joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43763c
Capabilities:
Resolve dns

Disassembly:
push ebp
xor eax, eax
mov ecx, 4
mov ebp, esp
push edi
push esi
lea edx, [ebp - 0x28]
push ebx
mov edi, edx
sub esp, 0x5c
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], esi
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x14]
mov dword [esp], ebx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x1c]
or eax, 1
test ebx, ebx
cmovne eax, dword [ebp + 0x1c]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x3c]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x38]
mov dword [esp + 8], eax
call sub.cygwin1.dll_getaddrinfo
test eax, eax
jne 0x4376a6
mov eax, dword [ebp - 0x3c]
test eax, eax
jne 0x4376e3
mov eax, str.not_found
jmp 0x4376ae
mov dword [esp], eax
call sub.cygwin1.dll_gai_strerror
mov edx, 0x4415cf
test esi, esi
jne 0x4376be
mov esi, 0x4415ce
mov edx, esi
test ebx, ebx
jne 0x4376c7
mov ebx, 0x4415d1
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], esi
mov dword [esp + 8], edx
mov dword [esp + 4], ebx
mov dword [esp], str._s_s_s:__s
call fcn.0041909c
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x438088
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 8]
mov dword [esp + 8], ebx
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov dword [esp], esi
call sub.cygwin1.dll_fwrite
cmp ebx, eax
je 0x4380d0
test eax, eax
jg 0x4380ca
mov dword [esp], 0x441864
call fcn.00427acc
sub ebx, eax
add esi, eax
jmp 0x438096
add esp, 0x10
pop ebx
pop esi
pop ebp
jmp fcn.004375b4

Function at 0x43828c
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [esp], ebx
mov dword [esp + 4], esi
call sub.cygwin1.dll_rename
test eax, eax
je 0x4382be
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], str.rename__s_____s
call fcn.00427acc
add esp, 0x10
pop ebx
pop esi
pop ebp
ret

Function at 0x4383e4
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.cygwin1.dll_setsockopt
inc eax
jne 0x438420
mov dword [esp], 0x4415b9
call fcn.00427acc
leave
ret
Function at 0x439b50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
cmp ebx, 1
sbb edi, edi
and edi, 0xffffffe0
add edi, 0x6e
cmp ebx, 1
sbb esi, esi
call sub.cygwin1.dll___getreent
and esi, 0x20
mov dword [esp + 0xc], edi
add esi, 0x59
mov dword [esp + 4], str.___c__c_:
mov dword [esp + 8], esi
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call fcn.004013ac
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 4]
mov dword [esp + 8], 1
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x19]
mov dword [esp], eax
call sub.cygwin1.dll_fread
test eax, eax
je 0x439c05
call sub.cygwin1.dll___locale_ctype_ptr
movzx esi, byte [ebp - 0x19]
test byte [esi + eax + 1], 8
jne 0x439c05
call sub.cygwin1.dll___locale_ctype_ptr
mov dword [esp], esi
call sub.cygwin1.dll_tolower
mov dword [esp], 0x441333
movzx eax, al
mov dword [esp + 4], eax
call fcn.0042dae4
cmp eax, 0xffffffff
cmovne ebx, eax
jmp 0x439ba2
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x401120
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 8], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [esp + 0xc]
push edi
push 0x4031ac
push esi
push eax
mov edi, ecx
mov dword [esp + 0x1c], 0
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
add esp, 0xc
test eax, eax
jne 0x40128c
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40128c
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
push 2
push 0
push eax
call esi
add esp, 0xc
push dword [esp + 0x10]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
add esp, 4
mov ebx, eax
push 0
push 0
push dword [esp + 0x18]
call esi
add esp, 0xc
push 0x40
push 0x3000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [edi], eax
test eax, eax
jne 0x4011ec
push 0x401690
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, str.Memory_allocation_failed__Error_code:
push eax
call fcn.00401470
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push dword [esp + 0x10]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
jmp 0x40129a
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [edi + 4], eax
test eax, eax
jne 0x40122b
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, str.Memory_allocation_for_shellcodeBuff_failed__n
call fcn.00401470
push 0x8000
push 0
push dword [edi]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push dword [esp + 0x10]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
jmp 0x40129a
push dword [esp + 0x10]
push ebx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
cmp eax, ebx
je 0x40125b
push str.Error_reading_file__n
call fcn.00401040
add esp, 4
push dword [edi + 4]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x40120d
push ebx
push dword [edi + 4]
push dword [edi]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push dword [esp + 0x10]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.004016bf
mov esp, ebp
pop ebp
ret 4
push esi
push str.Error_opening_file:__s_n
call fcn.00401040
add esp, 8
mov ecx, dword [esp + 0x14]
xor al, al
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004016bf
mov esp, ebp
pop ebp
ret 4
Function at 0x401ebf
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401efe
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401efe
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401efe
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401efe
cmp dword [ecx + 0x74], 0xe
jbe 0x401efe
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x401000
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, esi
call fcn.004010e0
push 0x64
push 0x40bf90
push 0x6d
push esi
call dword [sym.imp.USER32.dll_LoadStringW]
call fcn.004011b0
test eax, eax
jne 0x401031
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret 0x10
push esi
call fcn.004017e0
add esp, 4
test eax, eax
je 0x401028
push ebx
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
jne 0x401068
mov esi, str.OpenSCManager:
call fcn.004012d0
pop ebx
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret 0x10
push esi
mov ecx, ebx
call fcn.00401b60
add esp, 4
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [0x40b970], 0
je 0x401099
cmp dword [0x40b968], 0x3d
jge 0x401099
push 5
push 0
push 0
push 0x40bb80
jmp 0x4010a7
push 5
push 0
push 0x40bb80
push 0x40b978
push 0x4090d0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x4010cd
mov esi, str.ShellExecute:
call fcn.004012d0
pop ebx
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret 0x10
pop ebx
pop edi
xor eax, eax
pop esi
pop ebp
ret 0x10

