joyce8/EMBER2024-capa huggingface dataset:
Function at 0x650454
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x650485
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x65046d
add dl, dl
jne 0x650490
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x6504e1
xor eax, eax
add dl, dl
jne 0x65049d
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x65057e
add dl, dl
jne 0x6504ac
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x6504b7
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x6504c2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x6504cd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x6504d7
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x65047c
mov eax, 1
add dl, dl
jne 0x6504ef
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x6504fa
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x6504e6
sub eax, ebx
mov ebx, 1
jne 0x65052d
mov ecx, 1
add dl, dl
jne 0x650513
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x65051e
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x65050a
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x65047c
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x650544
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x65054f
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x65053b
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x65047c
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x65059f
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x65047c
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x651fd4
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x652005
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x651fed
add dl, dl
jne 0x652010
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x652061
xor eax, eax
add dl, dl
jne 0x65201d
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x6520fe
add dl, dl
jne 0x65202c
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x652037
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x652042
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x65204d
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x652057
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x651ffc
mov eax, 1
add dl, dl
jne 0x65206f
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x65207a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x652066
sub eax, ebx
mov ebx, 1
jne 0x6520ad
mov ecx, 1
add dl, dl
jne 0x652093
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x65209e
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x65208a
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x651ffc
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x6520c4
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x6520cf
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x6520bb
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x651ffc
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x65211f
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x651ffc
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x653058
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x6ccfc7
nop
nop
nop
nop
nop
jmp fcn.006e4f2b
Function at 0x653af4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x653d05
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00588bc8
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x653b2f
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x653b48
lea eax, [ebp - 0xc]
mov edx, dword [0x682514]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00588c28
jmp 0x653b5b
lea eax, [ebp - 0xc]
mov edx, dword [0x682514]
mov edx, dword [edx]
mov edx, dword [edx + 0x14]
call fcn.00588c28
lea eax, [ebp - 0xc]
mov edx, ebx
sar edx, 1
jns 0x653b67
adc edx, 0
mov edx, dword [edx*4 + 0x680d54]
call fcn.00588e34
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0xc]
call fcn.00588e18
push eax
call fcn.0058ae88
mov esi, eax
cmp esi, 0xffffffff
je 0x653cd7
mov eax, 0x40
call fcn.00586a80
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.0058b260
test eax, eax
je 0x653cca
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x653cca
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.0058b2c0
mov eax, edi
call fcn.00586ab0
mov eax, 0x18
call fcn.00586a80
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.0058b260
test eax, eax
je 0x653cca
mov eax, edi
cmp dword [eax], 0x4550
jne 0x653cca
add eax, 4
cmp byte [ebp - 1], 0
je 0x653c6e
cmp word [eax], 0x8664
jne 0x653c6e
mov eax, edi
call fcn.00586ab0
mov eax, 0xf0
call fcn.00586a80
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.0058b260
test eax, eax
je 0x653cca
