov dword [esp + 4], esi
lea edi, [esp + 0x28]
mov dword [esp], edi
mov ecx, eax
mul edx
shr edx, 6
mov dword [esp + 8], edx
imul eax, edx, 0x3e8
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea esi, [edi + eax]
jmp 0x62a97163
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0xffffffff
jmp 0x62a971f8
Function at 0x4018f0
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x422494]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x808]
push eax
push 0
push 0
push 0x41b27c
mov dword [ebp - 0x808], 0
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
je 0x40194c
push str.EHNULL
push 0x400
push 0x424d40
call fcn.00407761
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407752
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x808]
push esi
push ecx
lea edx, [ebp - 0x804]
push 0x400
push edx
call fcn.00407761
lea eax, [ebp - 0x804]
push eax
push 0x400
push 0x424d40
call fcn.00407761
mov ecx, dword [ebp - 0x808]
add esp, 0x18
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push str.PerfsLog
push 0x400
push 0x424d40
call fcn.0040852d
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
add esp, 0xc
push 0x424d40
call esi
cmp eax, 0xffffffff
je 0x4019b8
test al, 0x10
jne 0x401a05
push 0
push 0x424d40
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4019ef
push str.EHNULL
push 0x400
push 0x424d40
call fcn.00407761
add esp, 0xc
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407752
mov esp, ebp
pop ebp
ret
push 0x424d40
call esi
or eax, 2
push eax
push 0x424d40
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00407752
mov esp, ebp
pop ebp
ret

Function at 0x401a20
Capabilities:
Check if file exists
Create directory
Get file attributes
Set file attributes

Disassembly:
mov ecx, str.EHNULL
mov eax, 0x424d40
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401a56
test dx, dx
je 0x401a52
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401a56
add eax, 4
add ecx, 4
test dx, dx
jne 0x401a30
xor eax, eax
jmp 0x401a5b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x401a77
push str.EHNULL
push 0x400
push 0x425540
call fcn.00407761
add esp, 0xc
ret
push esi
push 0x424d40
push 0x400
push 0x425540
call fcn.00407761
push str.Sys
push 0x400
push 0x425540
call fcn.0040852d
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
add esp, 0x18
push 0x425540
call esi
cmp eax, 0xffffffff
je 0x401ab9
test al, 0x10
jne 0x401af9
push 0
push 0x425540
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x401ae3
push str.EHNULL
push 0x400
push 0x425540
call fcn.00407761
add esp, 0xc
pop esi
ret
push 0x425540
call esi
or eax, 2
push eax
push 0x425540
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop esi
ret
Function at 0x401b00
Capabilities:
Check if file exists
Create directory
Get file attributes
Set file attributes

Disassembly:
mov ecx, str.EHNULL
mov eax, 0x424d40
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401b36
test dx, dx
je 0x401b32
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401b36
add eax, 4
add ecx, 4
test dx, dx
jne 0x401b10
xor eax, eax
jmp 0x401b3b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x401b57
push str.EHNULL
push 0x400
push 0x425d40
call fcn.00407761
add esp, 0xc
ret
push esi
push 0x424d40
push 0x400
push 0x425d40
call fcn.00407761
push str.Log
push 0x400
push 0x425d40
call fcn.0040852d
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
add esp, 0x18
push 0x425d40
call esi
cmp eax, 0xffffffff
je 0x401b99
test al, 0x10
jne 0x401bd9
push 0
push 0x425d40
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x401bc3
push str.EHNULL
push 0x400
push 0x425d40
call fcn.00407761
add esp, 0xc
pop esi
ret
push 0x425d40
call esi
or eax, 2
push eax
push 0x425d40
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop esi
ret

Function at 0x401be0
Capabilities:
Check if file exists
Create directory
Get file attributes
Set file attributes

Disassembly:
mov ecx, str.EHNULL
mov eax, 0x424d40
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401c16
test dx, dx
je 0x401c12
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401c16
add eax, 4
add ecx, 4
test dx, dx
jne 0x401bf0
xor eax, eax
jmp 0x401c1b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x401c37
push str.EHNULL
push 0x400
push 0x426540
call fcn.00407761
add esp, 0xc
ret
push esi
push 0x424d40
push 0x400
push 0x426540
call fcn.00407761
push str.WinLog
push 0x400
push 0x426540
call fcn.0040852d
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
add esp, 0x18
push 0x426540
call esi
cmp eax, 0xffffffff
je 0x401c79
test al, 0x10
jne 0x401cb9
push 0
push 0x426540
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x401ca3
push str.EHNULL
push 0x400
push 0x426540
call fcn.00407761
add esp, 0xc
pop esi
ret
push 0x426540
call esi
or eax, 2
push eax
push 0x426540
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop esi
ret
Function at 0x401cc0
Capabilities:
Check if file exists
Create directory
Get file attributes
Set file attributes