Function at 0x4011b0
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x93c
mov eax, dword [0x40a03c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x918]
push eax
mov dword [ebp - 0x918], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea ecx, [ebp - 0x93c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [ebp - 0x914]
mov ecx, dword [ebp - 0x910]
lea edx, [eax + eax*4]
lea edx, [ecx + edx*2]
mov dword [0x40b968], edx
cmp eax, 5
jb 0x40120a
jne 0x40124d
test ecx, ecx
jne 0x401259
mov ecx, dword [0x40b974]
add ecx, 0x3e9
push 0x64
lea eax, [ebp - 0x804]
push eax
push ecx
push esi
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x10
push 0x40c058
lea edx, [ebp - 0x804]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401d8d
mov esp, ebp
pop ebp
ret
cmp eax, 6
ja 0x40120a
jne 0x401259
cmp ecx, 3
ja 0x40120a
mov ax, word [ebp - 0x93c]
test ax, ax
jne 0x40128c
mov dword [0x40b970], 1
mov dword [0x40b96c], 0x67
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401d8d
mov esp, ebp
pop ebp
ret
cmp ax, 9
jne 0x4012b9
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov dword [0x40b970], 0
mov dword [0x40b96c], 0x68
mov eax, 1
call fcn.00401d8d
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x40b974]
add ecx, 0x3ea
jmp 0x401216
Function at 0x401360
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
movzx eax, word [ebp + 8]
push 0xa
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x40138c
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push edi
push esi
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 4], ebx
test ebx, ebx
je 0x40140d
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push esi
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test esi, esi
jle 0x401406
cmp dword [ebp + 8], 0
je 0x401406
lea edi, [esi + 3]
and edi, 0xfffffffc
push edi
call fcn.00401deb
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x401403
mov ecx, dword [ebp + 8]
push esi
push ecx
push ebx
call fcn.004046b0
add esp, 0xc
cmp esi, edi
jge 0x4013fb
sub edi, esi
push edi
lea edx, [ebx + esi]
push 0
push edx
call fcn.004057a0
add esp, 0xc
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], esi
mov dword [eax], ebx
mov ebx, dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 8]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x401420
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push 0
push 0x20
push 3
push 0
push 1
push 0x80000000
push eax
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401452
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, esi
jne 0x4014dc
push edi
push esi
call fcn.00401deb
add esp, 4
push 0
lea ecx, [ebp - 0xc]
push ecx
mov edi, eax
push esi
push edi
push ebx
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4014d2
cmp dword [ebp - 0xc], esi
jne 0x4014d2
mov ecx, dword [ebp + 8]
mov eax, esi
cmp esi, 4
jb 0x4014a4
mov edx, dword [edi]
cmp edx, dword [ecx]
jne 0x4014cf
sub eax, 4
add ecx, 4
add edi, 4
cmp eax, 4
jae 0x401490
test eax, eax
je 0x4014c8
mov dl, byte [ecx]
cmp dl, byte [edi]
jne 0x4014cf
cmp eax, 1
jbe 0x4014c8
mov dl, byte [ecx + 1]
cmp dl, byte [edi + 1]
jne 0x4014cf
cmp eax, 2
jbe 0x4014c8
mov al, byte [ecx + 2]
cmp al, byte [edi + 2]
jne 0x4014cf
mov dword [ebp - 8], 1
mov edi, dword [ebp - 4]
push edi
call fcn.00401e6b
add esp, 4
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4014f0
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, eax
mov eax, dword [ebp + 8]
push eax
mov esi, ebx
mov eax, edi
call fcn.00401420
add esp, 4
test eax, eax
jne 0x40162b
push eax
push 0x20
push 4
push eax
push eax
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40153e
mov esi, str.CreateFile:
call fcn.004012d0
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
test edi, edi
je 0x40165b
cmp edi, ebx
je 0x4015ab
jbe 0x40165b
push 0
push 0
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
cmp eax, ebx
je 0x401584
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, str.SetFilePointer_1_:
call fcn.004012d0
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x40165b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, str.SetEndOfFile_:
call fcn.004012d0
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push edi
call fcn.00401deb
add esp, 4
push 0
lea ecx, [ebp - 8]
push ecx
push edi
push eax
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x401636
cmp dword [ebp - 8], edi
jne 0x401636
mov ecx, dword [ebp + 8]
mov edi, dword [ebp - 4]
mov eax, ebx
cmp ebx, 4
jb 0x4015f4
lea esp, [esp]
mov edx, dword [edi]
cmp edx, dword [ecx]
jne 0x40165b
sub eax, 4
add ecx, 4
add edi, 4
cmp eax, 4
jae 0x4015e0
test eax, eax
je 0x401618
mov dl, byte [ecx]
cmp dl, byte [edi]
jne 0x40165b
cmp eax, 1
jbe 0x401618
mov dl, byte [ecx + 1]
cmp dl, byte [edi + 1]
jne 0x40165b
cmp eax, 2
jbe 0x401618
mov al, byte [ecx + 2]
cmp al, byte [edi + 2]
jne 0x40165b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
push ecx
call fcn.00401e6b
add esp, 4
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
push edx
call fcn.00401e6b
add esp, 4
mov esi, str.WriteFile:
call fcn.004012d0
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
je 0x401685
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, str.SetFilePointer_2_:
call fcn.004012d0
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
push 0
lea eax, [ebp - 8]
push eax
push ebx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4016b2
cmp dword [ebp - 8], ebx
jne 0x4016b2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, str.WriteFile:
call fcn.004012d0
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4016d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x40a03c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x40b970], 0
push esi
push edi
mov esi, edx
push 0x104
mov edi, ecx
push esi
je 0x40171e
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x401744
mov esi, str.GetSystemDirectory:
call fcn.004012d0
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401d8d
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
test eax, eax
jne 0x401744
mov esi, str.GetSystemWow64Directory:
call fcn.004012d0
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401d8d
mov esp, ebp
pop ebp
ret
push str.driversUFileEncyptionDriver.sys
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov ecx, dword [0x40b96c]
lea eax, [ebp - 0x808]
push eax
push ecx
call fcn.00401360
add esp, 8
test eax, eax
jne 0x4017ad
mov eax, dword [0x40b974]
push 0x64
lea edx, [ebp - 0x804]
push edx
add eax, 0x3eb
push eax
push edi
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x10
push 0x40c058
lea ecx, [ebp - 0x804]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401d8d
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x808]
push ebx
mov ebx, eax
push edi
mov eax, esi
call fcn.004014f0
push edi
mov esi, eax
call fcn.00401e6b
mov ecx, dword [ebp - 4]
add esp, 8
pop ebx
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00401d8d
mov esp, ebp
pop ebp
ret
Function at 0x401d8d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40a03c]
jne 0x401d97
repz ret
jmp fcn.00402016

