joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4099c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x30
lea eax, [esp + 0x2c]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], eax
lea eax, [esp + 0x28]
mov dword [esp + 8], eax
lea eax, [esp + 0x24]
mov dword [esp + 4], eax
lea eax, [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 0x2c], 0
call sub.msvcrt.dll___getmainargs
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.msvcrt.dll___set_app_type
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.0040a360
mov dword [esp], eax
call sub.msvcrt.dll_exit
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
and esp, 0xfffffff0
call sub.msvcrt.dll___iob_func
mov edx, dword [ebp + 8]
leave
shl edx, 5
add eax, edx
ret
Function at 0x410348
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
push ebx
push esi
push edi
call fcn.0041014a
ret

Function at 0x410598
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xlatb
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0041017c
push eax
push esi
push dword [ebp + 8]
call fcn.00410131
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0041016c
dec edx
movsb byte es:[edi], byte [esi]
and esi, 0xffffff88
popfd
jl 0x4105f1
invalid
invalid
Function at 0x411cf1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax], al
add byte [eax - 0x78b5b], al
inc dword [eax]
and byte [ebp - 0x78b], 0
mov byte [ebp - 0x78a], 0xa0
and byte [ebp - 0x789], 0
mov byte [ebp - 0x788], 3
mov byte [ebp - 0x787], 0x3b
mov byte [ebp - 0x786], 0x33
mov byte [ebp - 0x785], 0x3c
mov byte [ebp - 0x784], 0x30
mov byte [ebp - 0x783], 0x3a
mov byte [ebp - 0x782], 0x2d
mov byte [ebp - 0x781], 0x71
mov byte [ebp - 0x780], 0x3b
mov byte [ebp - 0x77f], 0x33
mov byte [ebp - 0x77e], 0x33
mov byte [ebp - 0x77d], 0x5f
push 0xc
lea eax, [ebp - 0x78c]
push eax
call fcn.0041017c
pop ecx
push eax
mov eax, dword [ebp - 0x28]
lea eax, [ebp + eax - 0x12c]
push eax
call fcn.004100dd
add esp, 0xc
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x3a0], eax
jmp 0x4120e4

Function at 0x41232f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.0041016c
frstor dword [ebp - 0x774192e]
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.0041016c
and esi, dword [edx - 0x15]
lodsb al, byte [esi]
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x412359
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x412359
call fcn.0041016c
xchg byte [edi + 0x22], bh
pop edx
mov ebx, dword [edx + 0x24]
add ebx, edi
mov cx, word [ebx + ecx*2]
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.0041016c
cmp al, byte [eax]
push eax
push esi
push dword [ebp + 8]
push dword [ebp + 4]
push dword [ebp]
call fcn.0041096c
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x409f6a
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
xor eax, eax
push esi
mov esi, dword [ebp + 0xc]
sub esi, edx
push edi
xor edi, edi
cmp edx, dword [ebp + 0xc]
cmova esi, eax
test esi, esi
je 0x409f9a
movzx eax, byte [edx]
xor eax, dword [ecx]
imul eax, eax, 0x1000193
inc edx
inc edi
mov dword [ecx], eax
cmp edi, esi
jne 0x409f85
jmp 0x409f9c
mov eax, dword [ecx]
pop edi
pop esi
pop ebp
ret 8

Function at 0x40d64b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x40d66d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040d729
jmp 0x40d724
mov eax, dword [edi + 0x1c]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov eax, dword [eax]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], eax
test eax, eax
je 0x40d68e
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x40d690
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test ebx, ebx
jl 0x40d718
jg 0x40d6a3
test esi, esi
je 0x40d718
test ecx, ecx
jl 0x40d6e5
jg 0x40d6ad
test eax, eax
je 0x40d6e5
cmp ebx, ecx
jg 0x40d6bf
jl 0x40d6b7
cmp esi, eax
jae 0x40d6bf
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], ebx
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.005594a0
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov eax, dword [edi + 0x2c]
add dword [ebp + 8], ecx
sub esi, ecx
sbb ebx, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x40d6eb
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test ebx, ebx
jl 0x40d718
jg 0x40d6f5
test esi, esi
je 0x40d718
cmp dword [edi + 0x4c], 0
je 0x40d718
mov ecx, edi
call fcn.0040c878
push dword [edi + 0x4c]
push esi
push 1
push dword [ebp + 8]
call fcn.0056327a
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
pop esi
sbb edx, ebx
pop ebx
pop edi
leave
ret 0xc
Function at 0x41116a
Capabilities:
Copy file

