joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40fb3b
Capabilities:
Create process on windows
Delete file
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push 0x4c0
mov eax, 0x437207
call fcn.004226b6
mov dword [ebp - 0x4c4], ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x424]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [ebp - 0x4c0], eax
test eax, eax
je 0x40fd60
lea eax, [ebp - 0x21c]
xor ebx, ebx
push eax
push ebx
push 0x445ac4
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x40fd60
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x4b0]
call fcn.00402742
mov edi, 0x445acc
mov dword [ebp - 4], ebx
push edi
call fcn.00425b9b
pop ecx
push eax
push edi
lea ecx, [ebp - 0x4b0]
call fcn.00404e09
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp - 0x4b0]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x4cc], 0x443654
mov dword [ebp - 0x4c8], edi
or ebx, 0xffffffff
mov byte [ebp - 4], 1
cmp edi, ebx
je 0x40fd47
call fcn.0040219e
push eax
lea ecx, [ebp - 0x4b8]
call fcn.00401fe1
mov byte [ebp - 4], 2
lea eax, [ebp - 0x4a8]
push 3
push dword [esi]
lea ecx, [ebp - 0x4ac]
mov dword [ebp - 0x4ac], eax
call fcn.004109d0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x4bc]
push dword [ebp - 0x4ac]
call fcn.00404405
lea eax, [ebp - 0x4a8]
mov byte [ebp - 4], 5
cmp dword [ebp - 0x4ac], eax
je 0x40fc71
push dword [ebp - 0x4ac]
call fcn.0042623f
pop ecx
push dword [ebp - 0x4bc]
lea eax, [ebp - 0x4b8]
push str._InternetShortcut__r_nURL_s_r_n
push eax
call fcn.00404a41
mov esi, dword [ebp - 0x4b8]
lea eax, [ebp - 0x4c0]
add esp, 0xc
push 0
push eax
push dword [esi - 0xc]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x4b4], eax
test edi, edi
je 0x40fcc3
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0x4b4]
xor edi, edi
test eax, eax
je 0x40fcdf
push 5
push edi
push edi
push dword [ebp - 0x4b0]
push 0x443648
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x5c
push dword [ebp - 0x4b0]
call fcn.00423f5c
pop ecx
pop ecx
test eax, eax
je 0x40fcfc
mov ebx, eax
sub ebx, dword [ebp - 0x4b0]
sar ebx, 1
push ebx
lea eax, [ebp - 0x4b4]
push eax
lea ecx, [ebp - 0x4b0]
call fcn.0040812e
mov edx, dword [ebp - 0x4c4]
mov ecx, eax
add edx, 0x1c
mov byte [ebp - 4], 6
call fcn.004077b8
mov ecx, dword [ebp - 0x4b4]
lea ecx, [ecx - 0x10]
call fcn.00402471
mov ecx, dword [ebp - 0x4bc]
lea ecx, [ecx - 0x10]
call fcn.00402471
lea ecx, [esi - 0x10]
call fcn.00402471
test edi, edi
je 0x40fd52
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x4b0]
lea ecx, [ecx - 0x10]
call fcn.00402471
call fcn.00422671
ret 4
Function at 0x41149d
Capabilities:
Create thread

Disassembly:
push 0xc
mov eax, 0x436dfd
call fcn.00422682
mov esi, ecx
mov dword [ebp - 0x14], esi
mov edx, dword [0x44ecf8]
lea ebx, [esi + 4]
push ecx
mov ecx, dword [ebx]
call fcn.004175f6
mov ecx, ebx
call fcn.0040c16d
mov eax, dword [esi + 0x28]
mov edi, dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [eax]
push dword [ebx]
call edi
call fcn.0040219e
push eax
lea ecx, [ebp - 0x10]
call fcn.00401fe1
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
push 0xdc
call fcn.004023c9
push 0x40a
push dword [ebx]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, dword [ebp - 0x10]
push esi
push eax
call edi
mov edi, dword [ebp - 0x14]
push dword [ebx]
lea ecx, [edi + 0x40]
call fcn.0041d760
lea eax, [ebp - 0x18]
xor ecx, ecx
push eax
push ecx
lea eax, [edi + 0x30]
push eax
push 0x411542
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea ecx, [esi - 0x10]
mov dword [edi + 0x38], eax
call fcn.00402471
xor eax, eax
call fcn.0042265c
ret 0x10
