joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f320
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
mov dword [eax + 0x1c], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
xor eax, eax
pop ebp
ret

Function at 0x42f410
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x1c]
mov edx, 0x40
cmp eax, edx
jb 0x42f429
lea eax, [edx - 0x30]
pop esi
pop ebp
ret
lea ecx, [eax*8]
add dword [esi], ecx
push ebx
mov ebx, 0
adc dword [esi + 4], ebx
push edi
mov byte [eax + esi + 0x20], 0x80
mov edi, 1
add dword [esi + 0x1c], edi
mov eax, dword [esi + 0x1c]
mov ecx, 0x38
cmp eax, ecx
jbe 0x42f482
cmp eax, edx
jae 0x42f46e
lea esp, [esp]
mov byte [eax + esi + 0x20], bl
add dword [esi + 0x1c], edi
mov eax, dword [esi + 0x1c]
cmp eax, edx
jb 0x42f460
lea edx, [esi + 0x20]
push esi
call fcn.0042ee20
add esp, 4
mov dword [esi + 0x1c], ebx
mov ecx, 0x38
cmp dword [esi + 0x1c], ecx
jae 0x42f49f
jmp 0x42f490
mov edx, dword [esi + 0x1c]
mov byte [esi + edx + 0x20], bl
add dword [esi + 0x1c], edi
cmp dword [esi + 0x1c], ecx
jb 0x42f490
movzx eax, byte [esi + 7]
movzx ecx, byte [esi + 6]
movzx edx, byte [esi + 5]
mov byte [esi + 0x58], al
movzx eax, byte [esi + 4]
mov byte [esi + 0x59], cl
movzx ecx, byte [esi + 3]
mov byte [esi + 0x5a], dl
movzx edx, byte [esi + 2]
mov byte [esi + 0x5b], al
movzx eax, byte [esi + 1]
mov byte [esi + 0x5c], cl
movzx ecx, byte [esi]
mov byte [esi + 0x5d], dl
lea edx, [esi + 0x20]
push esi
mov byte [esi + 0x5e], al
mov byte [esi + 0x5f], cl
call fcn.0042ee20
movzx edx, byte [esi + 0xb]
mov eax, dword [ebp + 0xc]
mov byte [eax], dl
movzx ecx, byte [esi + 0xa]
mov byte [eax + 1], cl
movzx edx, byte [esi + 9]
mov byte [eax + 2], dl
movzx ecx, byte [esi + 8]
mov byte [eax + 3], cl
movzx edx, byte [esi + 0xf]
mov byte [eax + 4], dl
movzx ecx, byte [esi + 0xe]
mov byte [eax + 5], cl
movzx edx, byte [esi + 0xd]
mov byte [eax + 6], dl
movzx ecx, byte [esi + 0xc]
mov byte [eax + 7], cl
movzx edx, byte [esi + 0x13]
mov byte [eax + 8], dl
movzx ecx, byte [esi + 0x12]
mov byte [eax + 9], cl
movzx edx, byte [esi + 0x11]
mov byte [eax + 0xa], dl
movzx ecx, byte [esi + 0x10]
mov byte [eax + 0xb], cl
movzx edx, byte [esi + 0x17]
mov byte [eax + 0xc], dl
movzx ecx, byte [esi + 0x16]
mov byte [eax + 0xd], cl
movzx edx, byte [esi + 0x15]
mov byte [eax + 0xe], dl
movzx ecx, byte [esi + 0x14]
mov byte [eax + 0xf], cl
movzx edx, byte [esi + 0x1b]
mov byte [eax + 0x10], dl
movzx ecx, byte [esi + 0x1a]
mov byte [eax + 0x11], cl
movzx edx, byte [esi + 0x19]
add esp, 4
mov byte [eax + 0x12], dl
movzx ecx, byte [esi + 0x18]
pop edi
pop ebx
mov byte [eax + 0x13], cl
xor eax, eax
pop esi
pop ebp
ret
Function at 0x42fbb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x23c], 0
jne 0x42fd04
mov eax, dword [esi + 0x240]
cmp eax, 0x10
jge 0x42fd04
test eax, eax
js 0x42fd04
mov eax, dword [esi + 0x234]
push eax
call fcn.00433bb0
add esp, 4
test eax, eax
jne 0x42fd09
mov ecx, dword [esi + 0x240]