Disassembly:
push 0xf4
mov eax, 0x58b716
call fcn.00540b26
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
push eax
mov dword [ebp - 0xfc], eax
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x100], edi
call fcn.0041eaa8
mov ebx, eax
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push edi
push eax
call fcn.0041eaa8
add esp, 0x10
mov edi, eax
push 0
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00412339
cmp dword [ebx + 0x14], 8
mov cl, al
jb 0x4111c4
mov ebx, dword [ebx]
cmp dword [edi + 0x14], 8
jb 0x4111cc
mov edi, dword [edi]
xor eax, eax
test cl, cl
sete al
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov esi, eax
lea ecx, [ebp - 0x28]
cmp esi, 1
sete bl
call fcn.00406537
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00406537
cmp esi, 1
je 0x411279
call fcn.0040c312
push 2
pop esi
push esi
push eax
lea ecx, [ebp - 0xf8]
call fcn.0040bc1a
lea eax, [ebp - 0xf8]
mov dword [ebp - 4], esi
push str.Failed_to_copy_from_
push eax
call fcn.004014b9
pop ecx
pop ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._due_to
push dword [ebp - 0xfc]
push str._to_
push dword [ebp - 0x100]
push esi
call fcn.00401499
pop ecx
pop ecx
push eax
call fcn.004014b9
pop ecx
pop ecx
push eax
call fcn.00401499
pop ecx
pop ecx
push eax
call fcn.004014b9
pop ecx
pop ecx
mov ecx, eax
call fcn.0040438f
lea ecx, [ebp - 0xf8]
call fcn.0040be01
mov al, bl
call fcn.00540ad0
ret

Function at 0x411281
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x62fff4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0041eaa8
pop ecx
pop ecx
cmp dword [eax + 0x14], 8
jb 0x4112a8
mov eax, dword [eax]
push ebx
push 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [ebp - 0x1c]
lea ebx, [eax - 1]
neg ebx
sbb bl, bl
inc bl
call fcn.00406537
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.00540aaa
leave
ret
Function at 0x4118ea
Capabilities:
Get common file path
Query environment variable

Disassembly:
push 0x254
mov eax, 0x58b808
call fcn.00540b26
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x260], ebx
mov eax, dword fs:[0x2c]
mov ecx, dword [0x63bf34]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x6361e0]
cmp eax, dword [ecx + 8]
jg 0x411a71
cmp byte [0x6361dc], 0
jne 0x4119c9
cmp esi, 0x12
jne 0x41198d
push 0x104
lea eax, [ebp - 0x21c]
push eax
push str._ProgramW6432_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.00410cbd
pop ecx
pop ecx
mov esi, eax
mov dword [ebp - 4], 1
push 0x5c
mov ecx, esi
call fcn.004087b5
push esi
mov ecx, ebx
call fcn.00403659
lea ecx, [ebp - 0x234]
call fcn.00406511
jmp 0x411a69
cmp esi, 0x13
jne 0x4119c9
push 0x104
lea eax, [ebp - 0x21c]
push eax
push str._CommonProgramW6432_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.00410cbd
pop ecx
pop ecx
mov esi, eax
mov dword [ebp - 4], 2
jmp 0x41196c
and dword [ebp - 0x260], 0
lea eax, [ebp - 0x22c]
push esi
push eax
call fcn.004120ee
mov esi, eax
lea edi, [ebp - 0x244]
pop ecx
pop ecx
lea eax, [ebp - 0x260]
movsd dword es:[edi], dword [esi]
push eax
push 0
push 0
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x244]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jne 0x411a5b
push dword [ebp - 0x260]
lea eax, [ebp - 0x25c]
push eax
call fcn.00410cbd
pop ecx
pop ecx
mov esi, eax
push 0x5c
mov ecx, esi
mov dword [ebp - 4], 3
call fcn.004087b5
push esi
lea ecx, [ebp - 0x234]
call fcn.00403659
lea ecx, [ebp - 0x25c]
call fcn.00406511
push dword [ebp - 0x260]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea eax, [ebp - 0x234]
push eax
jmp 0x411976
and dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0xf
mov byte [ebx], 0
mov eax, ebx
call fcn.00540ad0
ret
mov edi, 0x6361e0
push edi
call fcn.00541697
cmp dword [0x6361e0], 0xffffffff
pop ecx
jne 0x411925
and dword [ebp - 4], 0
call fcn.004ede99
push edi
cmp dword [eax + 0x1c], 1
sete byte [0x6361dc]
or dword [ebp - 4], 0xffffffff
call fcn.0054164d
pop ecx
jmp 0x411925
Function at 0x411c57
Capabilities:
Create directory