Function at 0x411904
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x21c
mov eax, dword [0x44e080]
xor eax, esp
mov dword [esp + 0x214], eax
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebp, ebp
cmp dword [edi + 0x30], ebp
jne 0x411a90
lea esi, [edi + 0x24]
mov eax, dword [esi]
cmp dword [eax - 0xc], ebp
jne 0x4119bb
push 0x104
lea eax, [esp + 0x1c]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x411966
add eax, eax
cmp eax, 0x208
jae 0x411aa9
xor ecx, ecx
lea ebx, [esp + 0x18]
mov word [esp + eax + 0x18], cx
jmp 0x41196b
mov ebx, str.Logger
push ebx
call fcn.00425b9b
pop ecx
push eax
push ebx
mov ecx, esi
call fcn.004026cf
push 0x2e
push dword [esi]
call fcn.00423f5c
pop ecx
pop ecx
mov ecx, eax
test ecx, ecx
je 0x4119a4
mov eax, dword [esi]
sub ecx, eax
sar ecx, 1
test ecx, ecx
jle 0x4119a4
mov eax, dword [eax - 0xc]
sub eax, ecx
push eax
push ecx
mov ecx, esi
call fcn.004045a9
mov ebx, str..log
push ebx
call fcn.00425b9b
pop ecx
push eax
push ebx
mov ecx, esi
call fcn.00404e09
mov eax, dword [esi]
push ebp
push 0x80
push 4
push ebp
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
lea esi, [edi + 0x2c]
mov ebx, eax
mov ecx, dword [esi + 4]
cmp ebx, ecx
je 0x4119ea
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 4]
mov dword [esi + 4], ebx
mov ecx, ebx
cmp dword [edi + 0x30], 0xffffffff
jne 0x4119f7
test ecx, ecx
jmp 0x411a84
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x411a1c
cmp dword [edi + 0x30], ebp
je 0x411a90
push 2
push ebp
push ebp
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x411a52
test eax, eax
jne 0x411a81
cmp dword [edi + 0x30], ebp
je 0x411a81
push 2
pop ecx
push ebp
lea eax, [esp + 0x18]
mov dword [esp + 0x14], 0xfeff
push eax
push ecx
lea eax, [esp + 0x1c]
mov dword [esp + 0x20], ecx
push eax
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
cmp dword [edi + 0x30], ebp
je 0x411a90
lea eax, [edi + 0x28]
mov ecx, edi
push eax
call fcn.00411aaf
lea ecx, [esp + 0x10]
call fcn.00411ade
push eax
mov ecx, edi
call fcn.00411aaf
mov ecx, dword [esp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.00402471
jmp 0x411a90
cmp dword [esi + 4], ebp
je 0x411a90
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov dword [esi + 4], ebp
mov ecx, dword [esp + 0x224]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00421c45
add esp, 0x21c
ret
call fcn.004222e1
int3

Function at 0x411aaf
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push 0
mov esi, ecx
mov edx, dword [eax]
lea eax, [ebp + 8]
push eax
mov eax, dword [edx - 0xc]
add eax, eax
push eax
push edx
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
pop esi
pop ebp
ret 4
Function at 0x4142b1
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x1c
mov eax, 0x437a1a
call fcn.00422682
mov ecx, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x18], edi
mov ecx, dword [ecx]
sub ecx, 0x10
call fcn.00404f5e
lea esi, [eax + 0x10]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], edi
cmp byte [ebp + 0xc], 0
je 0x4142f9
push 0x5c
push esi
call fcn.00423f5c
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jne 0x4142f3
or ebx, 0xffffffff
jmp 0x4142fc
sub ebx, esi
sar ebx, 1
jmp 0x4142fc
mov ebx, dword [esi - 0xc]
cmp byte [ebp + 0xc], 0
je 0x41431d
push ebx
push edi
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00404457
mov ecx, eax
xor eax, eax
inc eax
mov byte [ebp - 4], al
mov edi, dword [ebp - 0x14]
jmp 0x414334
lea ecx, [esi - 0x10]
call fcn.00404f5e
lea edi, [eax + 0x10]
mov dword [ebp - 0x14], edi
push 2
pop eax
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], eax
mov dl, byte [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], eax
