joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42d6d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push ebx
push esi
push edi
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x42d73a
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x42d73a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x42d73a
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x42d73a
push edi
push ebx
push esi
call fcn.00483740
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push 0
push esi
mov dword [esp + 0x18], 0
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
je 0x42d741
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor al, al
pop edi
pop esi
pop ebx
pop ecx
ret
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
push ecx
push edx
call fcn.0042d770
mov edi, eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
test edi, edi
pop edi
pop esi
sete al
pop ebx
pop ecx
ret
Function at 0x42dfd0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a0f24
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
mov eax, dword [0x4c2c40]
xor eax, esp
mov dword [esp + 0x98], eax
push ebx
push esi
push edi
mov eax, dword [0x4c2c40]
xor eax, esp
push eax
lea eax, [esp + 0xb0]
mov dword fs:[0], eax
lea eax, [esp + 0x14]
push eax
mov esi, ecx
mov dword [esp + 0x18], 8
mov dword [esp + 0x1c], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, esi
call fcn.004650d0
call fcn.00465ec7
mov eax, dword [eax + 8]
lea ecx, [esp + 0x34]
push ecx
push str.32770
push eax
call dword [sym.imp.USER32.dll_GetClassInfoW]
lea edx, [esp + 0x34]
push edx
mov dword [esp + 0x5c], str.Canon.IC.AutoUpdate.Dlg.Progress.with.Cancel
call fcn.004600dd
xor ebx, ebx
push ebx
call fcn.00466847
add esp, 4
call fcn.00464021
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [esp + 0x2c], vtable.CWinAUFileUtil.0
mov dword [esp + 0xb8], ebx
mov dword [esp + 0x30], vtable.CWinAUNetworkUtil.0
mov dword [esp + 0x1c], vtable.CWinAUSystemUtil.0
lea eax, [esp + 0x20]
push eax
mov byte [esp + 0xbc], 2
call fcn.00450c10
mov edx, dword [esi + 0x48]
lea ecx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, 7
mov esi, eax
mov dword [esp + 0x5c], vtable.CAUUpdateCheckerDocument.0
mov dword [esp + 0x7c], edi
mov dword [esp + 0x78], ebx
mov word [esp + 0x68], bx
mov dword [esp + 0x98], edi
mov dword [esp + 0x94], ebx
mov word [esp + 0x84], bx
mov dword [esp + 0x60], ebx
mov byte [esp + 0x9c], bl
mov byte [esp + 0xb8], 4
mov eax, dword [esp + 0x10]
push eax
mov edx, esi
lea ecx, [esp + 0x60]
call fcn.0041f900
inc esp
sub al, byte [eax]
add byte [ecx + 0x5fd1c5f2], ah
or eax, 0x309f2e3a
cmp ch, byte [esi]
inc ebp
cmp ch, byte ss:[esi]
mov ah, 0x98
mov dl, 0x4b
dec edx
add dword [edi + edx*2 + 0xe], esi
cmp ch, byte [esi]
pop edi
cwde
jg 0x42e169
ljmp 0x320e:0xb3bb425a
or al, 0x3d
pop edi
or eax, 0x776bf2bd
mov ecx, 0xefbd25ac
mov dword [0x5f2ff45e], eax
or eax, 0x1041ef3a
invalid

