joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433250
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov ebx, edx
mov edi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [0x5c4738]
xor eax, ebp
mov dword [esp + 0x48], eax
movzx eax, byte [ecx + 0xb]
test al, al
jns 0x433279
mov eax, dword [ecx + 4]
test eax, eax
je 0x433378
mov eax, 0x300
mov ecx, ebx
and ecx, eax
cmp ecx, eax
je 0x433378
cmp edi, 2
mov eax, 0x5c78ae
mov ecx, 0x5c7aae
cmove ecx, eax
cmp word [ecx], 0
jne 0x433378
xorps xmm0, xmm0
lea esi, [esp + 0x20]
movaps xmmword [esi + 0x10], xmm0
movaps xmmword [esi], xmm0
mov dword [esi + 0x20], 0
push esi
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [esi], 0
je 0x433378
cmp byte [0x5c78ac], 0
setne al
bt ebx, 8
jb 0x433378
shr ebx, 9
and ebx, 1
or bl, al
je 0x433378
cmp edi, 2
mov eax, 0x587734
mov edx, 0x587748
cmove edx, eax
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0xb]
test cl, cl
jns 0x4333c6
mov ecx, dword [eax]
mov dword [esp + 4], ecx
mov ecx, dword [eax + 4]
xor eax, eax
inc eax
mov dword [esp + 0x18], eax
xor edi, edi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 0x10], 0
mov ebx, dword [edx + 4]
mov esi, ecx
sub ecx, ebx
mov dword [esp + 0x14], ecx
jb 0x433365
push ebx
push dword [edx]
push dword [esp + 0xc]
mov dword [esp + 0x28], edx
call fcn.004d13e5
mov edx, dword [esp + 0x28]
add esp, 0xc
test eax, eax
je 0x43338b
add edx, 0x14
inc edi
mov ecx, esi
cmp edi, dword [esp + 0x18]
jb 0x43333d
cmp dword [esp + 0x10], 0
jne 0x4333cf
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.004d25a3
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esp + 4]
movzx ecx, word [eax + ebx*2]
cmp cx, 0x5c
je 0x43339e
test cx, cx
jne 0x433365
mov eax, dword [esp + 4]
lea eax, [eax + ebx*2]
mov edx, dword [edx + 8]
mov dword [esp + 0x10], edx
cmp edx, 1
je 0x4333f2
cmp dword [esp + 0x10], 2
jne 0x433402
mov dword [esp + 0xc], str.WOW6432Node
mov dword [esp + 8], eax
jmp 0x433402
mov dword [esp + 4], eax
jmp 0x43331c
mov eax, dword [ebp + 8]
cmp byte [eax + 0xb], 0
js 0x43343d
mov eax, dword [ebp + 8]
mov edx, dword [esp + 8]
sub edx, eax
sar edx, 1
mov ecx, dword [ebp + 8]
push dword [esp + 0xc]
push edx
call fcn.0041f270
jmp 0x433378
mov dword [esp + 0xc], str.WOW6432Node_
mov edx, dword [esp + 4]
mov dword [esp + 8], edx
cmp cx, 0x5c
jne 0x43341e
lea ecx, [eax + 2]
dec dword [esp + 0x14]
cmp word [eax + 2], 0x5c
mov dword [esp + 4], ecx
mov eax, ecx
je 0x433408
jmp 0x433422
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0x10]
mov dword [esp + 0x18], ecx
mov eax, dword [eax + 0xc]
xor edi, edi
mov edx, eax
mov ecx, dword [esp + 0x14]
jmp 0x43336b
mov eax, dword [ebp + 8]
mov eax, dword [eax]
jmp 0x4333db
Function at 0x4335b0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20c
mov edi, dword [ebp + 8]
mov eax, dword [0x5c4738]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x216]
push 0x206
push 0xff
push esi
call fcn.004d5a00
add esp, 0xc
mov word [esi - 2], 0
lea eax, [ebp - 0x218]
push 0x104
push eax
push str.PROGRAMFILES
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
dec eax
cmp eax, 0x102
ja 0x433641
test esi, esi
je 0x433641
mov ebx, esi
dec esi
cmp word [ebp + ebx*2 - 0x21a], 0x5c
je 0x433609
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x433625
mov eax, dword [edi]
lea ecx, [esi + 1]
push ecx
lea ecx, [ebp - 0x218]
push ecx
push eax
call fcn.004d13e5
add esp, 0xc
test eax, eax
je 0x433718
mov word [ebp - 0x218], 0
push 0x104
lea eax, [ebp - 0x218]
push eax
push str.PROGRAMFILES_X86_
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
dec eax
cmp eax, 0x102
ja 0x4336a2
inc esi
cmp esi, 1
je 0x4336a2
mov ebx, esi
dec esi
cmp word [ebp + ebx*2 - 0x21c], 0x5c
je 0x43366c
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x433689
mov eax, dword [edi]
push esi
lea ecx, [ebp - 0x218]
push ecx
push eax
call fcn.004d13e5
add esp, 0xc
test eax, eax
je 0x433743
mov word [ebp - 0x218], 0
push 0x104
lea eax, [ebp - 0x218]
push eax
push str.PROGRAMW6432
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
dec eax
cmp eax, 0x102
ja 0x4336ff
inc esi
cmp esi, 1
je 0x4336ff
mov ebx, esi
dec esi
cmp word [ebp + ebx*2 - 0x21c], 0x5c
je 0x4336cd
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x4336ea
mov eax, dword [edi]
push esi
lea ecx, [ebp - 0x218]
push ecx
push eax
call fcn.004d13e5
add esp, 0xc
test eax, eax
je 0x43376c
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d25a3
mov eax, ebx
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret
movzx eax, byte [edi + 0xb]
mov ecx, eax
test al, al
jns 0x433725
mov ecx, dword [edi + 4]
sub esi, ecx
cmp esi, 0xffffffff
je 0x433796
mov ecx, edi
test al, al
jns 0x433734
mov ecx, dword [edi]
cmp word [ecx + ebx*2], 0x5c
mov bl, 1
jne 0x433641
jmp 0x433701
movzx eax, byte [edi + 0xb]
mov ecx, eax
test al, al
jns 0x433750
mov ecx, dword [edi + 4]
cmp ecx, esi
je 0x433796
mov ecx, edi
test al, al
jns 0x43375c
mov ecx, dword [edi]
cmp word [ecx + ebx*2 - 2], 0x5c
mov bl, 1
jne 0x4336a2
jmp 0x433701
movzx eax, byte [edi + 0xb]
mov ecx, eax
test al, al
jns 0x433779
mov ecx, dword [edi + 4]
cmp ecx, esi
je 0x433796
test al, al
jns 0x433783
mov edi, dword [edi]
cmp word [edi + ebx*2 - 2], 0x5c
mov bl, 1
jne 0x4336ff
jmp 0x433701
mov bl, 1
jmp 0x433701
Function at 0x4348e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov dword [esp + 0x44], ecx
mov eax, dword [0x5c4738]
xor eax, ebp
mov dword [esp + 0x78], eax
test byte [0x5c3290], 0x19
je 0x4349ac
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [esp + 0x3c], ecx
mov esi, dword [eax + 4]
call fcn.004ba5a0
mov dword [esp + 0x40], eax
xor eax, eax
dec eax
lea edi, [esp + 0x48]
mov dword [edi + 4], eax
mov dword [edi], eax
mov dword [esp], edi
call fcn.004bb520
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x50]
movdqa xmmword [ebx], xmm0
movdqa xmmword [ebx + 0x10], xmm0
mov word [ebx], 0x602
mov byte [ebx + 2], 6
mov dword [ebx + 4], str.file_name
mov dword [ebx + 8], str.function_name
mov dword [ebx + 0x10], esi
mov eax, dword [esp + 0x3c]
mov dword [ebx + 0x18], eax
xor eax, eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], edi
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], eax
pxor xmm0, xmm0