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x653cca
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
call fcn.00588c04
jmp 0x653cca
cmp byte [ebp - 1], 0
jne 0x653cca
cmp word [eax], 0x14c
jb 0x653cca
cmp word [eax], 0x150
ja 0x653cca
mov eax, edi
call fcn.00586ab0
mov eax, 0xe0
call fcn.00586a80
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.0058b260
test eax, eax
je 0x653cca
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x653cca
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
call fcn.00588c04
mov eax, edi
call fcn.00586ab0
push esi
call fcn.0058ae40
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.00588f44
jne 0x653cef
inc ebx
cmp ebx, 0x19
jne 0x653b21
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x653d0c
lea eax, [ebp - 0xc]
inc ebp
hlt
call fcn.00588bc8
ret
Function at 0x653fc8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
xor ebx, ebx
push 0
push 0
push 0
push edi
call fcn.0058b2c0
push 0
lea eax, [ebp - 4]
push eax
push 0x40
push esi
push edi
call fcn.0058b260
test eax, eax
je 0x654065
cmp word [esi], 0x5a4d
jne 0x654065
push 0
push 0
mov eax, dword [esi + 0x3c]
push eax
push edi
call fcn.0058b2c0
push 0
lea eax, [ebp - 4]
push eax
push 0x18
lea eax, [ebp - 0x1c]
push eax
push edi
call fcn.0058b260
test eax, eax
je 0x654065
cmp dword [ebp - 0x1c], 0x4550
jne 0x654065
lea edx, [ebp - 0x18]
mov ecx, 0x14
mov eax, dword [ebp + 0xc]
call fcn.0058bcbc
mov ax, word [ebp - 0x18]
cmp ax, 0x14c
jb 0x654065
cmp ax, 0x150
ja 0x654065
push 0
lea eax, [ebp - 4]
push eax
push 0xe0
mov eax, dword [ebp + 8]
push eax
push edi
call fcn.0058b260
test eax, eax
je 0x654065
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x659dcc
Capabilities:
Parse pe header

Disassembly:
push ebx
xor ecx, ecx
test edx, edx
je 0x659df4
mov ebx, edx
mov eax, ebx
cmp word [eax], 0x5a4d
jne 0x659df4
add ebx, dword [eax + 0x3c]
mov eax, ebx
cmp dword [eax], 0x4550
jne 0x659df4
cmp word [eax + 0x18], 0x20b
sete cl
mov eax, ecx
pop ebx
ret

Function at 0x659df8
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
push edi
mov esi, edx
xor ebx, ebx
test esi, esi
je 0x659e51
mov edi, esi
push 0x40
push edi
call fcn.0058b1d0
test eax, eax
jne 0x659e51
cmp word [edi], 0x5a4d
jne 0x659e51
mov eax, dword [edi + 0x3c]
test eax, eax
jle 0x659e51
cmp eax, 0x10000
jge 0x659e51
add esi, eax
push 0x120
push esi
call fcn.0058b1d0
test eax, eax
jne 0x659e51
cmp dword [esi], 0x4550
jne 0x659e51
mov ax, word [esi + 0x18]
cmp ax, 0x10b
je 0x659e4f
cmp ax, 0x20b
jne 0x659e51
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x663158
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
xor eax, eax
push ebp
push 0x66320e
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea ecx, [ebp - 8]
mov eax, dword [0x6821f4]
mov eax, dword [eax]
mov edx, 0xa
call fcn.005d751c
mov eax, dword [ebp - 8]
call fcn.0058897c
push eax
lea ecx, [ebp - 0xc]
mov eax, dword [0x6821f4]
mov eax, dword [eax]
mov edx, 9
call fcn.005d751c
mov eax, dword [ebp - 0xc]
call fcn.0058897c
push eax
call fcn.0058b098
push eax
call fcn.0058b0b8
test eax, eax
je 0x6631f3
xor eax, eax
mov ecx, dword fs:[0x18]
mov ecx, dword [ecx + 0x30]
cmp dword [ecx + 0xc], 0
jne 0x6631dd
mov ecx, dword fs:[0x20]
jecxz 0x6631f3
mov byte [ebp - 1], 1
jmp 0x6631f3
xor ecx, ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
movzx ecx, byte [eax + 2]
jecxz 0x6631f3
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x663215
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.005884d0
ret
Function at 0x66de94
Capabilities:
Encode data using xor

Disassembly:
jmp 0x6d1f13
nop
nop
nop
nop
nop
jmp 0x6ec051
ret
push ebx
push esi
add esp, 0xffffffd4
mov dword [esp + 4], eax
lea eax, [esp + 0xc]
mov edx, 0x10
call fcn.0058bcc4
mov eax, dword [0x6821f4]
mov eax, dword [eax]
mov ecx, dword [eax + 0x64]
mov eax, dword [0x6821f4]
mov eax, dword [eax]
mov eax, dword [eax + 0x64]
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [esp], eax
mov eax, dword [esp + 4]
mov eax, dword [eax]
sub eax, 1
test eax, eax
jl 0x6ec112
add eax, 1
mov dword [esp + 8], eax
xor esi, esi
lea eax, [esp + 0x1c]
mov edx, 0x10
call fcn.0058bcc4
lea eax, [esi + esi*4]
mov edx, dword [esp]
mov edx, dword [edx + eax*8 + 0x108]
mov ecx, dword [esp]
mov eax, dword [ecx + eax*8 + 0x104]
mov ecx, dword [0x6821f4]
mov ecx, dword [ecx]
add eax, dword [ecx + 0x64]
lea ecx, [esp + 0x1c]
call fcn.005c7220
mov ecx, 4
lea eax, [esp + 0x1c]
lea edx, [esp + 0xc]
mov ebx, dword [eax]
xor dword [edx], ebx
add edx, 4
add eax, 4
sub ecx, 1
jne 0x6ec0f1
add esi, 1
sub dword [esp + 8], 1
