joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4036e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, ecx
mov ecx, 0x518252
push edi
mov edi, edx
call fcn.004dd464
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x403745
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x403745
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x403732
cmp esi, edx
jae 0x403745
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x403720
cmp esi, edx
jae 0x403745
xor eax, eax
cmp word [esi], ax
pop edi
cmove esi, eax
mov eax, esi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x403f30
Capabilities:
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4de1be
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push esi
mov esi, ecx
mov ecx, 0x518caa
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x14], 0
call fcn.004dd464
mov dword [ebp - 4], 1
call fcn.00402970
mov ecx, eax
test ecx, ecx
je 0x404037
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 1
push eax
push 1
push 0
push 0
call dword [sym.imp.WTSAPI32.dll_WTSEnumerateSessionsW]
test eax, eax
je 0x404026
mov edx, dword [ebp - 0x18]
xor eax, eax
push edi
mov edi, dword [ebp - 0x1c]
test edx, edx
je 0x403fd4
lea ecx, [edi + 8]
cmp dword [ecx], 0
je 0x403fc7
inc eax
add ecx, 0xc
cmp eax, edx
jb 0x403fb8
jmp 0x403fd4
lea eax, [eax + eax*2]
movq xmm0, qword [edi + eax*4]
movq qword [ebp - 0x30], xmm0
push edi
mov edi, dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
call edi
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x10]
push eax
push 5
push dword [ebp - 0x30]
push 0
call dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
test eax, eax
je 0x404025
mov edx, dword [ebp - 0x10]
test edx, edx
jne 0x404001
xor ecx, ecx
jmp 0x404017
mov ecx, edx
push ebx
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404007
sub ecx, ebx
sar ecx, 1
pop ebx
push ecx
push edx
mov ecx, esi
call fcn.00406740
push dword [ebp - 0x10]
call edi
pop edi
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004027e0
int3
Function at 0x404050
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4de1ed
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x11], dl
mov dword [ebp - 0x28], ecx
mov ecx, 0x518caa
mov dword [ebp - 4], 0
call fcn.004dd464
lea eax, [ebp + 8]
mov byte [ebp - 4], 1
push eax
mov edx, 0x505aec
mov dword [ebp - 0x18], 1
lea ecx, [ebp - 0x24]
call fcn.004055d0
add esp, 4
push 0x505aec
mov edx, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20]
call fcn.00405760
add esp, 4
mov byte [ebp - 4], 3
mov edx, dword [eax]
mov edi, dword [ebp + 8]
add edi, 0xfffffff0
lea ecx, [edx - 0x10]
cmp ecx, edi
je 0x404118
mov eax, dword [edi + 0xc]
lea ebx, [edi + 0xc]
shr eax, 0x1f
test al, al
jne 0x40410c
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x40410c
call fcn.00406660
or esi, 0xffffffff
mov dword [ebp - 0x1c], eax
mov ecx, esi
lock xadd dword [ebx], ecx
dec ecx
test ecx, ecx
jg 0x404104
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x1c]
add eax, 0x10
mov dword [ebp + 8], eax
jmp 0x40411b
push dword [edx - 0xc]
lea ecx, [ebp + 8]
push edx
call fcn.00406740
or esi, 0xffffffff
mov edx, dword [ebp - 0x20]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x404135
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x24]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40414f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp + 0x14], 0
mov ecx, 0x440
mov eax, 0x40
mov dword [ebp - 0x64], 0x3c
cmovne eax, ecx
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x60], eax
mov ecx, 5
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x28]
movlpd qword [ebp - 0x40], xmm0
movlpd qword [ebp - 0x38], xmm0
movlpd qword [ebp - 0x30], xmm0
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
xor eax, eax
cmp byte [ebp + 0x10], al
mov dword [ebp - 0x58], 0
cmovne eax, ecx
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x64]
push eax
mov dword [ebp - 0x44], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x4041d2
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [edi], eax
cmp byte [ebp - 0x11], 0
je 0x4041f1
push dword [ebp + 0x18]
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebp + 8]
mov edi, dword [ebp - 0x18]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], esi
dec esi
test esi, esi
jg 0x40420c
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404590
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4de265
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
mov ecx, 0x518caa
call fcn.004dd464
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
push ecx
mov dword [ebp - 4], 0
lea ebx, [ebp - 0x20]
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0x505b3c
call fcn.00406170
push ecx
mov byte [ebp - 4], 1
mov esi, esp
mov dword [ebp - 0x10], esi
