joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4058c5
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x413cd0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00402501
mov dword [ebp - 0x14], eax
cmp dword [0x414cf4], esi
jne 0x4059b8
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x405945
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x405a98
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x405a98
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x405a98
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x414cf4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x414cf8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x414cfc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x414d04], eax
test eax, eax
je 0x4059b5
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x414d00], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4059dd
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4059d0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x4059f2
push 4
pop eax
jmp 0x405a9a
cmp dword [ebp - 0x14], esi
je 0x4059f2
push dword [0x414cf4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4059d7
mov eax, dword [0x414d00]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x405a50
cmp dword [0x414d04], edi
je 0x405a50
push eax
call ebx
push dword [0x414d04]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x405a50
test eax, eax
je 0x405a50
call ecx
test eax, eax
je 0x405a45
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x405a45
test byte [ebp - 8], 1
jne 0x405a50
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x405a80
mov eax, dword [0x414cf8]
cmp eax, edi
je 0x405a7d
push eax
call ebx
test eax, eax
je 0x405a7d
call eax
mov esi, eax
test esi, esi
je 0x405a7d
mov eax, dword [0x414cfc]
cmp eax, edi
je 0x405a7d
push eax
call ebx
test eax, eax
je 0x405a7d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x414cf4]
call ebx
test eax, eax
je 0x405a98
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x405a9a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405aab
mov esp, ebp
pop ebp
ret
Function at 0x4010b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4010cb
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401104
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x401100
jmp 0x4010f0
cmp esi, eax
jae 0x401104
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4010f0
cmp esi, eax
jb 0x40110b
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4018b0
Capabilities:
Enumerate processes on remote desktop session host

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4417c0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x454d50]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
push 0x447d68
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x1c], ebx
call fcn.00401a40
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], ebx
je 0x4019a1
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x10]
push edx
push 1
push ebx
push ebx
call sub.WTSAPI32.dll_WTSEnumerateProcessesW
mov dword [ebp - 0x18], eax
cmp eax, ebx
je 0x4019a1
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x1c], ebx
jbe 0x4019a1
mov edi, dword [ebp - 0x10]
add edi, 8
lea ecx, [ebp - 0x14]
call fcn.00401c70
mov edx, dword [edi]
cmp edx, ebx
jne 0x401942
xor eax, eax
jmp 0x401956
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x401947
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [ebp - 0x14]
call fcn.00401f70
mov ecx, dword [ebp - 0x14]
xor eax, eax
cmp ecx, ebx
setne al
cmp eax, ebx
je 0x401990
mov eax, dword [ebp + 8]
push ecx
push eax
call fcn.004269a6
add esp, 8
cmp eax, ebx
je 0x40199a
mov eax, dword [ebp - 0x20]
inc eax
add edi, 0x10
mov dword [ebp - 0x20], eax
cmp eax, dword [ebp - 0x1c]
jb 0x401930
jmp 0x4019a1
push 0x80004005
call fcn.00401090
mov dword [ebp - 0x18], 1
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x4019b1
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
mov dword [ebp - 0x10], ebx
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4019d3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4019f9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x402500
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4416f9
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x454d50]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
call fcn.00417cef
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x40254a
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
mov ecx, dword [ebp + 8]
add eax, 0x10
mov dword [ecx], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], 1
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edi, eax
cmp edi, ebx
je 0x4025ea
push 0x20a
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, ebx
je 0x4025ea
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_HeapSize]
push eax
push ebx
push esi
call fcn.0042a570
add esp, 0xc
push 1
push 0x23
push esi
push ebx
mov dword [ebp - 0x10], ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp eax, 1
jne 0x4025ce
lea edi, [ebp - 0x10]
mov ecx, 0x105
mov edx, esi
call fcn.00402210
cmp eax, ebx
jge 0x4025c3
xor ecx, ecx
jmp 0x4025c6
mov ecx, dword [ebp - 0x10]
cmp eax, ebx
jne 0x4025d7
cmp ecx, ebx
je 0x4025d7
mov ecx, dword [ebp + 8]
push esi
call fcn.00401bc0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp eax, ebx
je 0x4025ea
push esi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [ebp + 8]
mov edx, dword [esi]
cmp dword [edx - 0xc], ebx
je 0x402602
push 0x1f
push str.EPSONPrinterConnectionChecker
mov ecx, esi
call fcn.00402ae0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403140