Disassembly:
push 0x140
mov eax, 0x58b87b
call fcn.00540b26
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x90]
mov esi, dword [ebp + 0xc]
push edi
push eax
call fcn.00411529
pop ecx
pop ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x90], ebx
jne 0x411d90
lea ecx, [ebp - 0x88]
call fcn.004274ae
test al, al
je 0x411ca2
mov bl, 1
jmp 0x411d90
lea eax, [ebp - 0x40]
push edi
push eax
call fcn.0041e927
pop ecx
pop ecx
cmp dword [ebp - 0x30], 0
mov byte [ebp - 4], 1
je 0x411d80
lea eax, [ebp - 0x40]
push esi
push eax
call fcn.00411c57
pop ecx
pop ecx
test al, al
je 0x411d80
lea eax, [ebp - 0x58]
push edi
push eax
call fcn.0041eaa8
pop ecx
pop ecx
cmp dword [eax + 0x14], 8
jb 0x411ce4
mov eax, dword [eax]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, 1
je 0x411d04
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [ebp - 0x149], bl
cmp eax, 0xb7
jne 0x411d0b
mov byte [ebp - 0x149], 1
lea ecx, [ebp - 0x58]
call fcn.00406537
cmp byte [ebp - 0x149], 0
je 0x411d21
xor eax, eax
inc eax
jmp 0x411d7e
call fcn.0040c312
push 2
push eax
lea ecx, [ebp - 0x148]
call fcn.0040bc1a
lea eax, [ebp - 0x148]
mov byte [ebp - 4], 2
push str.Failed_to_create_directory_at_
push eax
call fcn.004014b9
pop ecx
pop ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._due_to
push edi
push esi
call fcn.00401499
pop ecx
pop ecx
push eax
call fcn.004014b9
pop ecx
pop ecx
mov ecx, eax
call fcn.0040438f
lea ecx, [ebp - 0x148]
call fcn.0040be01
mov al, bl
mov bl, al
lea ecx, [ebp - 0x28]
call fcn.00406511
lea ecx, [ebp - 0x40]
call fcn.00406511
lea ecx, [ebp - 0x80]
call fcn.00406511
mov al, bl
call fcn.00540ad0
ret
Function at 0x411e4b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x62fff4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov ecx, edi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x38], eax
call fcn.0042756a
test al, al
jne 0x411ea1
xor ebx, ebx
mov dword [esi], 2
lea eax, [ebp - 0x1c]
mov byte [ebp - 0x1c], bl
push eax
lea ecx, [esi + 4]
mov dword [ebp - 8], 0xf
mov dword [ebp - 0xc], ebx
call fcn.00403659
lea ecx, [ebp - 0x1c]
jmp 0x411f9b
lea eax, [edi + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0041eaa8
pop ecx
pop ecx
cmp dword [eax + 0x14], 8
jb 0x411eb8
mov eax, dword [eax]
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 1
push bind
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
call fcn.00406537
cmp dword [ebp - 0x3c], 0xffffffff
jne 0x411ee8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
jmp 0x411e80
mov eax, dword [ebp - 0x38]
cdq
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x48]
push edi
push eax
mov dword [ebp - 0x44], edx
call fcn.00410d7d
pop ecx
pop ecx
push ebx
mov edi, dword [eax]
lea ecx, [ebp - 0x34]
push edi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], bl
call fcn.00406712
cmp dword [ebp - 0x20], 0x10
lea ecx, [ebp - 0x40]
push ebx
push ecx
push edi
mov edi, dword [ebp - 0x3c]
lea eax, [ebp - 0x34]
cmovae eax, dword [ebp - 0x34]
push eax
push edi
mov dword [ebp - 0x40], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
mov dword [ebp - 0x38], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x38]
cmp eax, 1
jne 0x411f63
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x40], eax
jne 0x411f71
lea eax, [ebp - 0x34]
mov dword [esi], ebx
push eax
lea ecx, [esi + 4]
call fcn.00403659
jmp 0x411f98
test eax, eax
jne 0x411f71
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
jmp 0x411f77
mov dword [esi], 0x26
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xc], ebx
push eax
lea ecx, [esi + 4]
mov dword [ebp - 8], 0xf
mov byte [ebp - 0x1c], bl
call fcn.00403659
lea ecx, [ebp - 0x1c]
call fcn.00406511
lea ecx, [ebp - 0x34]
call fcn.00406511
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00540aaa
leave
ret