mov ecx, dword [edi]
sub ecx, 0x10
call fcn.00406660
add eax, 0x10
mov ecx, ebx
mov dword [esi], eax
mov byte [ebp - 4], 0
call fcn.004042d0
mov edi, dword [ebp - 0x1c]
add esp, 8
sub edi, dword [ebp - 0x20]
sar edi, 2
mov byte [ebp - 4], 2
call fcn.00402970
mov ecx, eax
test ecx, ecx
je 0x404741
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
xor esi, esi
mov byte [ebp - 4], 3
or ebx, 0xffffffff
test edi, edi
je 0x4046d9
mov eax, dword [ebp - 0x20]
lea edx, [eax + esi*4]
mov eax, dword [edx]
mov ecx, dword [eax - 0xc]
test esi, esi
jne 0x4046a9
cmp ecx, 1
jl 0x404750
cmp word [eax + 2], 0x3a
jne 0x4046d6
push 0x505a64
lea ecx, [ebp - 0x14]
call fcn.00405760
add esp, 4
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x10]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.004068d0
mov byte [ebp - 4], 3
mov eax, ebx
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4046cd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4046cd
push ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.004068d0
push 0
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 1
push 0x505a64
lea ecx, [ebp - 0x10]
call fcn.004068d0
inc esi
cmp esi, edi
jb 0x404648
mov eax, dword [ebp - 0x10]
lea edx, [eax - 0x10]
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x4046ee
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x404730
mov edx, dword [ebp - 0x1c]
push ecx
call fcn.00406a60
mov ecx, dword [ebp - 0x18]
add esp, 4
mov edx, dword [ebp - 0x20]
sub ecx, edx
and ecx, 0xfffffffc
mov eax, edx
cmp ecx, 0x1000
jb 0x404726
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40474b
push ecx
push edx
call fcn.004b04f5
add esp, 8
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004027e0
call fcn.004b7be0
push 0x80070057
call fcn.004027e0
int3
Function at 0x4049d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4de2d6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x114
push esi
mov esi, ecx
mov ecx, 0x518caa
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x10], 0
call fcn.004dd464
mov dword [ebp - 4], 1
call fcn.00402970
mov ecx, eax
test ecx, ecx
je 0x404b58
mov eax, dword [ecx]
push ebx
push edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
push 0x104
lea eax, [ebp - 0x120]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x10], 1
call fcn.004b3b60
add esp, 0xc
lea eax, [ebp - 0x120]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x120]
push 0
push 0
push 0xffffffffffffffff
push eax
push 0
push 3
call ebx
lea edi, [eax - 1]
test edi, edi
jle 0x404ac2
mov ecx, dword [esi]
mov edx, 1
mov eax, dword [ecx - 8]
sub edx, dword [ecx - 4]
sub eax, edi
or eax, edx
jge 0x404a98
push edi
mov ecx, esi
call fcn.00406860
push edi
push dword [esi]
lea eax, [ebp - 0x120]
push 0xffffffffffffffff
push eax
push 0
push 3
call ebx
mov eax, dword [esi]
cmp edi, dword [eax - 8]
jg 0x404b62
mov dword [eax - 0xc], edi
xor ecx, ecx
mov eax, dword [esi]
mov word [eax + edi*2], cx
jmp 0x404ac9
mov ecx, esi
call fcn.004064d0
push 2
lea eax, [ebp - 0x18]
mov ecx, esi
push eax
call fcn.00405a70
mov dword [ebp - 4], 2
or ebx, 0xffffffff
mov edx, dword [eax]
mov edi, dword [esi]
sub edi, 0x10
lea ecx, [edx - 0x10]
cmp ecx, edi
je 0x404b2d
cmp dword [edi + 0xc], 0
jl 0x404b22
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x404b22
call fcn.00406660
mov dword [ebp - 0x14], eax
lea edx, [edi + 0xc]
mov ecx, ebx
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x404b1b
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x14]
add eax, 0x10
mov dword [esi], eax
jmp 0x404b2d
push dword [edx - 0xc]
mov ecx, esi
push edx
call fcn.00406740
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ebx
dec ebx
pop edi
test ebx, ebx
pop ebx
jg 0x404b47
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004027e0
push 0x80070057
call fcn.004027e0
int3
Function at 0x408aa0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
push ebx
mov ebx, ecx
mov ecx, 0x518caa
push esi
call fcn.004dd464
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318
push reloc.WS2_32.dll_bind
mov dword [ebp - 8], 0
mov dword [ebp - 0x1c], 0xffffffff
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x408c3e
push edi
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov ecx, dword [ebp - 8]
test eax, eax
mov edx, 0x64
cmovne ecx, edx
xor edi, edi
mov dword [ebp - 8], ecx
test ecx, ecx
je 0x408c3d
push 0x104
lea eax, [ebp - 0x224]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.004b3b60
push 0x104
lea eax, [ebp - 0x120]
mov dword [ebp - 0x14], 0
push 0
push eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x10], 0x104
call fcn.004b3b60
push edi
push str._04u
lea eax, [ebp - 0x120]
push 0x104
push eax
call fcn.004096a0
add esp, 0x28
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x408c19
