joyce8/EMBER2024-capa huggingface dataset:
Function at 0xf055192
Capabilities:
Query environment variable

Disassembly:
push 0x2c
push 0xf06e2b8
call fcn.0f005d34
xor ebx, ebx
cmp dword [ebp + 8], ebx
jne 0xf0551b4
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0xf0552ae
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
push dword [ebp + 8]
lea eax, [ebp - 0x3c]
push eax
mov esi, dword [sym.imp.ntdll.dll_RtlInitString]
call esi
xor edi, edi
inc edi
push edi
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ntdll.dll_RtlOemStringToUnicodeString]
cmp eax, ebx
jge 0xf055219
cmp eax, 0x80000005
jne 0xf0551f6
push 0xce
jmp 0xf0551fe
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0xf072008
call fcn.0f009440
add esp, 0xc
jmp 0xf0551ad
push edi
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.ntdll.dll_RtlUnicodeStringToAnsiString]
cmp eax, ebx
jl 0xf055291
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
mov dword [ebp - 0x20], ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov dword [ebp - 0x1c], eax
cmp eax, ebx
je 0xf05529f
cmp eax, dword [ebp + 0x10]
ja 0xf05529f
push dword [ebp + 0xc]
lea eax, [ebp - 0x2c]
push eax
call esi
push edi
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ntdll.dll_RtlAnsiStringToUnicodeString]
cmp eax, ebx
jge 0xf05527e
cmp eax, 0x80000005
jne 0xf055291
push 0xce
jmp 0xf055299
push edi
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.ntdll.dll_RtlUnicodeStringToOemString]
cmp eax, ebx
jge 0xf05529f
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
call fcn.0f0552b8
mov eax, dword [ebp - 0x1c]
call fcn.0f005d79
ret 0xc
Function at 0xf0554e2
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x52c
mov eax, dword [0xf072008]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0xf0899cc], 0
mov eax, dword [ebp + 0x20]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov dword [ebp - 0x524], esi
mov dword [ebp - 0x51c], eax
jne 0xf05551d
call fcn.0f055498
mov eax, dword [0xf0899d0]
test eax, eax
je 0xf055537
push 0x104
lea ecx, [ebp - 0x518]
push ecx
push ebx
call eax
mov ebx, eax
mov edi, dword fs:[0x18]
push ebx
lea eax, [ebp - 0x52c]
push eax
add edi, 0xbf8
call dword [sym.imp.ntdll.dll_RtlInitString]
push 0
lea eax, [ebp - 0x52c]
push eax
push edi
call dword [sym.imp.ntdll.dll_RtlOemStringToUnicodeString]
test eax, eax
jge 0xf05558a
cmp eax, 0x80000005
jne 0xf055574
push 0xce
jmp 0xf05557c
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
jmp 0xf055681
mov eax, dword [ebp + 0xc]
mov ebx, 0x80000000
cmp eax, ebx
jne 0xf05559b
mov eax, 0x80000100
push dword [ebp - 0x51c]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push esi
push dword [ebp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
push dword [edi + 4]
call esi
mov dword [ebp - 0x520], eax
cmp eax, 0xffffffff
jne 0xf05567b
cmp dword [ebp + 0xc], ebx
jne 0xf0555f5
push dword [ebp - 0x51c]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp - 0x524]
push dword [ebp + 0x10]
push ebx
push dword [edi + 4]
call esi
mov dword [ebp - 0x520], eax
cmp eax, 0xffffffff
jne 0xf05567b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0xf05567b
mov eax, dword fs:[0x18]
cmp dword [eax + 0xbf4], 0xc00000ba
je 0xf05567b
push dword [edi + 4]
push 0
call sub.sfc.dll_SfcIsFileProtected
test eax, eax
je 0xf05567b
lea eax, [ebp - 0x414]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0xf05567b
lea eax, [ebp - 0x20c]
push eax
push 0
push 0xf004924
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0xf05567b
push dword [ebp - 0x51c]
lea eax, [ebp - 0x20c]
push dword [ebp + 0x1c]
push 4
push dword [ebp - 0x524]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call esi
mov dword [ebp - 0x520], eax
mov eax, dword [ebp - 0x520]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0f0057d5
leave
ret 0x1c
Function at 0xf055730
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0xf072008]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0xf0899cc], 0
push esi
push edi
mov edi, dword [ebp + 8]
jne 0xf055758
call fcn.0f055498
mov eax, dword [0xf0899d0]
test eax, eax
je 0xf055772
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push edi
call eax
mov edi, eax
mov esi, dword fs:[0x18]
push edi
lea eax, [ebp - 0x110]
push eax
add esi, 0xbf8
call dword [sym.imp.ntdll.dll_RtlInitString]
push 0
lea eax, [ebp - 0x110]
push eax
push esi
call dword [sym.imp.ntdll.dll_RtlOemStringToUnicodeString]
test eax, eax
jge 0xf0557c1
cmp eax, 0x80000005
jne 0xf0557af
push 0xce
jmp 0xf0557b7
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0xf0557ee
push dword [ebp + 0xc]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edi, eax
test edi, edi
jne 0xf0557ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0xf0557ec
push dword [esi + 4]
push edi
call sub.sfc.dll_SfcIsFileProtected
test eax, eax
je 0xf0557ec
inc edi
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0f0057d5
leave
ret 8

Function at 0xf055803
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0xf072008]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0xf0899cc], 0
push esi
push edi
mov edi, dword [ebp + 8]
jne 0xf05582b
call fcn.0f055498
mov eax, dword [0xf0899d0]
test eax, eax
je 0xf055845
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push edi
call eax
mov edi, eax
mov esi, dword fs:[0x18]
push edi
lea eax, [ebp - 0x110]
push eax
add esi, 0xbf8
call dword [sym.imp.ntdll.dll_RtlInitAnsiString]
push 0
lea eax, [ebp - 0x110]
push eax
push esi
call dword [sym.imp.ntdll.dll_RtlOemStringToUnicodeString]
test eax, eax
jge 0xf055895
cmp eax, 0x80000005
jne 0xf055882
push 0xce
jmp 0xf05588a
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
jmp 0xf05589e
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0f0057d5
leave
ret 4
Function at 0xf0558b3
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0xf072008]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0xf0899cc], 0
push esi
push edi
mov edi, dword [ebp + 8]
jne 0xf0558db
call fcn.0f055498
mov eax, dword [0xf0899d0]
test eax, eax
je 0xf0558f5
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push edi
call eax
mov edi, eax
mov esi, dword fs:[0x18]
push edi
lea eax, [ebp - 0x110]
push eax
add esi, 0xbf8
call dword [sym.imp.ntdll.dll_RtlInitString]
push 0
lea eax, [ebp - 0x110]
push eax
push esi
call dword [sym.imp.ntdll.dll_RtlOemStringToUnicodeString]
test eax, eax
jge 0xf055944
cmp eax, 0x80000005
jne 0xf055932
push 0xce
jmp 0xf05593a
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0xf05596e
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, eax
test edi, edi
jne 0xf05596c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0xf05596c
push dword [esi + 4]
push edi
call sub.sfc.dll_SfcIsFileProtected
test eax, eax
je 0xf05596c
inc edi
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0f0057d5
leave
ret 4
Function at 0xf055983
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0xf072008]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0xf0899cc], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x210], ebx
jne 0xf0559b5
call fcn.0f055498
mov eax, dword [0xf0899d0]
test eax, eax
je 0xf0559e5
mov esi, 0x104
push esi
lea ecx, [ebp - 0x20c]
push ecx
push edi
call eax
mov edi, eax
push esi
lea eax, [ebp - 0x108]
push eax
push ebx
call dword [0xf0899d0]
mov dword [ebp - 0x210], eax
mov esi, dword fs:[0x18]
push edi
mov edi, dword [sym.imp.ntdll.dll_RtlInitString]
lea eax, [ebp - 0x220]
push eax
add esi, 0xbf8
call edi
mov ebx, dword [sym.imp.ntdll.dll_RtlOemStringToUnicodeString]
push 0
lea eax, [ebp - 0x220]
push eax
push esi
call ebx
test eax, eax
jge 0xf055a3b
cmp eax, 0x80000005
jne 0xf055a26
push 0xce
jmp 0xf055a2e
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0xf055acd
cmp dword [ebp - 0x210], 0
je 0xf055a6b
push dword [ebp - 0x210]
lea eax, [ebp - 0x220]
push eax
call edi
push 1
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x218]
push eax
call ebx
test eax, eax
jge 0xf055a72
jmp 0xf055a26
and dword [ebp - 0x214], 0
push 2
push dword [ebp - 0x214]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jne 0xf055ab6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0xf055ab6
push dword [ebp - 0x214]
push ebx
call sub.sfc.dll_SfcIsFileProtected
test eax, eax
jne 0xf055ab3
push dword [esi + 4]
push ebx
call sub.sfc.dll_SfcIsFileProtected
test eax, eax
je 0xf055ab6
xor edi, edi
inc edi
cmp dword [ebp - 0x214], ebx
je 0xf055acb
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0f0057d5
leave
ret 8
Function at 0xf055ae3
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0xf072008]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0xf0899cc], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x210], ebx
jne 0xf055b15
call fcn.0f055498
mov eax, dword [0xf0899d0]
test eax, eax
je 0xf055b45
mov esi, 0x104
push esi
lea ecx, [ebp - 0x20c]
push ecx
push edi
call eax
mov edi, eax
push esi
lea eax, [ebp - 0x108]
push eax
push ebx
call dword [0xf0899d0]
mov dword [ebp - 0x210], eax
mov esi, dword fs:[0x18]
push edi
mov edi, dword [sym.imp.ntdll.dll_RtlInitString]
lea eax, [ebp - 0x220]
push eax
add esi, 0xbf8
call edi
mov ebx, dword [sym.imp.ntdll.dll_RtlOemStringToUnicodeString]
push 0
lea eax, [ebp - 0x220]
push eax
push esi
call ebx
test eax, eax
jge 0xf055b9b
cmp eax, 0x80000005
jne 0xf055b86
push 0xce
jmp 0xf055b8e
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0xf055c2e
cmp dword [ebp - 0x210], 0
je 0xf055bcb
push dword [ebp - 0x210]
lea eax, [ebp - 0x220]
push eax
call edi
push 1
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x218]
push eax
call ebx
test eax, eax
jge 0xf055bd2
jmp 0xf055b86
and dword [ebp - 0x214], 0
push dword [ebp + 0x10]
push dword [ebp - 0x214]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jne 0xf055c17
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0xf055c17
push dword [ebp - 0x214]
push ebx
call sub.sfc.dll_SfcIsFileProtected
test eax, eax
jne 0xf055c14
push dword [esi + 4]
push ebx
call sub.sfc.dll_SfcIsFileProtected
test eax, eax
je 0xf055c17
xor edi, edi
inc edi
cmp dword [ebp - 0x214], ebx
je 0xf055c2c
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0f0057d5
leave
ret 0xc

Function at 0xf0561e5
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0xf072008]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0xf0899cc], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
jne 0xf056211
call fcn.0f055498
mov eax, dword [0xf0899d0]
test eax, eax
je 0xf05622b
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push edi
call eax
mov edi, eax
mov esi, dword fs:[0x18]
push edi
lea eax, [ebp - 0x110]
push eax
add esi, 0xbf8
call dword [sym.imp.ntdll.dll_RtlInitString]
push 0
lea eax, [ebp - 0x110]
push eax
push esi
call dword [sym.imp.ntdll.dll_RtlOemStringToUnicodeString]
test eax, eax
jge 0xf05627a
cmp eax, 0x80000005
jne 0xf056268
push 0xce
jmp 0xf056270
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0xf056284
push ebx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0f0057d5
leave
ret 8
Function at 0xf05629a
Capabilities:
Delete directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0xf072008]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0xf0899cc], 0
push esi
push edi
mov edi, dword [ebp + 8]
jne 0xf0562c2
call fcn.0f055498
mov eax, dword [0xf0899d0]
test eax, eax
je 0xf0562dc
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push edi
call eax
mov edi, eax
mov esi, dword fs:[0x18]
push edi
lea eax, [ebp - 0x110]
push eax
add esi, 0xbf8
call dword [sym.imp.ntdll.dll_RtlInitString]
push 0
lea eax, [ebp - 0x110]
push eax
push esi
call dword [sym.imp.ntdll.dll_RtlOemStringToUnicodeString]
test eax, eax
jge 0xf05632b
cmp eax, 0x80000005
jne 0xf056319
push 0xce
jmp 0xf056321
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0xf056334
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0f0057d5
leave
ret 4

Function at 0xf056349
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push esi
mov esi, dword fs:[0x18]
add esi, 0xbf8
test eax, eax
jne 0xf05636a
mov eax, 0xf002f38
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntdll.dll_RtlInitString]
push 0
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.ntdll.dll_RtlOemStringToUnicodeString]
test eax, eax
jge 0xf0563a7
cmp eax, 0x80000005
jne 0xf056394
push 0xce
jmp 0xf05639c
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
inc eax
jmp 0xf0563b0
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
pop esi
leave
ret 4

Function at 0xf0563ba
Capabilities:
Get disk size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push esi
mov esi, dword fs:[0x18]
add esi, 0xbf8
test eax, eax
jne 0xf0563db
mov eax, 0xf002f38
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntdll.dll_RtlInitString]
push 0
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.ntdll.dll_RtlOemStringToUnicodeString]
test eax, eax
jge 0xf056417
cmp eax, 0x80000005
jne 0xf056405
push 0xce
jmp 0xf05640d
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0xf05642c
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
pop esi
leave
ret 0x14
Function at 0xf056436
Capabilities:
Get disk information

Disassembly:
push 0x40
push 0xf06e2f8
call fcn.0f005d34
mov edi, dword fs:[0x18]
add edi, 0xbf8
mov dword [ebp - 0x1c], edi
mov eax, dword [ebp + 8]
xor esi, esi
cmp eax, esi
jne 0xf056460
mov eax, 0xf002f38
push eax
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.ntdll.dll_RtlInitString]
push esi
lea eax, [ebp - 0x50]
push eax
push edi
call dword [sym.imp.ntdll.dll_RtlOemStringToUnicodeString]
cmp eax, esi
jge 0xf05649e
cmp eax, 0x80000005
jne 0xf056489
push 0xce
jmp 0xf056491
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0xf0565d5
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x34], esi
xor eax, eax
mov word [ebp - 0x2e], ax
mov word [ebp - 0x36], ax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x44], ecx
mov edi, dword [ebp + 0x10]
lea eax, [edi + 1]
mov word [ebp - 0x46], ax
mov edx, dword [ebp + 0x20]
mov dword [ebp - 0x3c], edx
mov ebx, dword [ebp + 0x24]
lea edx, [ebx + 1]
mov word [ebp - 0x3e], dx
mov dword [ebp - 4], esi
cmp ecx, esi
je 0xf05651d
movzx eax, ax
add eax, eax
mov word [ebp - 0x2e], ax
mov eax, dword fs:[0x18]
movzx ecx, word [ebp - 0x2e]
push ecx
push esi
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x2c], eax
cmp eax, esi
jne 0xf05651d
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0xf072008
call fcn.0f009440
add esp, 0xc
jmp 0xf056497
cmp dword [ebp + 0x20], esi
je 0xf05654b
movzx eax, word [ebp - 0x3e]
add eax, eax
mov word [ebp - 0x36], ax
mov eax, dword fs:[0x18]
movzx ecx, word [ebp - 0x36]
push ecx
push esi
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x34], eax
cmp eax, esi
je 0xf0564fd
push ebx
push dword [ebp - 0x34]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push edi
push dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov dword [ebp - 0x20], eax
cmp eax, esi
je 0xf0565c6
cmp dword [ebp + 0xc], esi
je 0xf0565a1
push dword [ebp - 0x2c]
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push esi
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.ntdll.dll_RtlUnicodeStringToOemString]
cmp eax, esi
jge 0xf0565a1
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
jmp 0xf0564ff
cmp dword [ebp + 0x20], esi
je 0xf0565c6
push dword [ebp - 0x34]
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push esi
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.ntdll.dll_RtlUnicodeStringToOemString]
cmp eax, esi
jl 0xf056594
mov dword [ebp - 4], 0xfffffffe
call fcn.0f0565df
mov eax, dword [ebp - 0x20]
call fcn.0f005d79
ret 0x20
Function at 0xf0566b0
Capabilities:
Get hostname
Get process heap force flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
sub esp, 0x10
push esi
mov esi, dword [ebp + 0xc]
mov ecx, dword [esi]
push edi
add ecx, ecx
push ecx
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
test edi, edi
jne 0xf0566ec
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
leave
ret 8
mov ax, word [esi]
mov word [ebp - 6], ax
xor eax, eax
mov word [ebp - 8], ax
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0xf056726
xor esi, esi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, esi
jmp 0xf0566e6
push edi
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntdll.dll_RtlUnicodeStringToOemString]
movzx eax, word [ebp - 8]
mov dword [esi], eax
xor esi, esi
inc esi
jmp 0xf05670d

Function at 0xf056ec0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0xf0b6878]
mov edx, dword [ebp + 8]
mov ecx, dword [0xf0899e8]
sub esp, 0x24
push esi
lea esi, [eax + edx - 1]
lea edx, [eax - 1]
not edx
and esi, edx
lea ecx, [eax + ecx - 1]
dec eax
not eax
and ecx, eax
lea eax, [ebp - 8]
push eax
push 0x1c
lea eax, [ebp - 0x24]
push eax
push 0
push ecx
push 0xffffffffffffffff
mov dword [ebp - 4], ecx
call dword [sym.imp.ntdll.dll_NtQueryVirtualMemory]
test eax, eax
jl 0xf056f4d
test dword [ebp - 0x14], 0x10000
mov eax, dword [ebp - 0x18]
je 0xf056f17
cmp esi, eax
jbe 0xf056f2b
mov ecx, dword [ebp - 0x24]
add ecx, eax
cmp ecx, dword [0xf0b6880]
jae 0xf056f4d
mov eax, dword [0xf0b6878]
jmp 0xf056ee2
push 0x40
push 0x2000
lea eax, [ebp + 8]
push eax
push 0
lea eax, [ebp - 4]
push eax
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
test eax, eax
jl 0xf056f4d
mov eax, dword [ebp - 4]
jmp 0xf056f4f
xor eax, eax
pop esi
leave
ret 4

Function at 0xf056f59
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 4], ebx
cmp dword [0xf0899e8], ebx
je 0xf056f84
cmp dword [0xf0899ec], ebx
je 0xf056f84
mov eax, dword [ebp + 0xc]
push dword [eax]
call fcn.0f056ec0
mov dword [ebp - 4], eax
mov esi, dword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
mov edi, 0x1000
jmp 0xf056f99
cmp dword [ebp - 4], ebx
je 0xf056fc9
mov dword [ebp - 4], ebx
push 0x40
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push ebx
push eax
push 0xffffffffffffffff
call esi
cmp eax, ebx
jl 0xf056f91
mov ecx, dword [ebp - 4]
cmp dword [0xf0899ec], ebx
je 0xf056fc4
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
add edx, ecx
mov dword [0xf0899e8], edx
mov edx, dword [ebp + 8]
mov dword [edx], ecx
pop edi
pop esi
pop ebx
leave
ret 8