mov eax, dword [ebp + 0x10]
lea edx, [ecx + eax]
cmp edx, 0xc
jbe 0x42fc0a
or dword [esi + 0x238], 1
push ebx
push edi
xor edi, edi
test ecx, ecx
jne 0x42fc65
mov ecx, eax
and ecx, 0xfffffff0
mov dword [ebp + 8], ecx
jbe 0x42fc5e
lea ebx, [esi + 0x1f4]
xor eax, eax
mov edx, dword [ebp + 0xc]
lea ecx, [eax + edi]
mov ecx, dword [ecx + edx]
xor dword [ebx + eax], ecx
add eax, 4
cmp eax, 0x10
jb 0x42fc24
push ebx
push esi
call fcn.00433b20
add esp, 8
add dword [esi + 0x248], 0x80
adc dword [esi + 0x24c], 0
add edi, 0x10
cmp edi, dword [ebp + 8]
jb 0x42fc22
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
add ebx, edi
jmp 0x42fc68
mov ebx, dword [ebp + 0xc]
cmp edi, eax
jae 0x42fcfd
sub eax, edi
mov dword [ebp + 8], eax
mov ecx, 1
lea ebx, [ebx]
mov al, byte [ebx]
mov edx, dword [esi + 0x240]
mov byte [esi + edx + 0x224], al
add dword [esi + 0x240], ecx
add ebx, ecx
cmp dword [esi + 0x240], 0x10
jne 0x42fcf3
lea edi, [esi + 0x1f4]
mov eax, edi
mov ecx, 4
lea ecx, [ecx]
movzx edx, byte [eax + 0x30]
xor byte [eax], dl
movzx edx, byte [eax + 0x31]
xor byte [eax + 1], dl
movzx edx, byte [eax + 0x32]
xor byte [eax + 2], dl
movzx edx, byte [eax + 0x33]
xor byte [eax + 3], dl
add eax, 4
dec ecx
jne 0x42fcb0
push edi
push esi
call fcn.00433b20
xor eax, eax
add esp, 8
add dword [esi + 0x248], 0x80
mov dword [esi + 0x240], eax
adc dword [esi + 0x24c], eax
mov ecx, 1
sub dword [ebp + 8], ecx
jne 0x42fc80
pop edi
pop ebx
xor eax, eax
pop esi
pop ebp
ret
mov eax, 0x10
pop esi
pop ebp
ret
Function at 0x431b80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
push edi
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 8
mov dword [ebp - 4], edi
cmp eax, edi
je 0x431c24
push esi
mov eax, dword [ebp + 0x10]
dec dword [ebp + 0xc]
test eax, eax
je 0x431bb1
call eax
dec dword [ebp - 8]
call fcn.0044e75b
mov esi, eax
call fcn.0044e75b
cmp esi, eax
jne 0x431bd0
xor edi, 1
call fcn.0044e75b
cmp esi, eax
je 0x431bc4
call fcn.0044e75b
mov esi, eax
call fcn.0044e75b
cmp esi, eax
jne 0x431bec
xor ebx, 1
call fcn.0044e75b
cmp esi, eax
je 0x431be0
cmp edi, ebx
je 0x431bb4
mov eax, dword [ebp - 4]
lea ecx, [eax + eax]
or ecx, edi
cmp dword [ebp - 8], 0
mov dword [ebp - 4], ecx
jne 0x431bb1
mov eax, dword [ebp + 8]
mov dl, cl
mov byte [eax], dl
inc eax
cmp dword [ebp + 0xc], 0
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
mov dword [ebp - 8], 8
jne 0x431ba5
mov eax, dword [ebp - 0xc]
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4337c0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x28], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0x3c6ef372
mov dword [eax + 0x14], 0xa54ff53a
mov dword [eax + 0x18], 0x510e527f
mov dword [eax + 0x1c], 0x9b05688c
mov dword [eax + 0x20], 0x1f83d9ab
mov dword [eax + 0x24], 0x5be0cd19
xor eax, eax
pop ebp
ret
Function at 0x4338c0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x28]
mov edx, 0x40
cmp eax, edx
jb 0x4338d9
lea eax, [edx - 0x30]
pop esi
pop ebp
ret
lea ecx, [eax*8]
add dword [esi], ecx
push ebx
mov ebx, 0
adc dword [esi + 4], ebx
push edi
mov byte [eax + esi + 0x2c], 0x80
mov edi, 1
add dword [esi + 0x28], edi
mov eax, dword [esi + 0x28]
mov ecx, 0x38
cmp eax, ecx
jbe 0x433932
cmp eax, edx
jae 0x43391e
lea esp, [esp]
mov byte [eax + esi + 0x2c], bl
add dword [esi + 0x28], edi
mov eax, dword [esi + 0x28]
cmp eax, edx
jb 0x433910
lea eax, [esi + 0x2c]
push esi
call fcn.00431d10
add esp, 4
mov dword [esi + 0x28], ebx
mov ecx, 0x38
cmp dword [esi + 0x28], ecx
jae 0x43394f
jmp 0x433940
mov edx, dword [esi + 0x28]
mov byte [esi + edx + 0x2c], bl
add dword [esi + 0x28], edi
cmp dword [esi + 0x28], ecx
jb 0x433940
movzx eax, byte [esi + 7]
movzx ecx, byte [esi + 6]
movzx edx, byte [esi + 5]
mov byte [esi + 0x64], al
movzx eax, byte [esi + 4]
mov byte [esi + 0x65], cl
movzx ecx, byte [esi + 3]
mov byte [esi + 0x67], al
movzx eax, byte [esi + 1]
mov byte [esi + 0x66], dl
movzx edx, byte [esi + 2]
mov byte [esi + 0x68], cl
movzx ecx, byte [esi]
mov byte [esi + 0x6a], al
lea eax, [esi + 0x2c]
push esi
mov byte [esi + 0x69], dl
mov byte [esi + 0x6b], cl
call fcn.00431d10
movzx edx, byte [esi + 0xb]
mov eax, dword [ebp + 0xc]
mov byte [eax], dl
movzx ecx, byte [esi + 0xa]
mov byte [eax + 1], cl
movzx edx, byte [esi + 9]
mov byte [eax + 2], dl
movzx ecx, byte [esi + 8]
mov byte [eax + 3], cl
movzx edx, byte [esi + 0xf]
mov byte [eax + 4], dl
movzx ecx, byte [esi + 0xe]
mov byte [eax + 5], cl
movzx edx, byte [esi + 0xd]
mov byte [eax + 6], dl
movzx ecx, byte [esi + 0xc]
mov byte [eax + 7], cl
movzx edx, byte [esi + 0x13]
mov byte [eax + 8], dl
movzx ecx, byte [esi + 0x12]
mov byte [eax + 9], cl
movzx edx, byte [esi + 0x11]
mov byte [eax + 0xa], dl
movzx ecx, byte [esi + 0x10]
mov byte [eax + 0xb], cl
movzx edx, byte [esi + 0x17]
mov byte [eax + 0xc], dl
movzx ecx, byte [esi + 0x16]
mov byte [eax + 0xd], cl
movzx edx, byte [esi + 0x15]
mov byte [eax + 0xe], dl
movzx ecx, byte [esi + 0x14]
mov byte [eax + 0xf], cl
movzx edx, byte [esi + 0x1b]
mov byte [eax + 0x10], dl
movzx ecx, byte [esi + 0x1a]
mov byte [eax + 0x11], cl
movzx edx, byte [esi + 0x19]
mov byte [eax + 0x12], dl
movzx ecx, byte [esi + 0x18]
mov byte [eax + 0x13], cl
movzx edx, byte [esi + 0x1f]
mov byte [eax + 0x14], dl
movzx ecx, byte [esi + 0x1e]
mov byte [eax + 0x15], cl
movzx edx, byte [esi + 0x1d]
mov byte [eax + 0x16], dl
movzx ecx, byte [esi + 0x1c]
mov byte [eax + 0x17], cl
movzx edx, byte [esi + 0x23]
mov byte [eax + 0x18], dl
movzx ecx, byte [esi + 0x22]
mov byte [eax + 0x19], cl
movzx edx, byte [esi + 0x21]
mov byte [eax + 0x1a], dl
movzx ecx, byte [esi + 0x20]
mov byte [eax + 0x1b], cl
movzx edx, byte [esi + 0x27]
mov byte [eax + 0x1c], dl
movzx ecx, byte [esi + 0x26]
add esp, 4
mov byte [eax + 0x1d], cl
movzx edx, byte [esi + 0x25]
mov byte [eax + 0x1e], dl
movzx ecx, byte [esi + 0x24]
pop edi
pop ebx
mov byte [eax + 0x1f], cl
xor eax, eax
pop esi
pop ebp
ret
Function at 0x433b20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
movzx eax, byte [edi]
add eax, eax
lea edx, [ecx + eax*8 + 0x258]
push 0x10
push edx
lea eax, [ebp - 0x10]
push eax
call fcn.0044cd60
add esp, 0xc
mov esi, 1
mov edx, 0x100
movzx ecx, byte [esi + edi]
mov ebx, dword [ebp + 8]
add ecx, edx
xor eax, eax
add ecx, ecx
lea ecx, [ebx + ecx*8 + 0x258]
jmp 0x433b70
mov ebx, dword [ecx]
xor dword [ebp + eax - 0x10], ebx
add eax, 4
add ecx, 4
cmp eax, 0x10
jl 0x433b70
add edx, 0x100
inc esi
cmp edx, 0x1000
jl 0x433b54
push 0x10
lea edx, [ebp - 0x10]
push edx
push edi
call fcn.0044cd60
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43d2f5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, edx
mov eax, edx
xor eax, dword [ebp + 0x10]
shr ecx, 5
inc ecx
cmp edx, ecx
jb 0x43d32c
push esi
push edi
mov esi, dword [ebp + 8]
movzx esi, byte [esi + edx - 1]
mov edi, eax
shl edi, 5
add esi, edi
mov edi, eax
shr edi, 2
add esi, edi
sub edx, ecx
xor eax, esi
cmp edx, ecx
jae 0x43d30c
pop edi
pop esi
pop ebp
ret

Function at 0x441493
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push esi
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 8]
mov esi, 0x200
call fcn.00435136
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.00434fd5
push dword [ebp + 0xc]
push esi
push 1
push eax
call fcn.0044c8ed
add esp, 0x20
jmp 0x4414f5
cmp esi, 0x3fffffff
ja 0x4414d9
add esi, esi
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.00434fd5
push dword [ebp + 0xc]
push esi
push 1
push eax
call fcn.0044c8ed
add esp, 0x18
add dword [ebp - 0x208], eax
cmp eax, esi
jae 0x4414cf
lea eax, [ebp - 0x210]
push eax
call fcn.0043509e
pop ecx
pop esi
leave
ret

Function at 0x44150f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push esi
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 8]
call fcn.00435136
push dword [ebp + 0x10]
lea eax, [ebp - 0x210]
push eax
call fcn.00434fd5
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push 1
push eax
call fcn.0044c8ed
mov esi, eax
add dword [ebp - 0x208], esi
lea eax, [ebp - 0x210]
push eax
call fcn.0043509e
xor eax, eax
add esp, 0x24
cmp eax, esi
sbb eax, eax
neg eax
pop esi
leave
ret

Function at 0x441800
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
mov ebx, eax
call fcn.004360e4
pop ecx
mov esi, eax
sub esi, ebx
push 1
pop edi
je 0x441891
push ebx
push dword [ebp + 8]
dec esi
call fcn.00436273
pop ecx
pop ecx
cmp eax, 3
jne 0x44185a
test edi, edi
je 0x441886
push 0
push ebx
push dword [ebp + 8]
call fcn.0043645c
fstp qword [esp + 4]
mov dword [esp], str._.14g
push dword [ebp + 0xc]
call fcn.00449f2d
add esp, 0x10
test eax, eax
jle 0x441886
xor edi, edi
inc edi
jmp 0x441888
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 8]
call fcn.00435c58
add esp, 0xc
test edi, edi
je 0x441886
push dword [ebp + 0xc]
xor edi, edi
push dword [ebp - 4]
inc edi
push edi
push eax
call fcn.0044b51e
add esp, 0x10
cmp eax, dword [ebp - 4]
je 0x441888
xor edi, edi
inc ebx
test esi, esi
jne 0x44181b
test edi, edi
je 0x441896
xor eax, eax
inc eax
jmp 0x4418a5
push 0
push 0
push dword [ebp + 8]
call fcn.00434dff
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret

Function at 0x453e09
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4997b8]
jne 0x453e13
repz ret
jmp fcn.00466cfc
Function at 0x46445e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x464485
call fcn.0044e8aa
mov dword [eax], esi
call fcn.0044e897
push 0x16
pop esi
mov dword [eax], esi
call fcn.00455842
mov eax, esi
jmp 0x4644da
test dword [ebp + 0xc], 0xfffffff9
jne 0x46446b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4644b2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0044e8bd
pop ecx
call fcn.0044e897
mov eax, dword [eax]
jmp 0x4644da
test al, 0x10
jne 0x4644d8
test al, 1
je 0x4644d8
test byte [ebp + 0xc], 2
je 0x4644d8
call fcn.0044e8aa
mov dword [eax], 5
call fcn.0044e897
mov dword [eax], 0xd
jmp 0x4644a9
xor eax, eax
pop esi
pop ebp
ret

Function at 0x468a8e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4997b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00458525
and dword [ebp - 0x14], 0
cmp dword [0x49e0cc], 0
mov dword [ebp - 0x18], eax
jne 0x468b41
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x468be9
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x468be9
mov esi, dword [section..data]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x49e0cc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x49e0d0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x49e0d4], eax
call edi
push eax
call esi
mov dword [0x49e0dc], eax
test eax, eax
je 0x468b41
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x49e0d8], eax
mov eax, dword [0x49e0d8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [0x499004]
cmp eax, ecx
je 0x468b9a
cmp dword [0x49e0dc], ecx
je 0x468b9a
push eax
call esi
push dword [0x49e0dc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x468b9a
test ebx, ebx
je 0x468b9a
call edi
test eax, eax
je 0x468b91
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x468b91
test byte [ebp - 8], 1
jne 0x468b9a
or dword [ebp + 0x10], 0x200000
jmp 0x468bcd
mov eax, dword [0x49e0d0]
cmp eax, dword [ebp - 0x18]
je 0x468bcd
push eax
call esi
test eax, eax
je 0x468bcd
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x468bcd
mov eax, dword [0x49e0d4]
cmp eax, dword [ebp - 0x18]
je 0x468bcd
push eax
call esi
test eax, eax
je 0x468bcd
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x49e0cc]
call esi
test eax, eax
je 0x468be9
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x468beb
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00453e09
leave
ret
Function at 0x401000
Capabilities:
Get windows directory from kuser_shared_data
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x448
call fcn.00401190
xor eax, eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov word [esp + 0x44], ax