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push str.NetCfgInstanceId
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x408c14
cmp dword [ebx + 0x14], 0x10
mov eax, ebx
jb 0x408bd9
mov eax, dword [ebx]
lea ecx, [ebp - 0x224]
push ecx
push eax
call fcn.004bd6a3
add esp, 8
test eax, eax
jne 0x408c14
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 4
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push str.Characteristics
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x408c32
push dword [ebp - 4]
call esi
inc edi
cmp edi, dword [ebp - 8]
jb 0x408b31
pop edi
push dword [ebp - 0xc]
call esi
mov eax, dword [ebp - 0x1c]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x18]
push dword [ebp - 4]
mov dword [ebp - 0x1c], eax
call esi
pop edi
push dword [ebp - 0xc]
call esi
mov eax, dword [ebp - 0x1c]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a800
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4de778
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x2c
push esi
mov esi, ecx
mov ecx, 0x518caa
mov dword [ebp - 4], 0
call fcn.004dd464
lea eax, [ebx + 8]
push eax
lea ecx, [ebp - 0x38]
call fcn.00405510
mov dword [ebp - 0x20], esi
push 0x1c
mov byte [ebp - 4], 1
call fcn.004b052b
movups xmm0, xmmword [ebp - 0x38]
add esp, 4
mov byte [ebp - 0x38], 0
mov dword [ebp - 0x14], eax
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x28]
movq qword [eax + 0x10], xmm0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0xf
mov dword [eax + 0x18], esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
push ecx
push 0
push eax
push 0x40c510
push 0
push 0
call fcn.004bd8d8
add esp, 0x18
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x40a902
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 4
call fcn.00409b50
cmp dword [ebp - 0x18], 0
jne 0x40a910
mov ecx, dword [ebx + 0x1c]
cmp ecx, 0x10
jb 0x40a8ee
mov edx, dword [ebx + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40a8e4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a915
push ecx
push edx
call fcn.004b04f5
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x18
push 6
mov dword [ebp - 0x18], 0
call fcn.004b1cef
call fcn.004bd969
call fcn.004b7be0
int3
Function at 0x40adc0
Capabilities:
Check if file exists
Create thread

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4de800
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x140
push esi
push edi
mov esi, ecx
mov ecx, 0x518caa
mov dword [ebp - 4], 0
call fcn.004dd464
push 0x108
lea eax, [ebp - 0x14c]
push 0
push eax
call fcn.004b3b60
mov eax, dword [esi + 4]
add esp, 0xc
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
mov eax, dword [eax]
push 0
push 0
mov dword [ebp - 0x150], eax
lea eax, [ebp - 0x150]
push eax
push 0x40a970
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
xorps xmm0, xmm0
mov dword [ebp - 0x30], eax
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
mov byte [ebp - 4], 1
call fcn.00403b50
lea ecx, [ebp - 0x2c]
push 0x40
cmp eax, 0x40
jne 0x40aead
call fcn.00402700
movups xmm0, xmmword [str.http:__dw.gptchrome.net_bropkg_GInstallerx64_153.exe]
mov ecx, eax
movups xmmword [ecx], xmm0
movups xmm0, xmmword [0x505e0c]
movups xmmword [ecx + 0x10], xmm0
movups xmm0, xmmword [0x505e1c]
movups xmmword [ecx + 0x20], xmm0
mov eax, dword [0x505e2c]
jmp 0x40aed9
call fcn.00402700
movups xmm0, xmmword [str.http:__dw.gptchrome.net_bropkg_GInstallerx86_153.exe]
mov ecx, eax
movups xmmword [ecx], xmm0
movups xmm0, xmmword [0x505e44]
movups xmmword [ecx + 0x10], xmm0
movups xmm0, xmmword [0x505e54]
movups xmmword [ecx + 0x20], xmm0
mov eax, dword [0x505e64]
mov dword [ecx + 0x30], eax
xor edi, edi
mov dword [ebp - 0x2c], ecx
mov byte [ecx + 0x34], 0
mov dword [ebp - 0x18], 0x3f
mov dword [ebp - 0x1c], 0x34
push ecx
mov ecx, dword [ebx + 8]
mov esi, esp
mov dword [ebp - 0x38], esp
mov dword [ebp - 0x34], esi
lea ecx, [ecx - 0x10]
call fcn.00406660
add eax, 0x10
mov dword [esi], eax
sub esp, 0x18
mov byte [ebp - 4], 2
lea eax, [ebp - 0x2c]
mov ecx, esp
push eax
call fcn.00405510
xor edx, edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x148]
call fcn.00408210
add esp, 0x1c
test al, al
jne 0x40af47
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 5
jl 0x40aef3
push 0xffffffffffffffff
push dword [ebp - 0x30]
mov dword [ebp - 0x44], 1
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebx + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp - 0x18]
test eax, eax
setne byte [ebp - 0x11]
cmp ecx, 0x10
jb 0x40af98
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40af8e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40afcb
push ecx
push edx
call fcn.004b04f5
add esp, 8
mov esi, dword [ebx + 8]
or eax, 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40afb3