call fcn.00414ab3
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x446df8
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 3
mov eax, dword [ebp - 0x10]
test al, 2
je 0x41436e
and eax, 0xfffffffd
lea ecx, [edi - 0x10]
mov dword [ebp - 0x10], eax
call fcn.00402471
mov eax, dword [ebp - 0x10]
mov byte [ebp - 4], 5
test al, 1
je 0x414381
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.00402471
mov edi, dword [ebp - 0x18]
test edi, edi
jne 0x414390
xor ebx, ebx
inc ebx
jmp 0x414460
cmp byte [ebp + 0xc], 0
jne 0x4143a6
push dword [ebp + 0x14]
push edi
call fcn.00414535
xor ebx, ebx
jmp 0x414460
call fcn.0040219e
push eax
lea ecx, [ebp + 0xc]
call fcn.00401fe1
mov ecx, dword [ebp + 8]
lea eax, [ebx + 1]
push eax
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 6
push eax
call fcn.0040816e
mov ebx, eax
lea eax, [ebp + 0x10]
mov byte [ebp - 4], 7
and dword [ebp + 0x10], 0
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
push 0
push dword [ebx]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp + 8], eax
cmp eax, 0xea
jne 0x41442d
push dword [ebp + 0x10]
lea ecx, [ebp + 0xc]
call fcn.00402588
mov edi, dword [ebx]
lea eax, [ebp + 0x10]
push eax
lea ecx, [ebp + 0xc]
call fcn.0040466c
push eax
lea eax, [ebp - 0x20]
push eax
push 0
push edi
mov edi, dword [ebp - 0x18]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ecx
lea ecx, [ebp + 0xc]
mov dword [ebp + 8], eax
call fcn.00404f3e
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 6
xor ebx, ebx
mov ecx, dword [ebp - 0x14]
test eax, eax
setne bl
lea ecx, [ecx - 0x10]
call fcn.00402471
cmp dword [ebp + 8], 0
jne 0x414455
mov ecx, dword [ebp + 0x14]
lea eax, [ebp + 0xc]
push eax
call fcn.004042a2
mov ecx, dword [ebp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.00402471
test edi, edi
je 0x41446b
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esi - 0x10]
call fcn.00402471
mov eax, ebx
call fcn.0042265c
ret 0x10
Function at 0x414535
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x20c]
sub esp, 0x20c
push 0xffffffffffffffff
push 0x436aa9
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x44e080]
xor eax, ebp
mov dword [ebp + 0x208], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x218]
xor ecx, ecx
mov esi, dword [ebp + 0x214]
mov ebx, ecx
push ecx
push ecx
push ecx
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push ecx
push eax
lea eax, [ebp]
push eax
push ecx
jmp 0x4145ca
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x14]
call fcn.00402742
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
and dword [ebp - 4], 0
push eax
call fcn.004042a2
or dword [ebp - 4], 0xffffffff
inc ebx
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00402471
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp]
push eax
push ebx
push esi
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x41458f
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.00421c45
add ebp, 0x20c
leave
ret 8
Function at 0x414600
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0x294
mov eax, 0x437a9f
call fcn.004226b6
mov edi, ecx
mov dword [ebp - 0x294], edi
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x290], esi
mov dword [ebp - 0x28c], eax
xor ebx, ebx
lea ecx, [ebp + 8]
mov dword [ebp - 4], ebx
call fcn.00407130
call fcn.0040219e
push eax
lea ecx, [ebp - 0x288]
call fcn.00401fe1
lea eax, [ebp - 0x288]
mov byte [ebp - 4], 1
push eax
push esi
push ecx
mov esi, esp
mov dword [ebp - 0x27c], esi
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00404f5e
add eax, 0x10
mov dword [esi], eax
call fcn.0041488a
test al, al