Disassembly:
mov ecx, str.EHNULL
mov eax, 0x424d40
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401cf6
test dx, dx
je 0x401cf2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401cf6
add eax, 4
add ecx, 4
test dx, dx
jne 0x401cd0
xor eax, eax
jmp 0x401cfb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x401d17
push str.EHNULL
push 0x400
push 0x426d40
call fcn.00407761
add esp, 0xc
ret
push esi
push 0x424d40
push 0x400
push 0x426d40
call fcn.00407761
push str.WinRm
push 0x400
push 0x426d40
call fcn.0040852d
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
add esp, 0x18
push 0x426d40
call esi
cmp eax, 0xffffffff
je 0x401d59
test al, 0x10
jne 0x401d99
push 0
push 0x426d40
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x401d83
push str.EHNULL
push 0x400
push 0x426d40
call fcn.00407761
add esp, 0xc
pop esi
ret
push 0x426d40
call esi
or eax, 2
push eax
push 0x426d40
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop esi
ret

Function at 0x402000
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x808
mov eax, dword [0x422494]
xor eax, esp
mov dword [esp + 0x804], eax
mov ecx, str.EHNULL
mov eax, 0x425d40
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40204a
test dx, dx
je 0x402046
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40204a
add eax, 4
add ecx, 4
test dx, dx
jne 0x402024
xor eax, eax
jmp 0x40204f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40207c
push str.EHNULL
push 0x400
push 0x424540
call fcn.00407761
add esp, 0xc
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.00407752
mov esp, ebp
pop ebp
ret
lea eax, [esp]
push eax
call fcn.00401da0
push 0x425d40
push 0x400
push 0x424540
call fcn.00407761
add esp, 0xc
lea ecx, [esp]
push ecx
push 0x400
push 0x424540
call fcn.0040852d
add esp, 0xc
call fcn.00401760
test al, al
je 0x4020c6
push 0x424540
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.00407752
mov esp, ebp
pop ebp
ret
Function at 0x403ab0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x419ad8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x422494]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebx + 0x44], 0
je 0x403c41
cmp byte [ebx + 0x49], 0
je 0x403c41
mov eax, dword [ebx]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
mov ecx, ebx
call edx
cmp eax, 0xffffffff
je 0x403c35
lea esi, [ebp - 0x2c]
call fcn.00403540
mov dword [ebp - 4], 0
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov edx, eax
cmp edi, 0x10
jae 0x403b23
lea edx, [ebp - 0x2c]
mov eax, edx
mov ecx, dword [ebx + 0x44]
mov esi, dword [ecx]
lea edi, [ebp - 0x30]
push edi
mov edi, dword [ebp - 0x1c]
add edi, edx
push edi
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [esi + 0x18]
call eax
sub eax, 0
je 0x403b5c
dec eax
je 0x403b60
sub eax, 2
lea ecx, [ebp - 0x2c]
je 0x403c3c
call fcn.004020e0
xor al, al
jmp 0x403c43
mov byte [ebx + 0x49], 0
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov edx, eax
cmp edi, 0x10
jae 0x403b70
lea edx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, edx
je 0x403b9d
cmp edi, 0x10
jae 0x403b7f
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x54]
push ecx
push esi
push 1
push eax
call fcn.00408d24
add esp, 0x10
cmp esi, eax
jne 0x403c2d
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [ebx + 0x49], 0
je 0x403c39
test esi, esi
jne 0x403b17
mov ecx, dword [ebp - 0x1c]
or edx, 0xffffffff
sub edx, ecx
cmp edx, 8
jbe 0x403c5e
lea esi, [ecx + 8]
cmp esi, 0xfffffffe
ja 0x403c5e
cmp edi, esi
jae 0x403c16
push ecx
push esi
lea ecx, [ebp - 0x2c]
call fcn.004042b0
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
test esi, esi
je 0x403b17
mov ecx, eax
cmp edi, 0x10
jae 0x403bf2
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 0x1c]
xor eax, eax
mov dword [ecx + edx], eax
mov dword [ecx + edx + 4], eax
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], esi
jae 0x403c0d
lea eax, [ebp - 0x2c]
mov byte [eax + esi], 0
jmp 0x403b11
test esi, esi
jne 0x403be8
mov dword [ebp - 0x1c], esi
cmp edi, 0x10
jae 0x403c25
lea eax, [ebp - 0x2c]
mov byte [eax], 0
jmp 0x403b11
lea ecx, [ebp - 0x2c]
call fcn.004020e0
xor al, al
jmp 0x403c43
lea ecx, [ebp - 0x2c]
call fcn.004020e0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00407752
mov esp, ebp
pop ebp
ret
push str.string_too_long
call fcn.00407403
int3
Function at 0x403f80
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x419a4b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x422494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004074be
push 4
mov dword [ebp - 4], 0
call fcn.00407db1
mov edi, eax
add esp, 4
test edi, edi
je 0x403ffc
call fcn.00406db2
mov dword [edi], eax
call fcn.00406b71
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.00406aa6
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x403ff2
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.00406ace
jmp 0x403ffe
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x404bf0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x419c76
mov eax, dword fs:[0]
push eax
mov eax, 0x184c
call fcn.00415d50
mov eax, dword [0x422494]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x400
lea eax, [ebp - 0x810]
xor esi, esi
push eax
push esi
mov dword [ebp - 0x184c], esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor ecx, ecx
lea eax, [ebp - 0x810]