movdqu xmmword [esp + 0xc], xmm0
mov dword [esp + 8], str.ScopedAllowIO
mov dword [esp + 4], 0x5c3290
mov dword [esp], 0x42
call fcn.004c1190
mov al, byte [ebx]
test al, al
jne 0x4349c5
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.004d25a3
mov eax, dword [esp + 0x44]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
cmp byte [esp + 0x51], 8
jne 0x4349e6
mov ecx, dword [esp + 0x60]
test ecx, ecx
je 0x4349e6
mov eax, dword [ecx]
mov dword [esp], 1
call dword [eax]
sub esp, 4
mov al, byte [esp + 0x50]
cmp al, 2
jb 0x4349ac
xor edi, edi
inc edi
cmp byte [esp + edi + 0x51], 8
jne 0x434a0e
mov ecx, dword [esp + edi*8 + 0x60]
test ecx, ecx
je 0x434a0e
mov eax, dword [ecx]
mov dword [esp], 1
call dword [eax]
sub esp, 4
mov al, byte [esp + 0x50]
inc edi
movzx ecx, al
cmp edi, ecx
jae 0x4349ac
jmp 0x4349ed
Function at 0x435430
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x270
mov eax, dword [0x5c4738]
xor eax, ebp
mov dword [esp + 0x268], eax
xor eax, eax
dec eax
lea esi, [esp + 0x20]
mov dword [esi + 0x34], eax
mov dword [esi + 0x30], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea edi, [esp + 0x60]
push 0x3f4
push str..._.._base_files_file_util_win.cc
push 0x57e0fb
push edi
call fcn.004c10c0
add esp, 0x10
mov ecx, esi
push 0
push edi
call fcn.004c7be0
lea esi, [esp + 0x62]
push 0x206
push 0xff
push esi
call fcn.004d5a00
add esp, 0xc
mov word [esi - 2], 0
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
dec esi
cmp esi, 0x103
ja 0x4354ff
push edi
call fcn.004d00f2
add esp, 4
lea ebx, [esp + 8]
mov ecx, ebx
push eax
push edi
call fcn.004cae90
lea edi, [esp + 0x14]
mov ecx, ebx
push edi
call fcn.004291a0
mov ecx, dword [ebp + 8]
push edi
call fcn.00411710
mov ecx, edi
call fcn.004c5e70
mov ecx, ebx
call fcn.004c5e70
cmp esi, 0x104
setb bl
lea ecx, [esp + 0x20]
call fcn.004c7b60
mov ecx, dword [esp + 0x268]
xor ecx, ebp
call fcn.004d25a3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x436e30
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov eax, dword [0x5c4738]
xor eax, ebp
mov dword [esp + 0x30], eax
mov eax, dword [0x5c8020]
mov ecx, dword [0x5c7534]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 0x18]
jle 0x436ebc
push 0x5c8020
call fcn.004d02b9
add esp, 4
cmp dword [0x5c8020], 0xffffffff
jne 0x436ebc
xorps xmm0, xmm0
mov esi, esp
movaps xmmword [esi + 0x10], xmm0
movaps xmmword [esi], xmm0
mov dword [esi + 0x20], 0
push esi
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [esi + 0x20]
mov dword [0x5c801c], eax
movaps xmm0, xmmword [esi]
movaps xmm1, xmmword [esi + 0x10]
movups xmmword [0x5c800c], xmm1
movups xmmword [0x5c7ffc], xmm0
push 0x5c8020
call fcn.004d03d3
add esp, 4
movzx eax, word [0x5c7ffc]
cmp ax, 9
jne 0x436edf
xor esi, esi
inc esi
mov ecx, dword [esp + 0x30]
xor ecx, ebp
call fcn.004d25a3
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
xor esi, esi
test ax, ax
je 0x436ecc
cmp ax, 6
jne 0x436ef3
mov esi, 2
jmp 0x436ecc
cmp ax, 0xc
jne 0x436f00
mov esi, 3
jmp 0x436ecc
mov esi, 4
jmp 0x436ecc

Function at 0x436f70
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov ebx, dword [ecx + 0x1c]
mov edi, dword [ecx + 0x20]
cmp ebx, edi
je 0x43700b
mov esi, edx
mov dword [ebp - 0x10], edx
cmp dword [ebx + 0x50], esi
jne 0x436ff7
cmp byte [ebx + 0x1b], 0
jns 0x436f9a
mov eax, dword [ebx + 0x10]
jmp 0x436f9d
lea eax, [ebx + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
mov eax, dword [ebp + 8]
jne 0x436ff7
mov esi, dword [eax + 4]
cmp esi, dword [eax + 8]
je 0x437000
movups xmm0, xmmword [ebx]
movups xmmword [esi], xmm0
lea ecx, [esi + 0x10]
lea eax, [ebx + 0x10]
push eax
call fcn.00407430
lea ecx, [esi + 0x1c]
lea eax, [ebx + 0x1c]
push eax
call section..text
movups xmm0, xmmword [ebx + 0x28]
movups xmm1, xmmword [ebx + 0x38]
movups xmmword [esi + 0x28], xmm0
movups xmmword [esi + 0x38], xmm1
movsd xmm0, qword [ebx + 0x48]
movsd qword [esi + 0x48], xmm0
add esi, 0x50
mov eax, dword [ebp + 8]
mov dword [eax + 4], esi
mov esi, dword [ebp - 0x10]
add ebx, 0x58
cmp edi, ebx
jne 0x436f8a
jmp 0x43700b
mov ecx, dword [ebp + 8]
push ebx
call fcn.0054cdb0
jmp 0x436ff4
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x439c80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x280
mov eax, dword [0x5c4738]
xor eax, ebp
mov dword [esp + 0x278], eax
lea edi, [esp + 0x70]
push 0x208
push 0xff
push edi
call fcn.004d5a00
add esp, 0xc
call fcn.00502470
movzx ecx, byte [eax + 0xb]
test cl, cl
jns 0x439cc4
mov ecx, dword [eax + 4]
mov bl, byte [ebp + 0xc]
test ecx, ecx
jne 0x439d87
xor edx, edx
mov ecx, eax
push edx
push 0x579d68
push 0xffffffffffffffff
push edx
call fcn.004ca4a0
test eax, eax
jne 0x439d87
movzx eax, bl
push eax
push 0x1a
push edi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x439da8
xor eax, eax
dec eax
lea esi, [esp + 0xc]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
push edi
call fcn.004d00f2
add esp, 4
mov edx, edi
lea edi, [esp + 0x18]
mov ecx, edi
push eax
push edx
call fcn.004cae90
mov ecx, edi
push 6
push 0x57a052
push esi
call fcn.00411970
mov ecx, edi
call fcn.004c5e70
test bl, bl
je 0x439d52
push esi
call fcn.0040a6a0
add esp, 4
test al, al
je 0x439e0c
lea ecx, [esp + 0xc]
push 2
push 0x57a07a
mov esi, dword [ebp + 8]
push esi
call fcn.00411970
lea ecx, [esp + 0xc]
call fcn.004c5e70
mov ecx, dword [esp + 0x278]
xor ecx, ebp
call fcn.004d25a3
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.00502470
cmp byte [eax + 0xb], 0
jns 0x439d94
mov eax, dword [eax]
push 0x104
push eax
push edi
call fcn.004d14b0
add esp, 0xc
jmp 0x439d00
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esp + 0xc]
push eax
push esi
call fcn.00501dd0
add esp, 8
lea edi, [esp + 0x18]
mov ecx, edi
push esi
push 0x4b
push str.GetUserIdFilePath
push 1
call fcn.00501b30
lea ecx, [esp + 0x54]
push 0x57a050
push str.Cant_get_path_to_AppData_folder
call fcn.004fc970
mov ecx, edi
call fcn.00501b70
cmp byte [esi + 0xb], 0
jns 0x439dfd
push dword [esp + 0xc]
call fcn.004cf0d6
add esp, 4
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.0041a390
jmp 0x439d6f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, esp
push eax
push ebx
call fcn.00501dd0
add esp, 8
lea edi, [esp + 0x18]
mov ecx, edi
push ebx
push 0x52
push str.GetUserIdFilePath
push 1
call fcn.00501b30