je 0x4146c9
lea eax, [ebp - 0x288]
push eax
lea ecx, [ebp - 0x24]
call fcn.004121e0
push ecx
lea eax, [ebp - 0x27c]
push eax
lea ecx, [ebp - 0x24]
call fcn.004123b2
mov ecx, dword [ebp - 0x28c]
push eax
mov byte [ebp - 4], 2
call fcn.004042a2
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x27c]
lea ecx, [ecx - 0x10]
call fcn.00402471
lea eax, [ebp - 0x24]
mov ecx, edi
push eax
call fcn.004149fb
test al, al
jne 0x414828
cmp dword [ebp + 0xc], 1
jge 0x4146d7
xor ebx, ebx
inc ebx
jmp 0x414828
push 0x250
lea eax, [ebp - 0x278]
push ebx
push eax
call fcn.00423750
mov ecx, dword [ebp + 8]
add esp, 0xc
lea ecx, [ecx - 0x10]
call fcn.00404f5e
add eax, 0x10
mov dword [ebp - 0x280], eax
mov esi, 0x444d74
mov byte [ebp - 4], 3
push esi
call fcn.00425b9b
pop ecx
push eax
push esi
lea ecx, [ebp - 0x280]
call fcn.00404e09
mov esi, dword [ebp - 0x280]
cmp dword [esi - 4], 1
jle 0x41473d
push dword [esi - 0xc]
lea ecx, [ebp - 0x280]
call fcn.00402489
mov esi, dword [ebp - 0x280]
lea eax, [ebp - 0x278]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
mov dword [ebp - 0x2a0], 0x443514
mov dword [ebp - 0x27c], edi
mov dword [ebp - 0x29c], edi
lea eax, [ebp - 0x278]
mov byte [ebp - 4], 4
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp edi, 0xffffffff
je 0x414812
lea ecx, [ebp - 0x278]
call fcn.00414861
test al, al
je 0x4147fb
lea eax, [ebp - 0x24c]
push eax
lea edx, [ebp + 8]
lea ecx, [ebp - 0x284]
call fcn.00411b8a
pop ecx
push dword [ebp - 0x28c]
mov eax, dword [ebp + 0xc]
push dword [ebp - 0x290]
dec eax
mov byte [ebp - 4], 5
push eax
push ecx
mov ecx, dword [ebp - 0x284]
mov edi, esp
mov dword [ebp - 0x298], edi
lea ecx, [ecx - 0x10]
call fcn.00404f5e
mov ecx, dword [ebp - 0x294]
add eax, 0x10
mov dword [edi], eax
call fcn.00414600
test eax, eax
je 0x41484b
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x284]
lea ecx, [ecx - 0x10]
call fcn.00402471
mov edi, dword [ebp - 0x27c]
lea eax, [ebp - 0x278]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, 1
je 0x41477e
xor ebx, ebx
inc ebx
test edi, edi
je 0x414820
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esi - 0x10]
call fcn.00402471
mov ecx, dword [ebp - 0x288]
add ecx, 0xfffffff0
call fcn.00402471
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00402471
mov eax, ebx
call fcn.00422671
ret 0x10
mov ecx, dword [ebp - 0x284]
lea ecx, [ecx - 0x10]
call fcn.00402471
mov edi, dword [ebp - 0x27c]
jmp 0x414815
Function at 0x414b2e
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc
mov eax, 0x437b51
call fcn.00422682
cmp byte [ebp + 0x10], 0
jne 0x414b6f
mov dl, byte [ebp + 0xc]
mov ecx, dword [ebp + 8]
call fcn.00414ab3
cmp byte [ebp + 0x14], 0
je 0x414b58
test eax, eax
setne bl
jmp 0x414b5d
test eax, eax
sete bl
test eax, eax
je 0x414b68
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
jmp 0x414c0f
mov ebx, dword [ebp + 8]
push 0x5c
push dword [ebx]
call fcn.00423f5c
pop ecx
pop ecx
mov esi, eax
push 3
pop edi
test esi, esi
je 0x414bfd
sub esi, dword [ebx]
sar esi, 1
js 0x414bfd
push esi
push 0
lea eax, [ebp + 0x10]
mov ecx, ebx
push eax
call fcn.00404457
and dword [ebp - 4], 0
lea ecx, [ebp + 0x10]
mov dl, byte [ebp + 0xc]
call fcn.00414ab3
mov dword [ebp + 8], eax
mov dword [ebp - 0x14], 0x446df8
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x414bf2
lea edx, [esi + 1]
mov ecx, ebx
push edx
lea eax, [ebp + 0xc]
push eax
call fcn.0040816e
mov esi, dword [ebp + 0xc]
xor eax, eax
mov ebx, dword [ebp + 8]
push eax
push eax
push eax
push eax
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esi - 0x10]
mov edi, eax
call fcn.00402471