lea eax, [esp + 0x2c]
push eax
push 0x1e
push 0x4b6b20
call fcn.00403a30
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov byte [esp + 0x20], al
lea eax, [esp + 0xc]
push eax
push 0x19
push 0x4b6b8c
call fcn.00403a30
lea eax, [esp + 0x44]
push 0
push eax
call fcn.00401aa0
add esp, 0x20
test eax, eax
je 0x401182
push esi
mov esi, dword [eax + 0x18]
push edi
call fcn.00401190
test esi, esi
je 0x4010bb
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4010bb
mov ecx, dword [eax + esi + 0x7c]
test ecx, ecx
je 0x4010bb
mov eax, dword [eax + esi + 0x78]
test eax, eax
je 0x4010bb
lea edx, [esp + 8]
push edx
push ecx
lea edx, [eax + esi]
mov ecx, esi
call fcn.004035a0
add esp, 8
mov edi, eax
test edi, edi
jne 0x4010da
mov eax, dword [0x7ff450]
test eax, eax
je 0x401180
lea ecx, [esp + 8]
push ecx
push esi
call eax
mov edi, eax
test edi, edi
je 0x401180
xor eax, eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
lea eax, [esp + 0x20]
push eax
push 0x18
push 0x4b6b54
call fcn.00403a30
push 0x400
lea eax, [esp + 0x60]
push 0
push eax
call fcn.004018d0
mov ecx, 0x7ffe0030
add esp, 0x18
xor edx, edx
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401120
sub ecx, esi
sar ecx, 1
je 0x401180
add ecx, 0xb
cmp ecx, 0x200
ja 0x401180
xor eax, eax
test ecx, ecx
je 0x40115a
movzx esi, word [edx + edx + 0x7ffe0030]
test si, si
je 0x40115a
mov word [esp + edx*2 + 0x50], si
inc eax
inc edx
cmp eax, ecx
jb 0x401142
xor eax, eax
test ecx, ecx
je 0x401179
lea edx, [esp + edx*2 + 0x50]
movzx esi, word [esp + eax*2 + 0x20]
test si, si
je 0x401179
mov word [edx], si
inc eax
add edx, 2
cmp eax, ecx
jb 0x401164
lea eax, [esp + 0x50]
push eax
call edi
pop edi
pop esi
add esp, 0x448
ret
Function at 0x401550
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
sub esp, 0x20c
push ebx
push ebp
mov ebp, dword [0x7ff458]
push esi
push edi
mov edi, ecx
test ebp, ebp
je 0x40167a
cmp dword [0x7ff45c], 0
jne 0x401665
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov word [esp + 0x18], ax
mov byte [esp + 0x1a], al
lea eax, [esp + 0x10]
push eax
push 0xf
push 0x4b6bbc
call fcn.00403a30
push 0x200
lea eax, [esp + 0x2c]
push 0
push eax
call fcn.004018d0
mov edx, 0x7ffe0030
add esp, 0x18
xor ecx, ecx
lea esi, [edx + 2]
lea esp, [esp]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4015c0
sub edx, esi
sar edx, 1
je 0x40167a
mov esi, edi
lea ebx, [esi + 1]
lea ebx, [ebx]
mov al, byte [esi]
inc esi
test al, al
jne 0x4015e0
sub esi, ebx
add edx, 0xc
add edx, esi
cmp edx, 0x200
ja 0x40167a
xor eax, eax
test edx, edx
je 0x401617
movzx ebx, word [eax + eax + 0x7ffe0030]
test bx, bx
je 0x401617
mov byte [esp + eax + 0x1c], bl
inc ecx
inc eax
cmp eax, edx
jb 0x401600
xor eax, eax
test edx, edx
je 0x401632
lea ecx, [ecx]
mov bl, byte [esp + eax + 0x10]
test bl, bl
je 0x401632
mov byte [esp + ecx + 0x1c], bl
inc eax
inc ecx
cmp eax, edx
jb 0x401620
xor eax, eax
test edx, edx
je 0x40164f
lea ecx, [esp + ecx + 0x1c]
lea esp, [esp]
mov bl, byte [eax + edi]
test bl, bl
je 0x40164f
mov byte [ecx], bl
inc eax
inc ecx
cmp eax, edx
jb 0x401640
push 8
push 0
lea eax, [esp + 0x24]
push eax
call ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20c
ret
push 0x800
push 0
push edi
call ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20c
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20c
ret
Function at 0x402120
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x100
lea eax, [esp]
mov dword [esp], 0x58517e2b
push 0x100
push eax
mov dword [esp + 0xc], 0x13ac835e
mov dword [esp + 0x10], 0xd2b3bd2c
mov dword [esp + 0x14], 0x996cfca5
mov dword [esp + 0x18], 0xfff3d4d
mov dword [esp + 0x1c], 0x8f1ba038
mov dword [esp + 0x20], 0xedb4476a
mov dword [esp + 0x24], 0xf8824c8b
mov dword [esp + 0x28], 0xaf8ff94d
mov dword [esp + 0x2c], 0x536a24ec
mov dword [esp + 0x30], 0xe72ccd07
mov dword [esp + 0x34], 0xde0d8cde
mov dword [esp + 0x38], 0xbeeafc6
mov dword [esp + 0x3c], 0x88265666
mov dword [esp + 0x40], 0xbab25fd6
mov dword [esp + 0x44], 0x82dfa1aa
mov dword [esp + 0x48], 0x7ae9b34a
mov dword [esp + 0x4c], 0xc31662ae
mov dword [esp + 0x50], 0xcdadff6f
mov dword [esp + 0x54], 0xa1af6477
mov dword [esp + 0x58], 0x8be834f6
mov dword [esp + 0x5c], 0x52997ba6
mov dword [esp + 0x60], 0xfe329a92
mov dword [esp + 0x64], 0x3ba3ac15
mov dword [esp + 0x68], 0xb690baf2
mov dword [esp + 0x6c], 0xaeb10bbc
mov dword [esp + 0x70], 0xf416b3c5
mov dword [esp + 0x74], 0x7b899c0f
mov dword [esp + 0x78], 0xd962bc6b
mov dword [esp + 0x7c], 0x20db9606
mov dword [esp + 0x80], 0xab535ccf
mov dword [esp + 0x84], 0x91d94f4d
mov dword [esp + 0x88], 0x2f8e25af
mov dword [esp + 0x8c], 0x77b98314
mov dword [esp + 0x90], 0xd07c1f47
mov dword [esp + 0x94], 0x80cf8d13
mov dword [esp + 0x98], 0xe2f9aaa6
mov dword [esp + 0x9c], 0x33884e9b
mov dword [esp + 0xa0], 0xb3530d4
mov dword [esp + 0xa4], 0x889f7e88
mov dword [esp + 0xa8], 0xe9463cd3
mov dword [esp + 0xac], 0x48498625
mov dword [esp + 0xb0], 0x2fdde30f
mov dword [esp + 0xb4], 0x19a5d680
mov dword [esp + 0xb8], 0xa997a8bc
mov dword [esp + 0xbc], 0xdb18588f
mov dword [esp + 0xc0], 0x5f6b4f7a
mov dword [esp + 0xc4], 0x7ec1e03
mov dword [esp + 0xc8], 0xf8e38976
mov dword [esp + 0xcc], 0x814b84d2
mov dword [esp + 0xd0], 0xaa365f7e
mov dword [esp + 0xd4], 0x698ea25c
mov dword [esp + 0xd8], 0x8ab5cefa
mov dword [esp + 0xdc], 0xde70846b
mov dword [esp + 0xe0], 0x875f69b1
mov dword [esp + 0xe4], 0xebd18a4c
mov dword [esp + 0xe8], 0x263a086e
mov dword [esp + 0xec], 0x5fe4c36a
mov dword [esp + 0xf0], 0x81309fa
mov dword [esp + 0xf4], 0x188289c3
mov dword [esp + 0xf8], 0xd892cd4e
mov dword [esp + 0xfc], 0x756f5732
mov dword [esp + 0x100], 0x9ce153d1
mov dword [esp + 0x104], 0x5f8ecf57
call fcn.004039e0
push 0x4b7048
push 0x100
lea eax, [esp + 0x10]
push eax
push 0x347800
push 0x4b7048
call fcn.004038b0
mov eax, dword [esp + 0x120]
mov dword [eax], 0x4b7048
add esp, 0x11c
ret