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push edi
xor esi, esi
call ebx
mov edi, eax
test edi, edi
je 0x40317c
push 0x82
push esi
push edi
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x4031cf
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_HeapSize]
push eax
push 0
push esi
call fcn.0042a570
add esp, 0xc
test esi, esi
je 0x4031cf
push 0x40
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edi, eax
test edi, edi
jne 0x4031a4
call ebx
test eax, eax
je 0x40319e
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
xor eax, eax
pop ebx
ret
cmp edi, 0x40
jb 0x4031cf
lea ebx, [edi + edi + 2]
call fcn.00402250
mov esi, eax
test esi, esi
je 0x4031cf
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x4031cf
call fcn.004022a0
pop edi
pop esi
xor eax, eax
pop ebx
ret
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x4032e0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x441fb6
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x454d50]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
push 0x208
lea eax, [ebp - 0x218]
push edi
push eax
mov dword [ebp - 0x21c], edi
call fcn.0042a570
add esp, 0xc
push 0x447d67
lea ecx, [ebp - 0x21c]
call fcn.00401b00
push esi
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push 0x4480cc
push str.EBAPIB6Namex86
mov dword [ebp - 4], edi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push str.PrinterDriverData
call edi
push 0x4480cc
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x4033a9
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0042a570
add esp, 0xc
push esi
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push 0x4480cc
push str.EBAPIB6Name
push str.PrinterDriverData
call edi
push 0x4480cc
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x4033f8
mov eax, dword [ebp - 0x21c]
add eax, 0xfffffff0
push eax
call fcn.00402070
add eax, 0x10
mov dword [ebx], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x21c]
add eax, 0xfffffff0
add esp, 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x40348a
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x220]
call fcn.00401a40
push eax
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 1
call fcn.00401ea0
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x220]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x403440
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x21c]
push ecx
push str.EBAPI_Name___s__r_n
push 0x4592c0
call fcn.00402620
mov eax, dword [ebp - 0x21c]
add eax, 0xfffffff0
push eax
call fcn.00402070
add eax, 0x10
mov dword [ebx], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x21c]
add eax, 0xfffffff0
add esp, 0x10
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x403496
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004267a2
mov esp, ebp
pop ebp
ret
Function at 0x406090
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0x800
push 0x40
mov dword [ebp - 4], 0
mov ebx, 0x400
call edi
mov esi, eax
test esi, esi
je 0x406106
lea ebx, [ebx]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push eax
push 0
push esi
call fcn.0042a570
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
add esp, 0xc
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
lea ecx, [ebx - 2]
mov dword [ebp - 8], eax
cmp ecx, eax
jne 0x406111
push esi
add ebx, 0x400
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea edx, [ebx + ebx]
push edx
push 0x40
call edi
mov esi, eax
test esi, esi
jne 0x4060c0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
test eax, eax
jne 0x406127
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebx + ebx]
push eax
push 0x40
call edi
mov edi, eax
test edi, edi
je 0x406115
push edi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push eax
push 0
push edi
call fcn.0042a570
add esp, 0xc
cmp dword [ebp - 8], 0
jle 0x4061c6
mov eax, esi
cmp word [eax], 0
jne 0x406160
inc dword [ebp - 4]
cmp word [eax + 2], 0
je 0x406165
add eax, 2
jmp 0x406150
cmp dword [ebp - 4], 0
jle 0x4061c6
mov dword [ebp + 0xc], esi
mov dword [ebp - 8], esi
mov ecx, dword [ebp + 0xc]
cmp word [ecx], 0
jne 0x4061c0
push edi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push eax
push 0
push edi
call fcn.0042a570
mov eax, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
sub edx, eax
sar edx, 1
inc edx
push edx
push eax
push ebx
push edi
call fcn.004278ab
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov edx, dword [ecx + 8]
add esp, 0x1c
push edi
add eax, 2
push edx
mov dword [ebp - 8], eax
call fcn.0041fa11
mov eax, dword [ebp - 8]
cmp word [eax], 0
je 0x4061c6
add dword [ebp + 0xc], 2
jmp 0x406171
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GlobalFree]
call esi
push edi
call esi
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
cmp eax, dword [ecx + 8]
je 0x4061e0
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x406330
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x441e89
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x454d50]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 3
mov ecx, dword [ebp + 8]
push 0x447d68
call fcn.00401a40
mov dword [ebp - 0x14], 1
mov edi, 0x400
call fcn.00417cef
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x406446
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 4
mov eax, dword [esi - 8]
mov ebx, dword [ebp + 0xc]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x4063c6
push edi
lea ecx, [ebp - 0x10]
call fcn.00402020
mov esi, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push ebx
push edi
push esi
push 0x447d68
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ebx, eax