Function at 0x42e210
Capabilities:
Encode data using xor

Disassembly:
xor ch, al
push edx
sub bh, byte [edx - 0x1141fe5c]
add dword [esi + 0x7f9667ee], edi
invalid
add dword [esi + 0x7f9667ee], edi
adc ch, dl
pop edx
and bh, byte [edx + 0x2fc525b4]
lcall 0xaf0d, 0x5f2ed68f
js 0x42e20a
ljmp 0xc525:0xb4ba225a
mov dh, byte [esi]
das
das
aam 0x51
lds edi, [ebx + 0x47]
xchg edi, eax
xchg dword [esi], ecx
ljmp 0xbd15
Function at 0x430d10
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4987cb
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4c2c40]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00477a66
push 4
mov dword [esp + 0x20], 0
call fcn.0045a845
mov edi, eax
add esp, 4
test edi, edi
je 0x430d90
call fcn.004778f7
mov dword [edi], eax
call fcn.0047772b
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.00477a33
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x430d85
add eax, 1
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.00477a54
jmp 0x430d92
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x431a70
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x49f322
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4c2c40]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, dword [esp + 0x28]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [edi], 0x4ac6d4
mov dword [edi + 0x54], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
lea esi, [edi + 4]
push esi
mov dword [esp + 0x24], ebx
push edi
mov dword [esp + 0x1c], 1
call fcn.00431c70
mov dword [esp + 0x20], 1
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push esi
mov dword [edi + ecx], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
call fcn.00430d10
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x48], bl
mov byte [esi + 0x41], bl
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov edx, dword [0x4c86a8]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x44], edx
mov dword [esi + 0x3c], ebx
mov ecx, dword [esp + 0x2c]
push 0x22
mov byte [esp + 0x24], 2
call fcn.004306d0
test eax, eax
jne 0x431b68
mov eax, dword [edi]
mov ecx, dword [eax + 4]
mov eax, dword [ecx + edi + 8]
add ecx, edi
or eax, 2
cmp dword [ecx + 0x28], ebx
jne 0x431b61
or eax, 4
push ebx
push eax
call fcn.0042e790
mov eax, edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 8
Function at 0x432d00
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x49be32
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x4c2c40]
xor eax, esp
mov dword [esp + 0x218], eax
push esi
push edi
mov eax, dword [0x4c2c40]
xor eax, esp
push eax
lea eax, [esp + 0x228]
mov dword fs:[0], eax
mov esi, ecx
xor edi, edi
mov dword [esp + 0x10], edi
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
mov dword [esp + 0x14], esi
mov word [esi + 4], di
push 0x104
lea eax, [esp + 0x20]
push edi
mov dword [esp + 0x238], edi
push eax
mov dword [esp + 0x1c], 1
call fcn.0047dfc0
mov edx, dword [esp + 0x248]
mov eax, dword [esp + 0x244]
push 0xa
push 0x104
lea ecx, [esp + 0x30]
push ecx
push edx
push eax
call fcn.0047a68d
lea eax, [esp + 0x3c]
add esp, 0x20
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x432da0
sub eax, edx
sar eax, 1
je 0x432dd7
lea eax, [esp + 0x1c]
lea edx, [eax + 2]
jmp 0x432dc0
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x432dc0
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x20]
push ecx
jmp 0x432ddd
push edi
push 0x4a9c14
call fcn.00401c20
mov eax, esi
mov ecx, dword [esp + 0x228]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.00478599
add esp, 0x228
ret
Function at 0x4336a0
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x49de48
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4c2c40]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
push edi
mov eax, dword [0x4c2c40]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x3c]
xor esi, esi
push 0xffffffffffffffff
push esi
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], esi
mov word [esp + 0x18], si
call fcn.00401b70
push 0x5c
push 0x2f
lea edi, [esp + 0x14]
mov dword [esp + 0x3c], esi
call fcn.00404060
mov eax, dword [esp + 0x18]
mov edi, 8
add esp, 8
cmp dword [esp + 0x24], edi
jae 0x43371a
lea eax, [esp + 0x10]
push esi
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
cmp dword [esp + 0x24], edi
mov esi, eax
jb 0x433738
mov eax, dword [esp + 0x10]
push eax
call fcn.0045a870
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00478599
add esp, 0x2c
ret

Function at 0x4339f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x214
mov eax, dword [0x4c2c40]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push esi
lea eax, [esp + 8]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SOFTWARECanon_Inc_ICAuto_Update_Service
push reloc.OLEAUT32.dll_SysReAllocString
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x433a97
push 0x206
lea ecx, [esp + 0x16]
push ebx
push ecx
mov dword [esp + 0x18], 0x104
mov word [esp + 0x1c], bx
call fcn.0047dfc0
mov ecx, dword [esp + 0x14]
add esp, 0xc
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x14]
push eax
push ebx
push ebx
push str.baseURL
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x433a8c
lea eax, [esp + 0x10]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x433a70
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x14]
push edx
call fcn.00401c20
mov bl, 1
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x218]
pop esi
mov al, bl
pop ebx
xor ecx, esp
call fcn.00478599
add esp, 0x214
ret