jne 0x6ec0ab
lea ecx, [esp + 0x1c]
mov eax, dword [esp + 4]
mov edx, dword [eax + 4]
mov eax, dword [esp + 4]
add eax, 0x1c
call fcn.005c7220
mov eax, dword [esp + 4]
lea edx, [eax + 0xc]
lea eax, [esp + 0x1c]
mov ecx, 0x10
call fcn.0058d0e0
test al, al
jne 0x6ec14b
call fcn.0064c518
mov eax, dword [esp + 4]
mov eax, dword [eax + 8]
call fcn.00586a80
mov ebx, eax
call fcn.0063cfb8
mov eax, dword [esp + 4]
mov eax, dword [eax + 4]
call fcn.00586a80
mov esi, eax
mov eax, dword [esp + 4]
mov ecx, dword [eax + 4]
mov eax, dword [esp + 4]
lea edx, [eax + 0x1c]
mov eax, esi
call fcn.0058bcbc
lea eax, [esp + 0xc]
push eax
push 0x10
push 9
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 4]
mov edx, ebx
mov eax, esi
call fcn.006505b0
mov eax, esi
call fcn.00586ab0
lea ecx, [esp + 0x1c]
mov eax, dword [esp + 4]
mov edx, dword [eax + 8]
sub edx, 0x10
mov esi, ebx
add esi, 0x10
mov eax, esi
call fcn.005c7220
lea eax, [esp + 0x1c]
mov ecx, 0x10
mov edx, ebx
call fcn.0058d0e0
test al, al
jne 0x6ec1d8
call fcn.0064c518
mov eax, esi
call fcn.0066240c
mov eax, ebx
call fcn.00586ab0
add esp, 0x2c
pop esi
pop ebx
jmp 0x6d204b
Function at 0x99b03f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
shr ecx, 2
xor dword [edx], eax
add edx, 4
dec ecx
jne 0x99b057
pop ebp
ret 0xc

Function at 0x99b0fa
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebp
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x99b12b
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x99b109
add dl, dl
jne 0x99b13e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x99b1ae
xor eax, eax
add dl, dl
jne 0x99b153
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x99b283
add dl, dl
jne 0x99b166
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x99b175
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x99b184
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x99b193
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x99b1a1
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x99b11e
mov eax, 1
add dl, dl
jne 0x99b1c0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x99b1cf
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x99b1b3
sub eax, ebx
mov ebx, 1
jne 0x99b216
mov ecx, 1
add dl, dl
jne 0x99b1f4
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x99b203
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x99b1e7
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x99b11e
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x99b231
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x99b240
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x99b224
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x99b11e
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x99b2ab
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x99b11e
pop ebp
sub edi, dword [ebp + 8]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4016ec
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 8
call fcn.004040ef
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.004040ef
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
push 0x10
call fcn.004040ef
add esp, 4
mov dword [ebp - 0x14], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
push 0
mov ebx, 0x404c50
call fcn.00404101
add esp, 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
je 0x4017a5
mov eax, 0
jmp 0x4018e9
cmp dword [ebp + 0xc], 0
jne 0x4017d1
mov dword [ebp - 0x18], esp
mov eax, 4
call fcn.004040fb
cmp dword [ebp - 0x18], esp
je 0x4017ce
push 6
call fcn.004040f5
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp + 0x14], 0
jne 0x4017f9
mov eax, str.SeDebugPrivilege
push eax
mov ebx, dword [ebp + 0x10]
mov ebx, dword [ebx]
test ebx, ebx
je 0x4017f3
push ebx
call fcn.004040e9
add esp, 4
pop eax
mov ebx, dword [ebp + 0x10]
mov dword [ebx], eax
mov dword [ebp - 0x18], esp
lea eax, [ebp - 8]
push eax
push 0x28
push dword [ebp - 4]
mov eax, 5
call fcn.004040fb
cmp dword [ebp - 0x18], esp
je 0x401824
push 6
call fcn.004040f5
add esp, 4
mov dword [ebp - 0x18], esp
push dword [ebp - 0xc]
mov ebx, dword [ebp + 0x10]
push dword [ebx]
push 0x4753ed
mov eax, 6
call fcn.004040fb
cmp dword [ebp - 0x18], esp
je 0x401850
push 6
call fcn.004040f5
add esp, 4
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 1
mov ebx, dword [ebp - 0x10]
add ebx, 4
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 8
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 0xc
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 2
mov dword [ebp - 0x18], esp
mov eax, 0
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x14]
push 0x1c
push dword [ebp - 0x10]