Function at 0x412024
Capabilities:
Move file

Disassembly:
push 0x34
mov eax, 0x58b905
call fcn.00540b26
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.0041eaa8
mov edi, eax
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.0041eaa8
add esp, 0x10
cmp dword [edi + 0x14], 8
jb 0x41205b
mov edi, dword [edi]
cmp dword [eax + 0x14], 8
jb 0x412063
mov eax, dword [eax]
push 0xb
push edi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [ebp - 0x28]
lea ebx, [eax - 1]
neg ebx
sbb bl, bl
inc bl
call fcn.00406537
lea ecx, [ebp - 0x40]
call fcn.00406537
mov al, bl
call fcn.00540ad0
ret
Function at 0x41208e
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x62fff4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push eax
call fcn.0041103a
mov edi, eax
lea eax, [ebp - 0x1c]
push esi
push eax
call fcn.0041eaa8
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x4120c4
mov eax, dword [eax]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [ebp - 0x1c]
lea ebx, [eax - 1]
neg ebx
sbb bl, bl
inc bl
call fcn.00406537
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00540aaa
leave
ret

Function at 0x4121a9
Capabilities:
Write file on windows

Disassembly:
push 0x24
mov eax, 0x58b932
call fcn.00540b26
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x30], ecx
push eax
call fcn.0041eaa8
pop ecx
pop ecx
mov edi, eax
xor esi, esi
cmp dword [edi + 0x14], 8
mov dword [ebp - 4], esi
jb 0x4121dc
mov edi, dword [edi]
push esi
push ebx
call fcn.0041103a
pop ecx
push eax
push 2
push esi
push esi
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
lea ecx, [ebp - 0x28]
mov edi, eax
call fcn.00406537
cmp edi, 0xffffffff
jne 0x41220c
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x412256
push esi
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], esi
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x30]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 1
je 0x412230
call ebx
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, 1
je 0x412244
test esi, esi
je 0x412248
call ebx
mov esi, eax
test esi, esi
jne 0x412254
mov eax, dword [ebp + 0x10]
cmp dword [ebp - 0x2c], eax
push 0x27
pop ecx
cmovne esi, ecx
mov eax, esi
call fcn.00540ad0
ret
Function at 0x4145c0
Capabilities:
Enumerate processes