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.00402471
cmp byte [ebp + 0x14], 0
je 0x414c0a
test edi, edi
sete al
jmp 0x414c0f
test edi, edi
setne al
call fcn.0042265c
ret 0x10
Function at 0x415105
Capabilities:
Get disk size

Disassembly:
sub esp, 0x424
mov eax, dword [0x44e080]
xor eax, esp
mov dword [esp + 0x41c], eax
push ebx
push ebp
push esi
push edi
test ecx, ecx
je 0x415249
movzx eax, word [ecx]
lea esi, [esp + 0x28]
push 2
pop ebp
test ax, ax
je 0x415146
mov edx, esi
sub ecx, edx
mov word [esi], ax
add esi, ebp
movzx eax, word [ecx + esi]
test ax, ax
jne 0x415138
xor eax, eax
mov edx, esi
mov word [esi], ax
xor cl, cl
push 0x5c
xor al, al
mov dword [esp + 0x1c], edx
pop edi
sub esi, ebp
mov byte [esp + 0x17], al
cmp word [esp + 0x28], di
jne 0x41517b
cmp word [esp + 0x2a], di
jne 0x41517b
xor ebx, ebx
inc ebx
cmp word [esi], di
mov byte [esp + 0x17], bl
setne cl
jmp 0x415187
xor ebx, ebx
movzx eax, al
inc ebx
cmp word [esi], di
cmove eax, ebx
push 0x5c
pop ebp
cmp word [esp + 0x2c], bp
lea edi, [esp + 0x2c]
push 2
pop ebp
je 0x4151a6
push 0x5c
pop edx
add edi, ebp
cmp word [edi], dx
jne 0x41519b
mov edx, dword [esp + 0x18]
test cl, cl
jne 0x4151b0
test al, al
je 0x4151c1
jmp 0x4151ba
mov esi, edx
push 0x5c
pop eax
mov word [esi], ax
add esi, ebp
xor eax, eax
mov word [esi], ax
sub esi, ebp
xorps xmm0, xmm0
movlpd qword [esp + 0x20], xmm0
and dword [esp + 0x18], 0
lea eax, [esp + 0x18]
and dword [esp + 0x1c], 0
push eax
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x415227
push 0x5c
pop ecx
cmp word [esi], cx
lea eax, [esi - 2]
cmovne eax, esi
mov esi, eax
jmp 0x415205
cmp word [esi], cx
je 0x41520d
sub esi, ebp
lea eax, [esp + 0x28]
cmp esi, eax
ja 0x4151fe
cmp esi, edi
jb 0x415249
cmp byte [esp + 0x17], 0
jne 0x41521c
cmp esi, edi
jne 0x41521e
add esi, ebp
xor eax, eax
mov word [esi], ax
sub esi, ebp
jmp 0x4151ca
mov eax, dword [esp + 0x43c]
cmp eax, dword [esp + 0x24]
ja 0x415243
jb 0x415245
mov eax, dword [esp + 0x438]
cmp eax, dword [esp + 0x20]
jb 0x415245
xor bl, bl
mov al, bl
jmp 0x41524b
xor al, al
mov ecx, dword [esp + 0x42c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00421c45
add esp, 0x424
ret
Function at 0x4152e1
Capabilities:
Create process on windows

Disassembly:
push 0x68
mov eax, 0x437bda
call fcn.00422682
mov esi, edx
mov ebx, ecx
push 0x44
pop edi
push edi
lea eax, [ebp - 0x74]
push 0
push eax
call fcn.00423750
mov dword [ebp - 0x74], edi
xor eax, eax
lea edi, [ebp - 0x28]
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], al
mov edx, dword [ebx]
lea eax, [ebp - 0x28]
mov ecx, dword [esi]
xor ebx, ebx
push eax
lea eax, [ebp - 0x74]
push eax
push ebx
push ebx
push dword [ebp + 0xc]
xor eax, eax
cmp dword [ecx - 0xc], ebx
push ebx
push ebx
cmovne eax, ecx
push ebx
push eax
xor eax, eax
cmp dword [edx - 0xc], ebx
cmovne eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x41535a
mov esi, dword [ebp + 8]
test esi, esi
je 0x415381
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
jmp 0x415381
cmp dword [ebp + 8], ebx
je 0x415376
push 0xffffffffffffffff
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp + 8]
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
mov dword [ebp - 4], 2
cmp byte [ebp - 0x14], 0
je 0x4153a2
call fcn.0041e81d
mov eax, dword [0x44fc4c]
test eax, eax
je 0x4153a2
lea ecx, [ebp - 0x18]
push ecx
call eax
mov al, bl
call fcn.0042265c
ret
Function at 0x4153aa
Capabilities:
Create process on windows

Disassembly:
push 0x48
mov eax, 0x437c2f
call fcn.00422682
mov dword [ebp - 0x18], edx
mov edi, ecx
push 0x3c
xor eax, eax
pop esi
push esi
push eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x54]