push 0
push dword [ebp - 8]
mov eax, 7
call fcn.004040fb
cmp dword [ebp - 0x18], esp
je 0x4018e4
push 6
call fcn.004040f5
add esp, 4
jmp 0x4018e9
push eax
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.004040e9
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.004040e9
add esp, 4
mov ebx, dword [ebp - 0x14]
push ebx
call fcn.004040e9
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40192f
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push esi
call 0x401938
pop eax
mov esi, dword fs:[0x30]
mov esi, dword [esi + 0xc]
mov esi, dword [esi + 0x1c]
push esi
mov ebx, dword [esi + 8]
cmp eax, ebx
jb 0x40195b
mov ecx, dword [esi + 0x10]
add ecx, ebx
cmp eax, ecx
ja 0x40195b
mov eax, ebx
jmp 0x401970
mov esi, dword [esi]
mov ebx, dword [esi]
cmp ebx, dword [esp]
jne 0x401947
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
pop esi
pop esi
leave
ret
Function at 0x4039fc
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
push 8
call fcn.004040ef
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.004040ef
add esp, 4
mov dword [ebp - 0x14], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x18], 0
push 0x10
call fcn.004040ef
add esp, 4
mov dword [ebp - 0x1c], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x20], esp
mov eax, 0xf
call fcn.004040fb
cmp dword [ebp - 0x20], esp
je 0x403ab9
push 6
call fcn.004040f5
add esp, 4
mov dword [ebp - 4], eax
mov eax, str.SeDebugPrivilege
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x403ad2
push ebx
call fcn.004040e9
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x20], esp
lea eax, [ebp - 0xc]
push eax
push 0x28
push dword [ebp - 4]
mov eax, 0x10
call fcn.004040fb
cmp dword [ebp - 0x20], esp
je 0x403b01
push 6
call fcn.004040f5
add esp, 4
mov dword [ebp - 0x20], esp
push dword [ebp - 0x10]
push dword [ebp - 8]
push 0x4753ed
mov eax, 0x11
call fcn.004040fb
cmp dword [ebp - 0x20], esp
je 0x403b2b
push 6
call fcn.004040f5
add esp, 4
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x20]
mov dword [ebx], 1
mov ebx, dword [ebp - 0x14]
add ebx, 8
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x10]
add ebx, 4
mov dword [ebp - 0x24], ebx
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x20]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x14]
add ebx, 4
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x24], ebx
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x20]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x14]
add ebx, 0xc
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x20]
mov dword [ebx], 2
mov dword [ebp - 0x20], esp
mov eax, 0
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x1c]
push 0x1c
push dword [ebp - 0x14]
push 0
push dword [ebp - 0xc]
mov eax, 0x12
call fcn.004040fb
cmp dword [ebp - 0x20], esp
je 0x403bbf
push 6
call fcn.004040f5
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], esp
push dword [ebp - 0xc]
mov eax, 0x13
call fcn.004040fb
cmp dword [ebp - 0x20], esp
je 0x403be4
push 6
call fcn.004040f5
add esp, 4
mov eax, dword [ebp - 0x18]
jmp 0x403bec
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x403bfd
push ebx
call fcn.004040e9
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.004040e9
add esp, 4
mov ebx, dword [ebp - 0x14]
push ebx
call fcn.004040e9
add esp, 4
mov ebx, dword [ebp - 0x1c]
push ebx
call fcn.004040e9
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x4090a0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x466e9b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0045bdab
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x409122
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00459cfa
mov eax, dword [eax]
push 0x485200
push eax
call fcn.0044c9c4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0045c036
test bl, bl
je 0x409122
push 0x485200
lea ecx, [esp + 0xc]
call fcn.0045c3c6
push 0x488d48
lea ecx, [esp + 0xc]
call fcn.0045c3c6
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40915e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0045c036
jmp 0x409229
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x4091e2
lea edx, [esp + 0x7c]
push 0x488d44
push edx
call fcn.0044c9c4
add esp, 8
test eax, eax
je 0x4091e2
lea eax, [esp + 0x7c]
push 0x488d40
push eax
call fcn.0044c9c4
add esp, 8
test eax, eax
je 0x4091e2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x409172
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0045c036
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x409a20
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x409a82
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc