joyce8/EMBER2024-capa huggingface dataset:
Function at 0x457800
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push edi
xor edi, edi
push edi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x45784b
push esi
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x457840
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
push edi
call dword [0x63a218]
push eax
push edi
call fcn.00458d00
add esp, 0xc
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, edi
pop esi
pop edi
ret
mov eax, edi
pop edi
ret

Function at 0x457890
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x45790f
push esi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x45790f
push ebx
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
call dword [0x63a218]
add esp, 4
inc eax
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x457903
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edx, eax
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
mov esi, 1
call dword [sym.imp.USER32.dll_CloseClipboard]
pop ebx
mov eax, esi
pop edi
pop esi
ret
mov eax, esi
pop edi
pop esi
ret

Function at 0x4588c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, edx
push esi
push edi
mov esi, ebp
xor edi, edi
and esi, 3
mov eax, ecx
jle 0x4588e1
mov dl, byte [eax]
inc eax
cmp dl, bl
je 0x45893b
inc edi
cmp edi, esi
jl 0x4588d5
mov edi, ebx
and edi, 0xff
mov esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
lea edi, [ecx + ebp]
cmp eax, edi
jae 0x458970
mov edx, dword [eax]
xor edx, esi
lea ebp, [edx - 0x1010101]
not edx
and ebp, edx
test ebp, 0x80808080
je 0x45892a
cmp byte [eax], bl
je 0x458945
cmp byte [eax + 1], bl
je 0x45894e
cmp byte [eax + 2], bl
je 0x458958
cmp byte [eax + 3], bl
je 0x458964
add eax, 4
cmp eax, edi
jb 0x458901
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
dec eax
pop ebx
ret 4
pop edi
pop esi
pop ebp
sub eax, ecx
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
inc eax
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 2
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 3
pop ebx
ret 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
Function at 0x45a5a0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 8
xor ecx, ecx
xor eax, eax
push ebp
mov ebp, dword [esp + 0x18]
mov byte [eax + ebp], al
inc eax
cmp eax, 0x100
jl 0x45a5ac
mov eax, dword [esp + 0x14]
mov byte [ebp + 0x100], cl
cmp eax, ecx
mov byte [ebp + 0x101], cl
jle 0x45a63f
push ebx
push esi
push edi
mov byte [esp + 0x24], cl
xor esi, esi
mov ebx, ebp
mov dword [esp + 0x10], 0x100
mov edi, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
and edi, 0xff
xor eax, eax
xor edx, edx
mov al, byte [edi + ecx]
mov dl, byte [ebx]
add esi, eax
add edx, esi
and edx, 0x800000ff
jns 0x45a609
dec edx
or edx, 0xffffff00
inc edx
mov byte [esp + 0x14], dl
mov esi, dword [esp + 0x14]
and esi, 0xff
lea eax, [esi + ebp]
push eax
push ebx
call fcn.0045a650
lea eax, [edi + 1]
add esp, 8
cdq
idiv dword [esp + 0x20]
mov eax, dword [esp + 0x10]
inc ebx
dec eax
mov dword [esp + 0x10], eax
mov byte [esp + 0x24], dl
jne 0x45a5de
pop edi
pop esi
pop ebx
pop ebp
add esp, 8
ret

Function at 0x45a670
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
mov edx, dword [esp + 0x14]
push ebx
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
mov al, byte [esi + 0x100]
mov cl, byte [esi + 0x101]
test edx, edx
mov byte [esp + 0x20], al
mov byte [esp + 8], cl
jle 0x45a76d
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x28]
and edi, 0xff
and ebp, 0xff
lea eax, [edi + 1]
and eax, 0x800000ff
jns 0x45a6c2
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + 0x28], al
xor ecx, ecx
mov edi, dword [esp + 0x28]
and edi, 0xff
mov cl, byte [edi + esi]
lea eax, [edi + esi]
add ecx, ebp
mov dword [esp + 0x18], eax
and ecx, 0x800000ff
jns 0x45a6ee
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ebp, dword [esp + 0x10]
and ebp, 0xff
lea ecx, [esi + ebp]
push ecx
push eax
mov dword [esp + 0x1c], ecx
call fcn.0045a650
mov eax, dword [esp + 0x1c]
xor edx, edx
xor ecx, ecx
add esp, 8
mov dl, byte [eax]
mov eax, dword [esp + 0x18]
mov cl, byte [eax]
add edx, ecx
and edx, 0x800000ff
jns 0x45a72f
dec edx
or edx, 0xffffff00
inc edx
mov eax, dword [esp + 0x20]
and edx, 0xff
mov cl, byte [edx + esi]
mov dl, byte [ebx + eax]
xor dl, cl
mov byte [ebx + eax], dl
mov eax, dword [esp + 0x24]
inc ebx
cmp ebx, eax
jl 0x45a6b1
mov dl, byte [esp + 0x28]
mov al, byte [esp + 0x10]
pop edi
mov byte [esi + 0x100], dl
mov byte [esi + 0x101], al
pop ebp
pop esi
pop ebx
add esp, 0xc
ret
mov byte [esi + 0x100], al
mov byte [esi + 0x101], cl
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x45b730
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x63a3ec]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x45b743
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x45b784
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x63a494]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x45b7b6
mov bl, byte [esp + ecx + 0x4c]
jmp 0x45b7ba
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x45b7ab
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x45b7d8
mov bl, byte [esp + ecx + 0x4c]
jmp 0x45b7dc
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x45b7cd
xor ecx, ecx
mov eax, 0x63a3fc
xor ebx, ebx
mov bl, byte [ecx + 0x63a4a4]
cmp byte [esp + ebx + 0x14], 0
je 0x45b807
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x63a4bc]
cmp byte [esp + ebx + 0x14], 0
je 0x45b81e
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x45b7ee
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x45b777
lea edx, [esp + 0x84]
push edx
call fcn.0045b860
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x42c550
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x25c]
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov dword [ebp - 0x25c], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x258], eax
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
xor eax, eax
push fcn.0042c520
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.00408bc0
mov eax, dword [ebp - 0x25c]
mov dword [eax], 0
mov eax, dword [ebp - 4]
xor edx, edx
mov edi, eax
mov esi, edx
lea ebx, [ebp - 8]
mov eax, ebx
call fcn.00403d00
push esi
push edi
mov edx, ebx
xor cx, cx
mov eax, 0xffffffff
call fcn.00409e00
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x5f4c90]
call fcn.0040cf30
mov ecx, eax
mov edx, dword [0x5f4c90]
mov eax, 0x617d90
call fcn.00423b60
push 0
mov eax, 0x621254
mov dword [ebp - 0x254], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x250], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24c], eax