Disassembly:
push 0x2a0
mov eax, 0x58be65
call fcn.00540b26
mov dword [ebp - 0x298], ecx
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x29c], edi
mov dword [ebp - 0x2a0], edi
mov dword [ebp - 0x294], ebx
mov dword [ebp - 0x290], ebx
mov dword [ebp - 0x28c], ebx
push ebx
push 2
mov dword [ebp - 4], ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x41462a
lea eax, [ebp - 0x294]
mov ecx, edi
push eax
call fcn.00412c0d
lea ecx, [ebp - 0x294]
call fcn.00415db7
mov eax, edi
jmp 0x4147bf
lea eax, [ebp - 0x284]
mov dword [ebp - 0x284], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x41464e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41460a
mov dword [ebp - 0x2ac], ebx
mov dword [ebp - 0x2a8], ebx
mov dword [ebp - 0x2a4], ebx
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp - 0x298]
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x27c]
lea ecx, [ebp - 0x2ac]
mov dword [ebp - 0x288], eax
lea eax, [ebp - 0x288]
push eax
call fcn.0041297f
test ebx, ebx
jle 0x41469b
cmp dword [ebp - 0x288], ebx
jne 0x41474b
mov eax, dword [ebp - 0x26c]
and dword [ebp - 0x18], 0
mov dword [ebp - 0x29c], eax
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push eax
push dword [ebp - 0x288]
mov ecx, edi
call fcn.0041450b
test al, al
jne 0x414722
and dword [ebp - 0x30], 0
lea ecx, [ebp - 0x40]
xor eax, eax
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x260]
push eax
call fcn.004122af
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.0041ea15
pop ecx
pop ecx
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x28]
call fcn.004042de
lea ecx, [ebp - 0x58]
call fcn.00406511
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.00406537
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x288]
push eax
lea ecx, [ebp - 0x294]
call fcn.00412946
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00406511
lea eax, [ebp - 0x284]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x41466d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0x298]
lea esi, [ebx + 4]
push esi
call fcn.004062bb
pop ecx
lea eax, [ebp - 0x2ac]
push eax
lea ecx, [ebx + 0x34]
call fcn.00415e67
mov ecx, dword [ebp - 0x2a0]
lea eax, [ebp - 0x294]
push eax
call fcn.00412c0d
push esi
mov byte [ebp - 4], 4
call fcn.004062da
pop ecx
lea ecx, [ebp - 0x2ac]
call fcn.0040a4c2
lea ecx, [ebp - 0x294]
call fcn.00415db7
mov eax, dword [ebp - 0x2a0]
call fcn.00540ad0
ret 8
Function at 0x414f39
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x62fff4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov word [ebp - 8], 0x500
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x414f9a
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0x14]
neg eax
sbb eax, eax
and dword [ebp - 0x10], eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
cmp eax, 1
pop ebx
sete al
xor ecx, ebp
call fcn.00540aaa
leave
ret
Function at 0x41ca34
Capabilities:
Read file via mapping

Disassembly:
push 0xbc
mov eax, 0x58a7b7
call fcn.00540b26
push str.GlobalBattle.netHelperSvcPortObject
xor ebx, ebx
or edi, 0xffffffff
push ebx
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov esi, eax
test esi, esi
je 0x41ca90
push 8
pop eax
push eax
push ebx
push ebx
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x41ca87
cmp byte [eax], 1
jne 0x41ca80
push 8
pop ecx
cmp word [eax + 2], cx
jb 0x41ca80
mov edi, dword [eax + 4]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41cad4
call fcn.0040c312
push 2
push eax
lea ecx, [ebp - 0xc8]
call fcn.0040bc1a
lea eax, [ebp - 0xc8]
mov dword [ebp - 4], ebx
push str.Failed_to_open_mapping_file_due_to:
push eax
call fcn.004014b9
pop ecx
pop ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call fcn.0040438f
lea ecx, [ebp - 0xc8]
call fcn.0040be01
mov eax, edi
call fcn.00540ad0
ret
Function at 0x41d907
Capabilities:
Query service status