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp - 0x11]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
call fcn.004b7be0
int3
Function at 0x40c2c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4de965
push eax
mov dword fs:[0], esp
sub esp, 0x24c
push esi
mov esi, ecx
mov ecx, 0x518caa
call fcn.004dd464
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x40c41f
push 0x208
push eax
lea eax, [ebp - 0x258]
push eax
call fcn.004b3b60
add esp, 0xc
lea eax, [ebp - 0x258]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x38
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x50], 0x3c
push 0
push eax
call fcn.004b3b60
lea eax, [ebp - 0x258]
mov dword [ebp - 0x44], str.runas
add esp, 0xc
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x34], 1
mov dword [ebp - 4], 0
call fcn.00402970
mov ecx, eax
test ecx, ecx
je 0x40c459
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 1
mov edx, 8
mov cl, byte [esi]
mov eax, 0x13
test cl, cl
lea ecx, [ebp - 0x14]
cmove eax, edx
mov edx, str._upprivi__can_ins_d
push eax
mov eax, str._upprivi
cmovne eax, edx
push eax
call fcn.00406740
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 0x3c], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x40c430
push str.GPT_Chrome
lea ecx, [ebp - 0x10]
call fcn.004062e0
push 0x11
push 0x506078
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.004068d0
push 4
push str.GPT_Chrome
push dword [ebp - 0x10]
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x40c463
mov edx, dword [ebp - 0x10]
push edi
or edi, 0xffffffff
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40c409
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
pop edi
jg 0x40c41f
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov al, 1
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40c448
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
xor al, al
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004027e0
push 0
call fcn.004beb0b
int3
Function at 0x40e890
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4de4e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov ebx, ecx
mov ecx, 0x518760
push edi
mov dword [ebp - 0x10], ebx
call fcn.004dd464
push 8
mov dword [ebx], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004b052b
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.004b20e6
mov dword [esi + 4], eax
add esp, 8
mov eax, ebx
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov ecx, dword [ebp - 0xc]
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
pop edi
pop esi
mov dword [edx], 0
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x414da0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x48
push esi
mov esi, ecx
mov ecx, 0x518caa
push edi
call fcn.004dd464
mov edi, dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x10], 0
push eax
lea eax, [esp + 0x1c]
mov word [esp + 0x14], 0x3a43
push eax
lea eax, [esp + 0x1c]
mov byte [esp + 0x1a], 0x5c
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x24], 0
push eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
call edi
mov eax, dword [esp + 0x10]
imul eax, dword [esp + 0x14]
mul dword [esp + 0x18]
cmp byte [esi + 0x770], 0
mov dword [esi + 0x790], eax
mov dword [esi + 0x794], edx
je 0x414f2c
lea eax, [esp + 0x1c]
mov dword [esp + 0xc], 0
push eax
lea eax, [esp + 0x14]
mov word [esp + 0x10], 0x3a44
push eax
lea eax, [esp + 0x1c]
mov byte [esp + 0x16], 0x5c
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x20], 0
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0
push eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x30], 0
call edi
mov eax, dword [esp + 0x18]
imul eax, dword [esp + 0x14]
push 6
push 0
mov dword [esp + 0x14], 0
mul dword [esp + 0x18]
mov dword [esi + 0x798], eax
mov dword [esi + 0x79c], edx
call dword [sym.imp.ole32.dll_CoInitializeEx]
lea eax, [esp + 0xc]
push eax
push 0x505bf4
push 0
push 0x506a80
call dword [sym.imp.SHELL32.dll_SHCreateItemFromParsingName]
test eax, eax
js 0x414f1e
lea eax, [esp + 0x3c]
push eax
push str.System.Volume.BitLockerProtection
call dword [sym.imp.PROPSYS.dll_PSGetPropertyKeyFromName]
test eax, eax
js 0x414f1e
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x20]
push edx
xorps xmm0, xmm0
lea edx, [esp + 0x40]
movaps xmmword [esp + 0x24], xmm0
mov eax, dword [ecx]
push edx
push ecx
call dword [eax + 0x34]
test eax, eax
js 0x414f1e
mov eax, dword [esp + 0xc]
mov edi, dword [esp + 0x28]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
cmp edi, 1
je 0x414f2c
cmp edi, 3
je 0x414f2c
cmp edi, 5
je 0x414f2c
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x414f2c
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
pop edi
mov dword [esi + 0x79c], 0
mov dword [esi + 0x798], 0
pop esi
mov esp, ebp
pop ebp
ret