lea ecx, [esp + 0x54]
push 0x57a078
push str.Cant_create_directory:
call fcn.004fc970
lea ecx, [esp + 0x20]
push esi
call fcn.004fefd0
mov ecx, edi
call fcn.00501b70
cmp byte [ebx + 0xb], 0
jns 0x439e68
push dword [esp]
call fcn.004cf0d6
add esp, 4
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.0041a390
jmp 0x439d66
Function at 0x43d620
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov dword [esp + 0x44], edx
mov eax, dword [0x5c4738]
xor eax, ebp
mov dword [esp + 0x78], eax
test ecx, ecx
je 0x43d6e2
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x50]
movdqa xmmword [ebx], xmm0
movdqa xmmword [ebx + 0x10], xmm0
mov word [ebx], 0x301
mov dword [ebx + 4], ecx
movsd xmm0, qword [eax]
movsd qword [ebx + 0x10], xmm0
xor eax, eax
dec eax
lea edi, [esp + 0x48]
mov dword [edi + 4], eax
mov dword [edi], eax
mov dword [esp], edi
call fcn.004bb520
mov eax, dword [0x57f95c]
mov ecx, dword [edi]
mov edx, dword [edi + 4]
xor edi, edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x38], edi
mov edi, dword [ebp + 8]
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], eax
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov eax, dword [esp + 0x44]
mov dword [esp], eax
mov dword [esp + 0x3c], ebx
xorps xmm0, xmm0
movups xmmword [esp + 0x28], xmm0
movaps xmm0, xmmword [0x579330]
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 0x1c], 0x4d
mov ecx, esi
call fcn.00426390
sub esp, 0x44
mov al, byte [ebx]
test al, al
jne 0x43d6f5
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.004d25a3
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
cmp byte [esp + 0x51], 8
jne 0x43d716
mov ecx, dword [esp + 0x60]
test ecx, ecx
je 0x43d716
mov eax, dword [ecx]
mov dword [esp], 1
call dword [eax]
sub esp, 4
mov al, byte [esp + 0x50]
cmp al, 2
jb 0x43d6e2
xor esi, esi
inc esi
cmp byte [esp + esi + 0x51], 8
jne 0x43d73e
mov ecx, dword [esp + esi*8 + 0x60]
test ecx, ecx
je 0x43d73e
mov eax, dword [ecx]
mov dword [esp], 1
call dword [eax]
sub esp, 4
mov al, byte [esp + 0x50]
inc esi
movzx ecx, al
cmp esi, ecx
jae 0x43d6e2
jmp 0x43d71d
Function at 0x43f170
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov edi, dword [ebp + 8]
movzx eax, word [ebp + 0xc]
mov ecx, dword [0x5c4738]
xor ecx, ebp
mov dword [esp + 0x18], ecx
mov ecx, edi
shr ecx, 4
inc ecx
movzx ecx, cx
push eax
push ecx
push 6
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x43f1dc
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x43f1dc
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test eax, eax
je 0x43f2ef
mov ecx, edi
and ecx, 0xf
je 0x43f1e3
lea eax, [ecx - 1]
and edi, 7
cmp eax, 7
jae 0x43f1e7
mov ebx, esi
jmp 0x43f236
xor ebx, ebx
jmp 0x43f2f4
mov ebx, esi
jmp 0x43f246
mov eax, edi
sub eax, ecx
mov ebx, esi
movzx ecx, word [ebx]
lea ecx, [ebx + ecx*2]
movzx edx, word [ecx + 2]
lea ecx, [ecx + edx*2]
add ecx, 2
movzx edx, word [ecx + 2]
lea ecx, [ecx + edx*2 + 2]
movzx edx, word [ecx + 2]
lea ecx, [ecx + edx*2 + 2]
movzx edx, word [ecx + 2]
lea ecx, [ecx + edx*2 + 2]
movzx edx, word [ecx + 2]
lea ecx, [ecx + edx*2 + 2]
movzx edx, word [ecx + 2]
lea ecx, [ecx + edx*2]