Disassembly:
push 0x1a0
mov eax, 0x58ceb4
call fcn.00540b26
mov ebx, dword [ebp + 0x14]
xor esi, esi
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x1a4], ecx
mov dword [ebp - 0x1a0], eax
test ebx, ebx
je 0x41d9cd
lea eax, [ebp - 0x19c]
push eax
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x41dad9
mov eax, dword [ebp - 0x198]
cmp eax, edi
je 0x41da54
sub eax, 1
je 0x41d996
sub eax, 1
je 0x41d98e
sub eax, 1
je 0x41d989
sub eax, 1
je 0x41d996
sub eax, 1
je 0x41d98e
sub eax, 1
je 0x41d984
sub eax, 1
je 0x41d996
xor al, al
jmp 0x41d998
cmp edi, 7
jmp 0x41d991
cmp edi, 1
jmp 0x41d991
cmp edi, 4
setne al
jmp 0x41d998
mov al, 1
test al, al
jne 0x41da5c
and dword [ebp - 0x1a8], 0
lea eax, [ebp - 0x1ac]
push eax
mov dword [ebp - 0x1ac], 1
call fcn.0041c56d
inc esi
pop ecx
mov ecx, dword [ebp - 0x1a4]
cmp esi, ebx
jb 0x41d938
call fcn.0040c312
push 2
pop esi
push esi
push eax
lea ecx, [ebp - 0x180]
call fcn.0040bc1a
lea eax, [ebp - 0x180]
mov dword [ebp - 4], esi
push str.Service_
push eax
call fcn.004014b9
pop ecx
pop ecx
push 0x59abe8
push ebx
push str._within
push edi
mov ecx, eax
call fcn.0041c5b4
add esp, 4
push eax
push str._failed_to
push dword [ebp - 0x1a0]
push ecx
call fcn.00401499
pop ecx
pop ecx
push eax
call fcn.004014b9
pop ecx
pop ecx
push eax
call fcn.004014b9
pop ecx
pop ecx
push eax
call fcn.004014b9
pop ecx
pop ecx
mov ecx, eax
call fcn.0040438f
push eax
call fcn.004014b9
pop ecx
pop ecx
lea ecx, [ebp - 0x180]
call fcn.0040be01
mov al, 1
call fcn.00540ad0
ret
push 1
push str.AgentErrors.log
lea ecx, [ebp - 0xc8]
call fcn.0040bc1a
lea eax, [ebp - 0xc8]
mov dword [ebp - 4], 1
push str.Encountered_state
push eax
call fcn.004014b9
push edi
mov ecx, eax
call fcn.0041c5b4
add esp, 0xc
push eax
push 0x59abac
push dword [ebp - 0x1a0]
push str._while_waiting_for_service_
push dword [ebp - 0x198]
call fcn.0041c5b4
push eax
push ecx
call fcn.004014b9
add esp, 0xc
push eax
call fcn.004014b9
pop ecx
pop ecx
push eax
call fcn.00401499
pop ecx
pop ecx
push eax
call fcn.004014b9
pop ecx
pop ecx
push eax
call fcn.004014b9
pop ecx
pop ecx
jmp 0x41db4e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 1
push str.AgentErrors.log
lea ecx, [ebp - 0xc8]
mov esi, eax
call fcn.0040bc1a
and dword [ebp - 4], 0
lea eax, [ebp - 0xc8]
push str.Failed_to_query_service_
push eax
call fcn.004014b9
pop ecx
pop ecx
push esi
push 0x59ab60
push edi
mov ecx, eax
call fcn.0041c5b4
add esp, 4
push eax
push str._while_waiting_for_service_to
push dword [ebp - 0x1a0]
push ecx
call fcn.00401499
pop ecx
pop ecx
push eax
call fcn.004014b9
pop ecx
pop ecx
push eax
call fcn.004014b9
pop ecx
pop ecx
push eax
call fcn.004014b9
pop ecx
pop ecx
mov ecx, eax
call fcn.0040438f
lea ecx, [ebp - 0xc8]
call fcn.0040be01
xor al, al
jmp 0x41da56