Function at 0x434120
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x49bd11
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4c2c40]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor eax, eax
mov dword [esi], vtable.CAUActionListXML.0
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esp + 0x14], eax
mov ecx, 7
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x28], eax
mov word [esi + 0x18], ax
lea edi, [esi + 0x30]
mov dword [edi + 0x18], ecx
mov dword [edi + 0x14], eax
mov word [edi + 4], ax
mov byte [esp + 0x14], 2
call fcn.00415ed0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x435240
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x49d209
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4c2c40]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor ecx, ecx
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x38]
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov edi, edx
mov dword [esp + 0x30], ecx
mov ebx, dword [edi + 8]
add edi, 4
cmp ebx, dword [edi + 8]
mov dword [esp + 0x18], 1
jbe 0x435298
call fcn.00478a25
mov ebp, edi
lea ebx, [ebx]
mov esi, dword [edi + 8]
cmp dword [edi + 4], esi
jbe 0x4352ad
call fcn.00478a25
test ebp, ebp
je 0x4352b5
cmp ebp, edi
je 0x4352ba
call fcn.00478a25
cmp ebx, esi
je 0x43539f
test ebp, ebp
jne 0x4352cb
call fcn.00478a25
cmp ebx, dword [ebp + 8]
jb 0x4352d5
call fcn.00478a25
mov edi, dword [ebx + 4]
test edi, edi
je 0x43539a
mov esi, dword [ebx + 8]
mov ecx, esi
sub ecx, edi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 1
jbe 0x43539a
cmp edi, esi
jbe 0x43530c
call fcn.00478a25
lea esi, [edi + 0x1c]
cmp esi, dword [ebx + 8]
mov dword [esp + 0x24], edi
ja 0x43531d
cmp esi, dword [ebx + 4]
jae 0x435322
call fcn.00478a25
cmp esi, dword [ebx + 8]
jb 0x43532c
call fcn.00478a25
mov eax, dword [esp + 0x3c]
cmp dword [eax + 0x18], 8
mov edi, dword [eax + 0x14]
jb 0x43533e
mov eax, dword [eax + 4]
jmp 0x435341
add eax, 4
push eax
mov eax, dword [esi + 0x14]
mov ecx, esi
call fcn.0040e760
test eax, eax
jne 0x435386
cmp ebx, dword [ebp + 8]
jb 0x43535a
call fcn.00478a25
push 2
mov eax, ebx
call fcn.0040e240
cmp dword [eax + 0x14], 0
je 0x435386
cmp ebx, dword [ebp + 8]
jb 0x435373
call fcn.00478a25
push 0
mov eax, ebx
call fcn.0040e240
mov esi, dword [esp + 0x38]
push eax
call fcn.00401650
cmp ebx, dword [ebp + 8]
jb 0x435390
call fcn.00478a25
add ebx, 0x10
mov edi, ebp
jmp 0x4352a0
call fcn.00453e60
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 8

Function at 0x435ab0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [edi]
lea ecx, [esp]
push ecx
push esi
add eax, eax
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x14]
push 0
mov dword [edi], 0
mov ecx, dword [eax]
push str.InstVersion_forUIW
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x435b1e
mov eax, dword [esp + 8]
cmp eax, 1
je 0x435aef
cmp eax, 2
jne 0x435b0a
test esi, esi
mov eax, dword [esp]
je 0x435b18
test eax, eax
je 0x435b13
test al, 1
jne 0x435b0a
mov edx, eax
shr edx, 1
cmp word [esi + edx*2 - 2], 0
je 0x435b18
mov eax, 0xd
pop ecx
ret 4
mov word [esi], 0
shr eax, 1
mov dword [edi], eax
xor eax, eax
pop ecx
ret 4
Function at 0x4365f0
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 4]
push eax
push 0x20
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea ecx, [esp + 8]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push 0
push 0
mov edx, 2
push 0
mov dword [esp + 0x28], edx
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x14]
push 0
push eax
mov dword [esp + 0x28], 1
mov dword [esp + 0x30], ecx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov esp, ebp
pop ebp
ret
Function at 0x436cc0
Capabilities:
Enumerate gui resources

Disassembly:
push 0xffffffffffffffff
push 0x49bc38
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4c2c40]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor esi, esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov eax, dword [esp + 0x40]
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x3c], esi
push 0x436dc0
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], eax
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [esp + 0x28], esi
je 0x436d95
mov ebx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
cmp ebx, eax
jbe 0x436d30
call fcn.00478a25
mov eax, dword [esp + 0x20]
mov ebp, dword [sym.imp.USER32.dll_GetWindowLongW]
cmp dword [esp + 0x1c], eax
mov edi, eax
jbe 0x436d47
call fcn.00478a25
mov eax, dword [esp + 0x20]
cmp ebx, edi
je 0x436d95
cmp ebx, eax
jb 0x436d54
call fcn.00478a25
mov edx, dword [ebx]
push 0xfffffffffffffff0
push edx
call ebp
test eax, 0x10000000
je 0x436d7f
test eax, 0x8000000
jne 0x436d7f
cmp ebx, dword [esp + 0x20]
jb 0x436d74
call fcn.00478a25
mov esi, dword [esp + 0x44]
call fcn.00437980
xor esi, esi
mov eax, dword [esp + 0x20]
cmp ebx, eax
jb 0x436d90
call fcn.00478a25
mov eax, dword [esp + 0x20]
add ebx, 4
jmp 0x436d36
mov eax, dword [esp + 0x1c]
cmp eax, esi
je 0x436da6
push eax
call fcn.0045a870
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret

Function at 0x437360
Capabilities:
Get session information
Get session user name

Disassembly:
sub esp, 0x214
mov eax, dword [0x4c2c40]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
push edi
push 0x202
xor edi, edi
lea eax, [esp + 0x18]
push edi
push eax
mov esi, ecx
mov dword [esp + 0x14], 0
call fcn.0047dfc0
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x4373d6
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0xc]
push eax
push 5
push ecx
push edi
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x4373d6
mov edx, dword [esp + 8]
push edx
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x43740f
lea eax, [esp + 0x14]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4373f0
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x18]
push edx
call fcn.00401c20
mov edi, 1
mov eax, dword [esp + 8]
test eax, eax
je 0x43741d
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
mov ecx, dword [esp + 0x218]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.00478599
add esp, 0x214
ret
Function at 0x438f20
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4987cb
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4c2c40]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.00477a66
push 4
mov dword [esp + 0x20], 0
call fcn.0045a845
mov edi, eax
add esp, 4
test edi, edi
je 0x438fa0
call fcn.004778f7
mov dword [edi], eax
call fcn.0047772b
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.00477a33
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x438f95
add eax, 1
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.00477a54
jmp 0x438fa2
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x43b2b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x49cfd0
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4c2c40]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x70]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
add ebp, 4
mov esi, eax
mov edi, dword [ebp + 4]
xor ebx, ebx
mov eax, ebp
cmp eax, ebx
je 0x43b2f4
cmp eax, ebp
je 0x43b2f9
call fcn.00478a25
cmp esi, edi
je 0x43b398
mov edi, ebp
cmp edi, ebx
jne 0x43b30c
call fcn.00478a25
cmp esi, dword [edi + 4]
jne 0x43b316
call fcn.00478a25
cmp dword [esi + 0x24], 8
mov edi, dword [esi + 0x20]
jb 0x43b324
mov eax, dword [esi + 0x10]
jmp 0x43b327
lea eax, [esi + 0x10]
mov ecx, dword [esp + 0x74]
push eax
mov eax, dword [ecx + 0x14]
call fcn.0040e760
test eax, eax
je 0x43b42b
cmp byte [esi + 0x39], bl
je 0x43b348
call fcn.00478a25
jmp 0x43b2e5
mov eax, dword [esi + 8]
cmp byte [eax + 0x39], bl
jne 0x43b36e
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0x39], bl
jne 0x43b2e5
lea esp, [esp]
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0x39], bl
je 0x43b360
jmp 0x43b2e5
mov eax, dword [esi + 4]
cmp byte [eax + 0x39], bl
jne 0x43b2e3
lea ebx, [ebx]
cmp esi, dword [eax + 8]
jne 0x43b2e3
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0x39], bl
je 0x43b380
jmp 0x43b2e3
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
xor ecx, ecx
push ecx
lea eax, [esp + 0x28]
push eax
mov edx, eax
xor esi, esi
push esi
push edx
lea eax, [esp + 0x28]
mov dword [esp + 0x78], ebx
push eax
mov ebx, edx
call fcn.0041e900
mov ecx, dword [esp + 0x78]
push ecx
mov esi, ebx
call fcn.00401650
mov edx, dword [esp + 0x7c]
push edx
call fcn.00401650
mov ecx, dword [esp + 0x74]
mov eax, ebx
push eax
push ecx
lea edx, [esp + 0x3c]
push edx
call fcn.0043b5e0
lea ecx, [esp + 0x18]
push ecx
push ebp
mov ebx, eax
mov byte [esp + 0x70], 1
call fcn.0043b4b0
lea esi, [esp + 0x34]
call fcn.0043b450
mov eax, dword [esp + 0x28]
test eax, eax
je 0x43b42b
mov edx, dword [esp + 0x74]
mov edi, dword [esp + 0x2c]
push edx
call fcn.00402640
mov eax, dword [esp + 0x2c]
add esp, 4
push eax
call fcn.0045a870
add esp, 4
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret 0x10