Function at 0x40433c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40a03c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040318e
and dword [ebp - 0x14], 0
cmp dword [0x40b8ec], 0
mov dword [ebp - 0x18], eax
jne 0x4043ef
push 0x407d90
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x404497
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x407d84
push ebx
call edi
test eax, eax
je 0x404497
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x407d74
push ebx
mov dword [0x40b8ec], eax
call edi
push eax
call esi
push 0x407d60
push ebx
mov dword [0x40b8f0], eax
call edi
push eax
call esi
push 0x407d44
push ebx
mov dword [0x40b8f4], eax
call edi
push eax
call esi
mov dword [0x40b8fc], eax
test eax, eax
je 0x4043ef
push 0x407d2c
push ebx
call edi
push eax
call esi
mov dword [0x40b8f8], eax
mov eax, dword [0x40b8f8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x404448
cmp dword [0x40b8fc], ecx
je 0x404448
push eax
call esi
push dword [0x40b8fc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x404448
test ebx, ebx
je 0x404448
call edi
test eax, eax
je 0x40443f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40443f
test byte [ebp - 8], 1
jne 0x404448
or dword [ebp + 0x10], 0x200000
jmp 0x40447b
mov eax, dword [0x40b8f0]
cmp eax, dword [ebp - 0x18]
je 0x40447b
push eax
call esi
test eax, eax
je 0x40447b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40447b
mov eax, dword [0x40b8f4]
cmp eax, dword [ebp - 0x18]
je 0x40447b
push eax
call esi
test eax, eax
je 0x40447b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x40b8ec]
call esi
test eax, eax
je 0x404497
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x404499
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401d8d
leave
ret
Function at 0x1002439
Capabilities:
Get user security identifier