mov dword [ebp - 0x1818], 7
mov dword [ebp - 0x181c], esi
mov word [ebp - 0x182c], cx
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x404c60
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x810]
lea ecx, [ebp - 0x182c]
call fcn.004040b0
mov ebx, 1
lea edi, [ebp - 0x182c]
mov dword [ebp - 4], esi
call fcn.00403790
lea ecx, [eax + 1]
lea eax, [ebp - 0x1848]
mov edx, edi
call fcn.004026b0
mov edi, eax
lea esi, [ebp - 0x182c]
mov byte [ebp - 4], bl
call fcn.00403670
mov esi, 8
mov byte [ebp - 4], 0
cmp dword [ebp - 0x1834], esi
jb 0x404cd4
mov edx, dword [ebp - 0x1848]
push edx
call fcn.0040793a
add esp, 4
mov eax, dword [ebp - 0x182c]
cmp dword [ebp - 0x1818], esi
jae 0x404ce8
lea eax, [ebp - 0x182c]
push eax
lea eax, [ebp - 0x810]
push 0x400
push eax
call fcn.00407761
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessId]
lea ecx, [ebp - 0x1854]
push ecx
lea edx, [ebp - 0x1810]
push edx
mov dword [ebp - 0x1858], eax
mov dword [ebp - 0x1854], 0x400
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
push 0x22c
mov dword [ebp - 0x1850], ebx
call fcn.00407db1
add esp, 4
mov esi, eax
push esi
push ebx
mov dword [esi], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x404de5
lea eax, [ebp - 0x810]
push eax
lea eax, [esi + 0x24]
push eax
call fcn.004088d0
add esp, 8
test eax, eax
jne 0x404dd9
mov ecx, dword [esi + 8]
push ecx
push eax
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x404dd9
push edi
lea ecx, [ebp - 0x1010]
call fcn.00404a30
add esp, 4
push edi
mov bl, al
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x404dd3
lea edx, [ebp - 0x1810]
push edx
lea eax, [ebp - 0x1010]
push eax
call fcn.004088d0
add esp, 8
test eax, eax
jne 0x404dd3
mov ecx, dword [ebp - 0x1858]
cmp dword [esi + 8], ecx
jne 0x404e31
mov ebx, dword [ebp - 0x1850]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x404d65
mov edi, dword [ebp - 0x184c]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.0040793a
add esp, 4
cmp dword [ebp - 0x1818], 8
jb 0x404e13
mov edx, dword [ebp - 0x182c]
push edx
call fcn.0040793a
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00407752
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0x1850]
mov edi, 1
jmp 0x404deb
Function at 0x406770
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x64
push 0x424470
push 0x67
push esi
call edi
push 0x64
push 0x4243a8
push 0x6d
push esi
call edi
mov eax, esi
call fcn.00406870
push 0
push esi
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push 0x424470
push 0x4243a8
push 0
mov dword [0x424538], esi
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov edi, eax
test edi, edi
je 0x4067fe
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.USER32.dll_UpdateWindow]
call fcn.00404bf0
test eax, eax
je 0x406808
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0x10
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
push 0x6d
push esi
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov edi, dword [sym.imp.USER32.dll_GetMessageW]
push 0
push 0
mov esi, eax
push 0
lea eax, [ebp - 0x1c]
push eax
call edi
test eax, eax
je 0x406864
push ebx
mov ebx, dword [sym.imp.USER32.dll_TranslateAcceleratorW]
mov edx, dword [ebp - 0x1c]
lea ecx, [ebp - 0x1c]
push ecx
push esi
push edx
call ebx
test eax, eax
jne 0x406853
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea ecx, [ebp - 0x1c]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 0
push 0
push 0
lea edx, [ebp - 0x1c]
push edx
call edi
test eax, eax
jne 0x406830
pop ebx
mov eax, dword [ebp - 0x14]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x407752
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x422494]
jne 0x40775c
repz ret
jmp fcn.0040c75b
Function at 0x417129
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x422494]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040df19
and dword [ebp - 0x14], 0
cmp dword [0x424368], 0
mov dword [ebp - 0x18], eax
jne 0x4171dc
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x417284
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x417284
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x424368], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42436c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x424370], eax
call edi
push eax
call esi
mov dword [0x424378], eax
test eax, eax
je 0x4171dc
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x424374], eax
mov eax, dword [0x424374]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x417235
cmp dword [0x424378], ecx
je 0x417235
push eax
call esi
push dword [0x424378]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x417235
test ebx, ebx
je 0x417235
call edi
test eax, eax
je 0x41722c
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41722c
test byte [ebp - 8], 1
jne 0x417235
or dword [ebp + 0x10], 0x200000
jmp 0x417268
mov eax, dword [0x42436c]
cmp eax, dword [ebp - 0x18]
je 0x417268
push eax
call esi
test eax, eax
je 0x417268
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x417268
mov eax, dword [0x424370]
cmp eax, dword [ebp - 0x18]
je 0x417268
push eax
call esi
test eax, eax
je 0x417268
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x424368]
call esi
test eax, eax
je 0x417284
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x417286
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407752
leave
ret