mov eax, dword [esi - 8]
push eax
push esi
call fcn.00426c4d
add esp, 8
test eax, eax
jl 0x4064fd
cmp eax, dword [esi - 8]
jg 0x4064fd
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
lea eax, [edi - 1]
lea edx, [eax - 1]
cmp ebx, edx
je 0x406413
cmp ebx, eax
jne 0x406450
add esi, 0xfffffff0
mov byte [ebp - 4], 3
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x406433
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
add edi, 0x400
call fcn.00417cef
test eax, eax
jne 0x406393
push 0x80004005
call fcn.00401090
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x10]
push ecx
mov ecx, edi
call fcn.00401ea0
add esi, 0xfffffff0
mov byte [ebp - 4], 3
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x40647e
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov byte [ebp - 4], 2
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4064a1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4064c4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4064e7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x80070057
call fcn.00401090
int3
Function at 0x406650
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x441009
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x454d50]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
mov ecx, dword [ebp + 8]
push 0x447d68
call fcn.00401a40
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], 1
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebx, eax
cmp ebx, esi
je 0x4066ce
push 0x208
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
cmp edi, esi
je 0x40676c
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_HeapSize]
push eax
push esi
push edi
call fcn.0042a570
add esp, 0xc
cmp edi, esi
je 0x40676c
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ebx, eax
cmp ebx, esi
je 0x4066f0
cmp ebx, 0x104
jbe 0x406739
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp eax, esi
je 0x406703
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebx, esi
je 0x40676c
lea esi, [ebx + 1]
lea ebx, [esi + esi]
call fcn.00402250
mov edi, eax
test edi, edi
je 0x40676c
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x406728
cmp eax, esi
jbe 0x406737
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
test eax, eax
je 0x40676c
push edi
push 0
jmp 0x406765
xor esi, esi
mov eax, edi
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x406740
mov ecx, dword [ebp + 8]
sub eax, edx
sar eax, 1
push eax
push edi
call fcn.00401f70
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp eax, esi
je 0x40676c
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [ebp + 8]
call fcn.00406790
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4067f0
Capabilities:
Check os version
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x440fc0
mov eax, dword fs:[0]
push eax
sub esp, 0x15c
mov eax, dword [0x454d50]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x11c
xor edi, edi
lea eax, [ebp - 0x12c]
push edi
mov ebx, 1
push eax
mov dword [ebp - 4], ebx
call fcn.0042a570
add esp, 0xc
lea ecx, [ebp - 0x12c]
push ecx
mov dword [ebp - 0x12c], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0x38
lea edx, [ebp - 0x164]
push edi
push edx
call fcn.0042a570
add esp, 0xc
cmp dword [ebp - 0x128], 6
mov dword [ebp - 0x168], 0x3c
mov dword [ebp - 0x160], edi
jb 0x40688d
mov dword [ebp - 0x15c], str.runas
cmp dword [ebp + 0x14], edi
jne 0x406897
mov dword [ebp - 0x15c], str.open
mov edx, dword [ebp + 8]
mov dword [ebp - 0x14c], ebx
mov dword [ebp - 0x164], 0x440
mov ecx, dword [edx - 8]
mov eax, ebx
sub eax, dword [edx - 4]
or ecx, eax
jge 0x4068c3
push 0
lea ecx, [ebp + 8]
call fcn.00402020
mov edx, dword [ebp + 8]
mov dword [ebp - 0x158], edx
mov edx, dword [ebp + 0xc]
mov ecx, dword [edx - 8]
mov eax, ebx
sub eax, dword [edx - 4]
or ecx, eax
jge 0x4068e5
push 0
lea ecx, [ebp + 0xc]
call fcn.00402020
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 0x168]
push eax
mov dword [ebp - 0x154], edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x40695c
cmp dword [ebp - 0x148], 0x20
jle 0x40695c
cmp dword [ebp + 0x10], edi
jne 0x40690e
mov edi, ebx
jmp 0x40695e
cmp dword [ebp - 0x130], edi
je 0x40695e
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dword [esi], 0x103
mov ecx, dword [ebp - 0x130]
push 0x1f4
push ecx
call edi
mov edx, dword [ebp - 0x130]
push esi
push edx
call ebx
cmp dword [esi], 0x103
je 0x406928
mov eax, dword [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 1
jmp 0x40695e
xor edi, edi
mov byte [ebp - 4], 0
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406981
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4069a7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004267a2
mov esp, ebp
pop ebp
ret 0x10
Function at 0x406e00
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x440f88
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x454d50]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [ebp + 8], edi
je 0x406e8e
mov ecx, dword [ebp + 0xc]
cmp dword [ecx - 0xc], edi
je 0x406e8e
mov eax, 1
sub eax, dword [ecx - 4]
mov ecx, dword [ecx - 8]
or ecx, eax
jge 0x406e4e
push edi
lea ecx, [ebp + 0xc]
call fcn.00402020
mov eax, dword [ebp + 0xc]
push eax
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
cmp esi, edi
je 0x406e8e
cmp ebx, edi
je 0x406e67
push ebx
jmp 0x406e69
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, edi
je 0x406e84
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x406e8e
mov ecx, dword [ebp + 8]
mov edi, 1
mov dword [ecx], esi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x406eb4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8