add ecx, 2
movzx edx, word [ecx + 2]
lea ebx, [ecx + edx*2]
add ebx, 4
add eax, 8
jne 0x43f1ed
test edi, edi
je 0x43f246
movzx eax, word [ebx]
lea ebx, [ebx + eax*2]
add ebx, 2
dec edi
jne 0x43f23a
movzx ecx, word [ebx]
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 0x10], eax
cmp ecx, 5
jae 0x43f26a
lea edi, [esp + 8]
mov byte [edi + 0xb], cl
test cx, cx
jne 0x43f29c
jmp 0x43f2b1
mov dword [esp + 4], esi
lea esi, [ecx + 8]
and esi, 0xfffffff8
lea eax, [esi + esi]
push eax
mov edi, ecx
call fcn.004cf0a6
mov ecx, edi
add esp, 4
mov edi, eax
mov dword [esp + 8], eax
or esi, 0x80000000
mov dword [esp + 0x10], esi
mov esi, dword [esp + 4]
mov dword [esp + 0xc], ecx
add ebx, 2
lea eax, [ecx + ecx]
push eax
push ebx
push edi
mov ebx, ecx
call fcn.004d4f00
mov ecx, ebx
add esp, 0xc
mov word [edi + ecx*2], 0
mov edi, dword [ebp + 0x10]
cmp byte [edi + 0xb], 0
jns 0x43f2de
mov eax, dword [edi]
mov word [eax], 0
mov dword [edi + 4], 0
cmp byte [edi + 0xb], 0
jns 0x43f2de
push dword [edi]
call fcn.004cf0d6
add esp, 4
mov eax, dword [esp + 0x10]
mov dword [edi + 8], eax
movsd xmm0, qword [esp + 8]
movsd qword [edi], xmm0
test esi, esi
setne bl
mov ecx, dword [esp + 0x18]
xor ecx, ebp
call fcn.004d25a3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x441d50
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24c
mov esi, ecx
mov eax, dword [0x5c4738]
xor eax, ebp
mov dword [ebp - 0x10], eax
call fcn.004294b0
cmp eax, 2
jg 0x441e99
push 0x20
call fcn.004cf0a6
add esp, 4
mov dword [ebp - 0x248], eax
mov dword [ebp - 0x240], 0x80000010
mov dword [ebp - 0x244], 0xc
movsd xmm0, qword [0x584802]
movsd qword [eax + 0x10], xmm0
movups xmm0, xmmword [str.explorer.exe]
movups xmmword [eax], xmm0
mov word [eax + 0x18], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
xor ebx, ebx
mov eax, 0
test edi, edi
je 0x441dee
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp edi, 0xffffffff
je 0x441f8d
call fcn.004bafe0
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
mov eax, edi
lea ecx, [eax + 1]
cmp ecx, 2
mov edi, eax
jb 0x441f22
mov dword [ebp - 0x24c], ecx
mov dword [ebp - 0x250], esi
lea esi, [ebp - 0x238]
push 0x228
push 0
push esi
call fcn.004d5a00
add esp, 0xc
mov dword [esi - 4], 0x22c
lea eax, [ebp - 0x23c]
push eax
mov dword [ebp - 0x254], edi
push edi
call sub.KERNEL32.dll_Process32FirstW
xor ebx, ebx
test eax, eax
je 0x441eb7
mov bl, 0x80
mov edi, 0xc
lea esi, [ebp - 0x218]
push esi
call fcn.004d00f2
add esp, 4
test bl, bl
movzx ecx, bl
cmovs ecx, edi
cmp eax, ecx
jne 0x441e75
lea ecx, [ebp - 0x248]
push eax
push esi
push 0xffffffffffffffff
push 0
call fcn.004ca4a0
test eax, eax
je 0x441ebf
lea eax, [ebp - 0x23c]
push eax
push dword [ebp - 0x254]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x441ead
mov bl, byte [ebp - 0x23d]
mov edi, dword [ebp - 0x244]
jmp 0x441e4b
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
push esi
push eax
call sub.WTSAPI32.dll_WTSQueryUserToken
mov esi, eax
jmp 0x441f71
mov esi, dword [ebp - 0x250]
xor ebx, ebx
jmp 0x441f16
mov esi, dword [ebp - 0x250]
jmp 0x441f16
mov eax, dword [ebp - 0x234]
test eax, eax
mov esi, dword [ebp - 0x250]
mov ebx, 0
je 0x441f16
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
mov ecx, dword [ebp - 0x24c]
je 0x441f1c
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x258], eax
cmp edi, 0xffffffff
je 0x441f94
call fcn.004bafe0
mov ebx, edi
push dword [ebp - 0x258]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 0x24c]
mov edi, dword [ebp - 0x254]
cmp ecx, 2
jb 0x441f35
call fcn.004bafe0
push edi
call fcn.004c1b90
add esp, 4
cmp byte [ebp - 0x23d], 0
jns 0x441f4c
push dword [ebp - 0x248]
call fcn.004cf0d6
add esp, 4
push esi
push 0xf01ff
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov esi, eax
lea eax, [ebx + 1]
cmp eax, 2
jb 0x441f71
call fcn.004bafe0
push ebx
call fcn.004c1b90
add esp, 4
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d25a3
mov eax, ebx
add esp, 0x24c
pop esi
pop edi
pop ebx
pop ebp
ret
xor edi, edi
jmp 0x441de3
xor ebx, ebx
jmp 0x441f0a
Function at 0x444f70
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov esi, ecx
mov eax, dword [0x5c4738]
xor eax, ebp
mov dword [esp + 0x28], eax
xor eax, eax
lea ecx, [esp + 0x24]
mov dword [ecx], eax
push ecx
push eax
push 2
call sub.Secur32.dll_GetUserNameExW
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x44500b
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x44500b
mov dword [esp], esi
xor edi, edi
mov esi, ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
inc esi
je 0x44501c
test esi, esi
js 0x4450f8
lea eax, [esi + esi]
mov dword [esp + 4], eax
push eax
call fcn.004cf0a6
add esp, 4
mov edi, eax
mov dword [esp + 0x18], eax
lea eax, [eax + esi*2]
mov dword [esp + 0x20], eax
cmp dword [esp + 4], 0
je 0x445016
lea eax, [ebx + ebx]
add eax, 2
push eax
push 0
push edi
call fcn.004d5a00
add esp, 0xc
lea eax, [edi + ebx*2]
add eax, 2
jmp 0x445018
xorps xmm0, xmm0
movups xmmword [esi], xmm0
jmp 0x4450da
mov eax, edi
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x24]
push eax
push edi
push 2
call sub.Secur32.dll_GetUserNameExW
test al, al
je 0x445064
mov ebx, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 0x10], eax
cmp ebx, 0x7ffffff0
jae 0x4450ef
cmp ebx, 5
jae 0x44506f
lea edi, [esp + 8]
mov byte [edi + 0xb], bl
test ebx, ebx
mov esi, dword [esp]
jne 0x44509c
jmp 0x4450aa
xorps xmm0, xmm0
mov esi, dword [esp]
movups xmmword [esi], xmm0
jmp 0x4450c5
lea esi, [ebx + 8]
and esi, 0xfffffff8
lea eax, [esi + esi]
push eax
mov edi, ecx
call fcn.004cf0a6
mov ecx, edi
add esp, 4
mov edi, eax
mov dword [esp + 8], eax
or esi, 0x80000000
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], ebx
mov esi, dword [esp]
lea eax, [ebx + ebx]
push eax
push ecx
push edi
call fcn.004d4f00
add esp, 0xc
mov word [edi + ebx*2], 0
mov byte [esi], 1
movsd xmm0, qword [esp + 8]
movsd qword [esi + 4], xmm0
mov eax, dword [esp + 0x10]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4450da
mov dword [esp + 0x1c], eax
push eax
call fcn.004cf0d6
add esp, 4
mov ecx, dword [esp + 0x28]
xor ecx, ebp
call fcn.004d25a3
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [esp + 8]
call fcn.004fc800
lea ecx, [esp + 0x18]
call fcn.004ff350
int3