lea edx, [ebp - 0x254]
lea eax, [ebp - 0x10]
mov ecx, 2
call fcn.00408f50
push 0
push 0
push 3
push 0
push 3
push 0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x42c642
mov eax, 0x6722f0
push eax
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x42c670
call sub.kernel32.dll_GetLastError
mov edx, dword [ebp - 0x25c]
mov dword [edx], eax
mov eax, dword [ebp - 0x258]
xor edx, edx
call fcn.00408bc0
jmp 0x42c72a
push 0xc
lea eax, [ebp - 0x24]
push eax
call fcn.00446a00
push 0x224
lea eax, [ebp - 0x248]
push eax
call fcn.00446a00
mov dword [ebp - 0x244], 0x224
push 0
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x244]
lea eax, [ebp - 0x248]
push eax
push 0xc
lea eax, [ebp - 0x24]
push eax
push 0x2d1400
push ebx
call sub.kernel32.dll_DeviceIoControl
or eax, eax
jne 0x42c6e0
call sub.kernel32.dll_GetLastError
mov edx, dword [ebp - 0x25c]
mov dword [edx], eax
push ebx
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x258]
xor edx, edx
call fcn.00408bc0
jmp 0x42c72a
cmp dword [ebp - 0x230], 0
je 0x42c702
lea eax, [ebp - 0x248]
add eax, dword [ebp - 0x230]
lea ecx, [ebp - 0x14]
xor dx, dx
call fcn.00409510
jmp 0x42c70e
mov eax, dword [ebp - 0x25c]
mov dword [eax], 0xffffffff
cmp ebx, 0xffffffff
je 0x42c71c
push ebx
call sub.kernel32.dll_CloseHandle
lea esi, [esi]
mov eax, dword [ebp - 0x258]
mov edx, dword [ebp - 0x14]
call fcn.00408bc0
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.0042c520
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x439430
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
push esi
mov ebx, eax
mov esi, edx
mov dword [ebp - 4], 0
xor eax, eax
push fcn.00439420
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xc], 0
mov eax, dword [esi]
mov eax, dword [eax + 0x3c]
test eax, eax
je 0x43946a
mov eax, dword [eax - 4]
add eax, 1
test eax, eax
je 0x439478
mov byte [ebp - 8], 0
jmp 0x4394ee
mov byte [ebx + 4], 0
lea eax, [ebp - 4]
push eax
mov eax, dword [0x5f18e0]
call fcn.0040cf30
mov ecx, eax
mov edx, dword [0x5f18e0]
mov eax, 0x617d90
call fcn.00423b60
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4394a8
mov eax, 0x6722f0
push eax
push 0xffffffffffffffff
push 0
call sub.kernel32.dll_CreateMutexA
test eax, eax
jbe 0x4394e8
mov byte [ebp - 0xc], 1
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
je 0x4394cc
mov byte [ebx + 4], 1
mov esi, esi
push dword [0x5f1b10]
mov edx, 0x620948
mov eax, dword [esi]
mov ecx, dword [eax + 0x3c]
mov eax, dword [esi]
add eax, 0x3c
call fcn.0040d500
mov esi, esi
mov al, byte [ebp - 0xc]
mov byte [ebp - 8], al
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00439420
mov al, byte [ebp - 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x439960
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x44]
push ebx
push esi
push edi
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
xor eax, eax
push fcn.00439930
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x38]
mov eax, dword [edx]
mov edx, dword [eax + 0x3c]
mov ecx, dword [0x5f1bf0]
mov eax, dword [ebp - 0x3c]
call fcn.00438790
test al, al
jne 0x4399c4
mov byte [ebp - 0x34], 0
jmp 0x439b5a
mov byte [ebp - 0x40], 1
mov dword [ebp - 0x28], 4
lea eax, [ebp - 0x28]
push eax
mov edx, 0x622238
lea eax, [ebp - 0x24]
mov ecx, 1
call fcn.0040d060
mov ecx, 0x622200
mov edx, dword [0x5f1bb0]
mov eax, dword [ebp - 0x24]
call fcn.0040d040
mov ecx, 0x622200
mov edx, dword [0x5f1bc0]
mov eax, dword [ebp - 0x24]
add eax, 4
call fcn.0040d040
mov ecx, 0x622200
mov edx, dword [0x5f1bd0]
mov eax, dword [ebp - 0x24]
add eax, 8
call fcn.0040d040
mov ecx, 0x622200
mov edx, dword [0x5f1be0]
mov eax, dword [ebp - 0x24]
add eax, 0xc
call fcn.0040d040
mov eax, dword [ebp - 0x3c]
mov edx, dword [eax + 0xc]
mov eax, dword [edx + 0x2c]
cmp byte [eax + 0x10], 0
jne 0x439b1c
mov dword [ebp - 0x44], 0
push 0x80000000
push 0
push 0
call fcn.00554b30
mov edi, eax
test edi, edi
je 0x439b1c
mov eax, dword [ebp - 0x24]
call fcn.0040cf30
mov esi, eax
mov dword [ebp - 0x44], 0xffffffff
lea esi, [esi]
add dword [ebp - 0x44], 1
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x44]
mov eax, dword [eax + edx*4]
call fcn.0040cf30
mov ecx, eax
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x44]
mov edx, dword [eax + edx*4]
mov eax, 0x617d90
call fcn.00423b60
push 0x80000000
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x439aba
mov eax, dword [eax - 4]
mov edx, eax
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x439ac8
mov eax, 0x6722f0
lea ecx, [ebp - 0x2c]
call fcn.00441760
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x439adc
mov eax, 0x6722f0
push eax
push edi
call fcn.00554b40
mov ebx, eax
test ebx, ebx
setne al
and eax, 0xff
neg eax
je 0x439b10
lea eax, [ebp - 0x1c]
push eax
push ebx
call fcn.00554b50
test eax, eax
je 0x439b10
cmp dword [ebp - 0x18], 4
jne 0x439b19
mov byte [ebp - 0x40], 0
nop
jmp 0x439b19
cmp esi, dword [ebp - 0x44]
ja 0x439a80
lea esi, [esi]
mov al, byte [ebp - 0x40]
test al, al
je 0x439b54
mov ebx, 0x620948
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [0x5f1c00]
mov edx, dword [0x5f1bf0]
mov eax, dword [ebp - 0x3c]
call fcn.004388c0
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
lea eax, [ecx + 0x3c]
mov ecx, ebx
call fcn.0040d040
mov esi, esi
mov al, byte [ebp - 0x40]
mov byte [ebp - 0x34], al
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.00439930
mov al, byte [ebp - 0x34]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x439bb0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x24]
push ebx
push esi
push edi
mov esi, eax
mov edi, edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
xor eax, eax
push fcn.00439b80
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [edi]
mov edx, dword [eax + 0x3c]
mov ecx, dword [0x5f1c20]
mov eax, esi
call fcn.00438790
test al, al
jne 0x439c0c
mov byte [ebp - 0x20], 0
jmp 0x439d33
mov eax, dword [esi + 0xc]
mov eax, dword [eax + 0x2c]
cmp byte [eax + 0x10], 0
jne 0x439d04
lea eax, [ebp - 8]
push eax
mov eax, dword [0x5f18f0]
call fcn.0040cf30
mov ecx, eax
mov edx, dword [0x5f18f0]
mov eax, 0x617d90
call fcn.00423b60
call sub.kernel32.dll_GetCommandLineW
lea ecx, [ebp - 4]
xor dx, dx
call fcn.0040b430
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov ecx, 1
call fcn.00409a90
mov ebx, eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [0x5f1c10]
call fcn.0040cf30
mov ecx, eax
mov edx, dword [0x5f1c10]
mov eax, 0x617d90
call fcn.00423b60
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 4]
mov ecx, 1
call fcn.00409a90
add ebx, eax
test ebx, ebx
jbe 0x439c9d
mov eax, dword [esi + 0xc]
mov byte [eax + 5], 1
jmp 0x439d04
xor bl, bl
mov byte [ebp - 0x24], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
or eax, eax
je 0x439cf4
mov dword [ebp - 0x14], 4
lea eax, [ebp - 0x14]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
push 0x14
push dword [ebp - 0xc]
call sub.advapi32.dll_GetTokenInformation
or eax, eax
setne al
mov byte [ebp - 0x24], al
test al, al
je 0x439cf4
mov eax, dword [esi + 0xc]
cmp dword [ebp - 0x10], 0
seta byte [eax + 5]
lea esi, [esi]
cmp dword [ebp - 0xc], 0
jbe 0x439d04
push dword [ebp - 0xc]
call sub.kernel32.dll_CloseHandle
mov esi, esi
mov ebx, 0x620948
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [0x5f1c30]
mov edx, dword [0x5f1c20]
mov eax, esi
call fcn.004388c0
mov edx, dword [ebp - 0x1c]
mov eax, dword [edi]
add eax, 0x3c
mov ecx, ebx
call fcn.0040d040
mov byte [ebp - 0x20], 1
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.00439b80
mov al, byte [ebp - 0x20]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43a600
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xb0]
push ebx
push esi
push edi
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xa4], 0
xor eax, eax
push fcn.0043a5b0
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov dword [ebp - 0x9c], pe_nt_image_headers32
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x80]
push eax
call sub.advapi32.dll_GetUserNameA
lea eax, [ebp - 0xa4]
call fcn.00403d00
push 0
push 1
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x80]
xor cx, cx
mov edx, 0x7f
call fcn.004095b0
mov esi, dword [ebp - 0xa8]
lea eax, [ebp - 0xac]
push eax
mov eax, dword [0x5f1680]
call fcn.0040cf30
mov ecx, eax
mov edx, dword [0x5f1680]
mov eax, 0x617d90
call fcn.00423b60
mov edx, dword [ebp - 0xac]
lea eax, [ebp - 0xa4]
mov ecx, esi
call fcn.00408cc0
mov edx, dword [ebp - 0xa4]
lea ecx, [ebp - 0x98]
mov eax, 0x620a18
call fcn.004282c0
lea ecx, [ebp - 0x84]
lea edx, [ebp - 0x98]
mov eax, 0x620a18
call fcn.00428240
mov dword [ebp - 0xb0], 5
lea eax, [ebp - 0xb0]
push eax
mov edx, 0x6222a8
lea eax, [ebp - 0xa0]
mov ecx, 1
call fcn.0040d060
lea eax, [ebp - 0xac]
push eax
mov eax, dword [0x5f1ce0]
call fcn.0040cf30
mov ecx, eax
mov edx, dword [0x5f1ce0]
mov eax, 0x617d90
call fcn.00423b60
mov edx, dword [ebp - 0xac]
mov eax, dword [ebp - 0xa0]
call fcn.00408bc0
lea eax, [ebp - 0xac]
push eax
mov eax, dword [0x5f1cf0]
call fcn.0040cf30
mov ecx, eax
mov edx, dword [0x5f1cf0]
mov eax, 0x617d90
call fcn.00423b60
mov edx, dword [ebp - 0xac]
mov eax, dword [ebp - 0xa0]
add eax, 4
call fcn.00408bc0
lea eax, [ebp - 0xac]
push eax
mov eax, dword [0x5f1d00]
call fcn.0040cf30
mov ecx, eax
mov edx, dword [0x5f1d00]
mov eax, 0x617d90
call fcn.00423b60
mov edx, dword [ebp - 0xac]
mov eax, dword [ebp - 0xa0]
add eax, 8
call fcn.00408bc0
lea eax, [ebp - 0xac]
push eax
mov eax, dword [0x5f1d10]
call fcn.0040cf30
mov ecx, eax
mov edx, dword [0x5f1d10]
mov eax, 0x617d90
call fcn.00423b60
mov edx, dword [ebp - 0xac]
mov eax, dword [ebp - 0xa0]
add eax, 0xc
call fcn.00408bc0
lea eax, [ebp - 0xac]
push eax
mov eax, dword [0x5f1d20]
call fcn.0040cf30
mov ecx, eax
mov edx, dword [0x5f1d20]
mov eax, 0x617d90
call fcn.00423b60
mov edx, dword [ebp - 0xac]
mov eax, dword [ebp - 0xa0]
add eax, 0x10
call fcn.00408bc0
lea eax, [ebp - 0x88]
xor edx, edx
call fcn.00408bc0