Disassembly:
push 0x14
mov eax, 0x10113a1
call fcn.01001410
mov edi, dword [ebp + 0xc]
xor esi, esi
cmp edi, esi
je 0x100568e
cmp dword [ebp + 8], esi
je 0x1005698
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp + 8]
mov dword [edi], esi
push esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], esi
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x10056cd
mov eax, dword [ebp - 0x18]
push 2
xor ecx, ecx
pop edx
mul edx
seto cl
mov dword [ebp - 4], esi
neg ecx
or eax, ecx
push eax
call dword [0x1014498]
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
je 0x1002502
push dword [ebp - 0x1c]
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
mov dword [edi], eax
cmp eax, esi
je 0x10024fb
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x18]
push ecx
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1c]
push ecx
push eax
push dword [ebp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x10056b6
xor ebx, ebx
push dword [ebp - 0x14]
call dword [0x1014494]
mov eax, ebx
call fcn.01001340
ret 8
mov ebx, 0x8007000e
jmp 0x10024e8
mov ebx, 0x8007000e
jmp 0x10024f1
mov eax, 0x80004003
jmp 0x10024f3
mov eax, 0x80070057
jmp 0x10024f3
call fcn.01003252
push dword [edi]
mov ebx, eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov dword [edi], esi
jmp 0x10024e8
push eax
call fcn.01009411
mov ebx, eax
jmp 0x10024f1

Function at 0x1003826
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call fcn.01002c4a
mov eax, 0x1000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x98]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x10038c8
cmp dword [ebp - 0x94], 5
jb 0x100389b
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x10038e4
call fcn.01002230
test eax, eax
jl 0x1005dbc
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.010012fd
leave
ret
cmp dword [ebp - 0x88], 1
je 0x1005da4
jmp 0x100389b
cmp dword [ebp - 0x90], 0
jbe 0x100389b
jmp 0x1003897
cmp dword [ebp - 0x94], 4
ja 0x1003897
je 0x10038d7
jmp 0x100389b
mov byte [0x1014548], 1
jmp 0x10038b9