push eax
call fcn.00423750
mov ebx, dword [ebp + 0xc]
mov eax, 0x400
add esp, 0xc
mov dword [ebp - 0x54], esi
mov esi, dword [edi]
test ebx, ebx
lea ecx, [eax + 0x40]
cmovne eax, ecx
mov ecx, edi
mov dword [ebp - 0x50], eax
call fcn.00407af9
test al, al
je 0x4153fa
add esi, 8
mov ecx, dword [ebp - 0x18]
movzx eax, byte [ebp + 0x10]
xor eax, 1
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x38], eax
mov ecx, dword [ecx]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], 0x443648
cmp dword [ecx - 0xc], 0
cmovne eax, ecx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax]
cmp dword [ecx - 0xc], 0
jne 0x415443
mov edx, edi
lea ecx, [ebp + 0x18]
call fcn.00407369
and dword [ebp - 4], 0
xor ecx, ecx
mov eax, dword [eax]
inc ecx
mov edi, dword [ebp + 0xc]
jmp 0x41545d
add ecx, 0xfffffff0
call fcn.00404f5e
add eax, 0x10
mov edi, eax
mov dword [ebp + 0xc], edi
push 2
mov dword [ebp - 4], 1
pop ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp + 0x10], ecx
lea ecx, [eax - 0x10]
call fcn.00404f5e
lea esi, [eax + 0x10]
mov dword [ebp + 0xc], esi
mov dword [ebp - 4], 2
mov eax, dword [ebp + 0x10]
test al, 2
je 0x415490
and eax, 0xfffffffd
lea ecx, [edi - 0x10]
mov dword [ebp + 0x10], eax
call fcn.00402471
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 4
test al, 1
je 0x4154a3
mov ecx, dword [ebp + 0x18]
lea ecx, [ecx - 0x10]
call fcn.00402471
lea ecx, [ebp + 0xc]
mov edi, esi
call fcn.00407af9
test al, al
je 0x4154b4
lea edi, [esi + 8]
lea eax, [ebp - 0x54]
mov dword [ebp - 0x3c], edi
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x4154d3
test ebx, ebx
je 0x415505
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx], eax
jmp 0x415505
test ebx, ebx
je 0x4154f2
cmp dword [ebp - 0x1c], 0
je 0x415501
push 0xffffffffffffffff
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 0x1c], 0
je 0x415501
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x14], 1
lea ecx, [esi - 0x10]
call fcn.00402471
mov al, byte [ebp - 0x14]
call fcn.0042265c
ret
Function at 0x41580c
Capabilities:
Compare security identifiers

Disassembly:
push 0x24
mov eax, 0x437c97
call fcn.004226b6
xor ebx, ebx
mov dword [ebp - 0x28], 0x443654
mov dword [ebp - 0x24], ebx
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], ebx
call fcn.00404ec2
lea eax, [ebp - 0x24]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x415851
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4158f6
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], ebx
push eax
push ebx
push ebx
push 1
push dword [ebp - 0x24]
mov esi, ebx
mov dword [ebp - 0x2c], esi
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x41589e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4158e9
push dword [ebp - 0x20]
lea ecx, [ebp - 0x2c]
call fcn.0040b63b
mov esi, dword [ebp - 0x2c]
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push esi
push 1
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x4158e9
cmp dword [ebp - 0x20], 0
je 0x4158e9
lea eax, [ebp - 0x30]
mov dword [ebp - 0x1c], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea eax, [ebp - 0x1c]
mov word [ebp - 0x18], 0x500
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x4158ef
push dword [ebp - 0x30]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
push dword [ebp - 0x30]
lea ebx, [eax - 1]
neg ebx
sbb bl, bl
inc bl
call dword [sym.imp.ADVAPI32.dll_FreeSid]
jmp 0x4158ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call fcn.004221b9
pop ecx
cmp dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0x443654
je 0x41590c
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
call fcn.00422671
ret