mov eax, dword [ebp - 0xa0]
call fcn.0040cf30
mov esi, eax
mov edi, 0xffffffff
lea esi, [esi]
nop
add edi, 1
mov eax, dword [ebp - 0xa0]
mov edx, dword [eax + edi*4]
mov eax, dword [ebp - 0x84]
call fcn.00409780
test eax, eax
jne 0x43a888
mov eax, dword [0x5f5140]
or eax, ebx
mov ebx, eax
jmp 0x43a88c
cmp esi, edi
ja 0x43a860
test ebx, ebx
sete bl
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.0043a5b0
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43b030
Capabilities:
Create process on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x234]
push ebx
push esi
push edi
mov esi, eax
mov edi, edx
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0
xor eax, eax
push fcn.0043afd0
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x234], 0
push 0x104
lea eax, [ebp - 0x208]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ebx, eax
test ebx, ebx
jbe 0x43b2b8
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x208]
mov cl, 1
mov edx, 0x103
call fcn.0040b930
mov eax, dword [ebp - 0x220]
mov ecx, ebx
xor edx, edx
call fcn.0040bd70
mov eax, dword [ebp - 0x21c]
lea edx, [ebp - 0x210]
call fcn.0040b370
mov edx, dword [ebp - 0x210]
lea eax, [ebp - 0x214]
call fcn.0040a690
mov ecx, dword [ebp - 0x214]
mov eax, esi
mov edx, 0x6220c4
call fcn.0043af20
mov esi, eax
test esi, esi
jbe 0x43b20c
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x224], eax
lea edx, [esi + 2]
cmp word [eax + edx*2 - 2], 0x78
jne 0x43b163
mov eax, dword [ebp - 0x224]
lea edx, [esi + 3]
cmp word [eax + edx*2 - 2], 0x65
je 0x43b20c
lea eax, [ebp - 0x22c]
push eax
mov eax, dword [0x5f1930]
call fcn.0040cf30
mov ecx, eax
mov edx, dword [0x5f1930]
mov eax, 0x617d90
call fcn.00423b60
mov eax, dword [ebp - 0x22c]
lea edx, [ebp - 0x228]
call fcn.0040a5c0
mov ebx, dword [ebp - 0x228]
lea eax, [ebp - 0x230]
push eax
lea ecx, [esi - 1]
mov eax, dword [ebp - 0x214]
xor edx, edx
call fcn.0040ab80
mov edx, dword [ebp - 0x230]
lea eax, [ebp - 0x214]
mov ecx, ebx
call fcn.0040a710
mov eax, dword [ebp - 0x214]
lea edx, [ebp - 0x220]
call fcn.0040b3a0
mov ebx, dword [ebp - 0x220]
mov eax, dword [ebp - 0x210]
lea edx, [ebp - 0x21c]
call fcn.0040b3a0
mov eax, dword [ebp - 0x21c]
mov edx, ebx
call fcn.004638d0
mov eax, dword [edi]
add eax, 0x24
mov edx, dword [ebp - 0x214]
call fcn.0040a690
lea eax, [ebp - 0x20c]
push eax
push 0
mov eax, edi
push eax
mov eax, 0x433280
push eax
push 0
push 0
call sub.kernel32.dll_CreateThread
mov edx, 1
mov eax, 0x620f30
call fcn.0042a7e0
mov ebx, eax
lea eax, [ebp - 0x22c]
push eax
mov eax, dword [0x5f1cb0]
call fcn.0040cf30
mov ecx, eax
mov edx, dword [0x5f1cb0]
mov eax, 0x617d90
call fcn.00423b60
mov eax, dword [ebp - 0x22c]
lea edx, [ebp - 0x218]
call fcn.0040a5c0
push 1
push 0
mov edx, dword [edi]
mov eax, ebx
call fcn.0042a8e0
push eax
mov eax, dword [ebp - 0x214]
test eax, eax
jne 0x43b289
mov eax, 0x6722f0
push eax
mov eax, dword [ebp - 0x218]
test eax, eax
jne 0x43b299
mov eax, 0x6722f0
push eax
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
jbe 0x43b2b8
mov byte [ebp - 0x234], 1
mov eax, dword [edi]
push dword [eax + 0x34]
call sub.kernel32.dll_CloseHandle
nop
mov bl, byte [ebp - 0x234]
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.0043afd0
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret