joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42d816
Capabilities:
Connect to http server

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
xor ebx, ebx
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
mov dword [ebp - 4], ebx
rep stosd dword es:[edi], eax
xor esi, esi
mov dword [ebp - 8], esi
cmp dword [ebp - 4], esi
je 0x42d846
push dword [ebp - 4]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [ebp - 4], esi
cmp ebx, esi
je 0x42d853
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
xor ebx, ebx
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp + 0x14]
push dword [eax]
call fcn.00436d38
mov esi, eax
xor edx, edx
cmp esi, edx
jl 0x42d982
mov edi, dword [ebp + 0x24]
cmp edi, edx
je 0x42d87b
mov ecx, edi
cmp word [edi], dx
jne 0x42d87e
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp + 0x20]
cmp esi, edx
je 0x42d88c
mov eax, esi
cmp word [esi], dx
jne 0x42d88f
mov eax, dword [ebp - 0x18]
push edx
push edx
xor edx, edx
cmp dword [ebp - 0x24], 1
setne dl
lea edx, [edx + edx + 1]
push edx
push ecx
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp + 0x10]
call dword [sym.imp.WININET.dll_InternetConnectW]
mov ebx, eax
test ebx, ebx
je 0x42d991
test esi, esi
je 0x42d8f6
cmp word [esi], 0
je 0x42d8f6
test edi, edi
je 0x42d8f6
cmp word [edi], 0
je 0x42d8f6
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
call edi
push eax
push esi
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionW]
push 0x2b
push ebx
call esi
test eax, eax
je 0x42d8f6
push dword [ebp + 0x24]
call edi
push eax
push dword [ebp + 0x24]
push 0x2c
push ebx
call esi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x1c]
mov eax, dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x24]
push dword [ebp + 0x18]
push ebx
call fcn.0042d138
mov esi, eax
test esi, esi
js 0x42d9cc
push dword [ebp + 0x30]
mov edi, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0042d656
mov esi, eax
test esi, esi
js 0x42d9d8
cmp dword [ebp - 8], 0
jne 0x42d830
mov eax, dword [ebp + 0x28]
mov dword [eax], ebx
mov eax, dword [ebp + 0x2c]
xor ebx, ebx
and dword [ebp - 4], ebx
mov ecx, edi
mov dword [eax], ecx
lea eax, [ebp - 0x24]
push eax
call fcn.00436b02
cmp dword [ebp - 4], 0
je 0x42d96e
push dword [ebp - 4]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
test ebx, ebx
je 0x42d979
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x2c
push 0x44be3c
push esi
call fcn.004314ba
pop ecx
pop ecx
jmp 0x42d956
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x42d9a5
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
js 0x42d9b0
mov esi, 0x80004005
push esi
push 0x213
push 0x44bbe8
call fcn.004314ce
mov eax, dword [ebp + 0x14]
push dword [eax]
push 0x44be1e
jmp 0x42d9e2
mov eax, dword [ebp + 0x14]
push dword [eax]
push 0x44bdfc
jmp 0x42d9e2
mov eax, dword [ebp + 0x14]
push dword [eax]
push 0x44bdd8
push esi
call fcn.004314ba
add esp, 0xc
jmp 0x42d956
Function at 0x42dd26
Capabilities:
Create http request
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
or dword [ebp - 0x10], 0xffffffff
push ebx
push esi
push edi
xor ebx, ebx
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp + 0x18]
push ebx
push dword [edi]
lea eax, [ebp - 8]
push eax
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
call fcn.0042fa38
mov esi, eax
cmp esi, ebx
jge 0x42dd7d
push 0x44bffe
push esi
call fcn.004314ba
pop ecx
pop ecx
jmp 0x42ded7
push ebx
push ebx
push ebx
push ebx
push 0x44bff4
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [ebp - 4], eax
cmp eax, ebx
jne 0x42ddc9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x42dda7
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, ebx
jl 0x42ddb2
mov esi, 0x80004005
push esi
push 0x93
push 0x44bbe8
call fcn.004314ce
push 0x44bfd4
jmp 0x42dd70
lea eax, [ebp - 0xc]
push eax
push 0x78
push 0x44bfb4
push 0x40312c
call fcn.00436d9a
mov eax, dword [ebp - 0xc]
cmp eax, ebx
jbe 0x42de1b
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionW]
imul eax, eax, 0x3e8
push 4
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 2
push dword [ebp - 4]
call esi
push 4
lea eax, [ebp - 0xc]
push eax
push 6
push dword [ebp - 4]
call esi
push 4
lea eax, [ebp - 0xc]
push eax
push 5
push dword [ebp - 4]
call esi
lea eax, [ebp - 0x2c]
push eax
push dword [edi + 8]
lea eax, [ebp - 8]
push dword [edi + 4]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x24]
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.0042d9f0
mov esi, eax
cmp esi, ebx
jge 0x42de56
push dword [ebp - 8]
push 0x44bf8a
push esi
call fcn.004314ba
add esp, 0xc
jmp 0x42ded7
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0x24]
lea esi, [ebp - 0x1c]
call fcn.0042d364
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push dword [ebp - 0x10]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x24]
push dword [edi + 8]
push dword [edi + 4]
push eax
push dword [ebp - 4]
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.0042dab0
mov esi, eax
cmp esi, ebx
jge 0x42deb5
push dword [ebp - 8]
push 0x44bf6e
push esi
call fcn.004314ba
add esp, 0xc
jmp 0x42dec8
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x42dec8
cmp word [eax], bx
je 0x42dec8
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x10], 0xffffffff
je 0x42ded7
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x14], ebx
je 0x42dee4
push dword [ebp - 0x14]
call fcn.0042ead8
cmp dword [ebp - 4], ebx
je 0x42def2
push dword [ebp - 4]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
cmp dword [ebp - 8], ebx
je 0x42deff
push dword [ebp - 8]
call fcn.0042ead8
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x20
Function at 0x42e832
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
push 0x44
pop esi
xor ebx, ebx
push esi
lea eax, [ebp - 0x58]
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.00408720
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
add esp, 0xc
cmp eax, ebx
jne 0x42e868
mov eax, 0x43b65e
push eax
push dword [ebp + 8]
lea eax, [ebp - 4]
push 0x43f1c4
push eax
call fcn.0042ff9c
mov edi, eax
add esp, 0x10
cmp edi, ebx
jl 0x42e8e8
mov ax, word [ebp + 0x10]
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 4]
mov dword [ebp - 0x58], esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x42e8dd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x42e8c0
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jl 0x42e8cb
mov edi, 0x80004005
push edi
push 0xa6
push 0x44c47e
call fcn.004314ce
jmp 0x42e8e8
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov dword [ebp - 0x14], ebx
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x10], ebx
je 0x42e8fb
push dword [ebp - 0x10]
call esi
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x14], ebx
je 0x42e908
push dword [ebp - 0x14]
call esi
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 4], ebx
je 0x42e915
push dword [ebp - 4]
call fcn.0042ead8
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x4306ae
Capabilities:
Create directory
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
cmp eax, ebx
je 0x430773
cmp word [eax], bx
je 0x430773
push ebx
push eax
lea eax, [ebp - 4]
push eax
call fcn.0042fa38
mov esi, eax
cmp esi, ebx
jl 0x4307f6
lea eax, [ebp - 4]
push eax
call fcn.00430656
mov esi, eax
cmp esi, ebx
jl 0x4307f6
mov ebx, dword [ebp + 0x14]
xor edi, edi
inc edi
cmp dword [ebp + 0x10], edi
jb 0x4307ea
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
call fcn.0042ff9c
mov esi, eax
add esp, 0xc
test esi, esi
js 0x4307f6
push dword [ebp - 8]
push dword [ebp - 4]
push 0x44c592
push ebx
call fcn.0042ff9c
mov esi, eax
add esp, 0x10
test esi, esi
js 0x4307f6
xor esi, esi
push esi
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4307ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4307cb
inc edi
mov esi, 0x800700b7
cmp edi, dword [ebp + 0x10]
jbe 0x43070b
jmp 0x4307f6
mov edi, 0x104
push edi
lea eax, [ebp - 4]
push eax
call fcn.0042e9c4
mov esi, eax
cmp esi, ebx
jl 0x4307f6
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x4306fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x4307ae
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, ebx
jl 0x4307b9
mov esi, 0x80004005
push esi
push 0x2cf
push 0x44c55e
call fcn.004314ce
jmp 0x4307f6
cmp eax, 3
jne 0x4307da
push esi
push dword [ebx]
call fcn.0043575a
jmp 0x4307e8
cmp eax, esi
jle 0x4307e8
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
js 0x4307f6
push ebx
call fcn.00430656
mov esi, eax
cmp dword [ebp - 8], 0
je 0x430804
push dword [ebp - 8]
call fcn.0042ead8
cmp dword [ebp - 4], 0
je 0x430812
push dword [ebp - 4]
call fcn.0042ead8
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x10

Function at 0x43081c
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push esi
mov esi, dword [esp + 0xc]
push 0x104
push esi
call fcn.0042e9c4
test eax, eax
js 0x43084e
push dword [esi]
push 0
push 0
push dword [esp + 0x14]
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x43084e
push esi
call fcn.00430656
pop esi
ret 8
Function at 0x430bb0
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push edi
xor ebx, ebx
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp dword [0x44fc58], 0xffffffff
mov dword [ebp + 8], eax
jne 0x430bec
push ebx
push edi
push 0x450b74
call fcn.0042fc9a
mov ebx, eax
test ebx, ebx
js 0x430c44
xor ebx, ebx
jmp 0x430c44
test eax, eax
je 0x430c44
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
sub eax, esi
push eax
lea eax, [esi + edi]
push eax
push dword [0x44fc58]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x430c2a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x430c24
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
js 0x430c34
add esi, dword [ebp - 4]
cmp esi, dword [ebp + 8]
jb 0x430bf0
jmp 0x430c44
push ebx
push 0x30d
push 0x44c5f0
call fcn.004314ce
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4

Function at 0x431192
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
lea ebp, [esp - 0x3a4]
sub esp, 0x424
mov eax, dword [0x44f9f8]
xor eax, ebp
mov dword [ebp + 0x3a0], eax
push ebx
push esi
push edi
mov edi, dword [0x44fc60]
mov eax, 0x104
push eax
mov dword [ebp - 0x80], eax
xor ebx, ebx
lea eax, [ebp + 0x198]
push eax
push ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x74], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, 0x208
test eax, eax
jne 0x4311f4
push esi
lea eax, [ebp + 0x198]
push ebx
push eax
call fcn.00408720
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x198]
push eax
call fcn.0043507e
test eax, eax
jns 0x431212
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x7c], ebx
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x43122d
lea eax, [ebp - 0x70]
mov byte [eax], bl
inc eax
dec esi
jne 0x431227
push ebx
lea eax, [ebp - 0x74]
push eax
call fcn.00436ed6
push dword [ebp - 0x74]
xor esi, esi
push 0x44c72c
inc esi
push esi
call fcn.0043110a
mov eax, dword [ebp - 0x7c]
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
mov eax, dword [ebp - 0x78]
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
lea eax, [ebp + 0x198]
push eax
push 0x44c70e
push esi
call fcn.0043110a
lea eax, [ebp - 0x70]
push eax
push 0x44c6fe
push esi
call fcn.0043110a
mov eax, dword [0x44fc5c]
add esp, 0x34
sub eax, ebx
je 0x4312ac
dec eax
je 0x4312a4
dec eax
je 0x43129c
dec eax
jne 0x4312b2
mov edi, dword [0x44fc6c]
jmp 0x4312b2
mov edi, dword [0x44fc68]
jmp 0x4312b2
mov edi, dword [0x44fc64]
jmp 0x4312b2
mov edi, dword [0x44fc70]
push edi
push 0x44c6e2
push esi
call fcn.0043110a
add esp, 0xc
cmp dword [ebp - 0x74], ebx
pop edi
pop esi
pop ebx
je 0x4312d1
push dword [ebp - 0x74]
call fcn.0042ead8
mov ecx, dword [ebp + 0x3a0]
xor ecx, ebp
xor eax, eax
call fcn.00408498
add ebp, 0x3a4
leave
ret
Function at 0x4315b2
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x44f9f8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00408720
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x43164a
push 0x5c
pop ecx
cmp cx, word [ebp + eax*2 - 0x20e]
je 0x431621
push 1
push 0x44c59c
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.00431564
mov edi, eax
test edi, edi
js 0x431669
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00431524
mov edi, eax
test edi, edi
js 0x431669
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebx], eax
test eax, eax
jne 0x431669
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x43165e
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test edi, edi
js 0x431669
mov edi, 0x80004005
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408498
leave
ret 8
Function at 0x43421a
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor ebx, ebx
push edi
push 0x44c9d8
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
cmp edi, ebx
jne 0x434294
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x434257
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jl 0x434262
mov edi, 0x80004005
push edi
push 0x8d
push 0x44c988
call fcn.004314ce
mov eax, dword [ebp - 8]
test eax, eax
je 0x43427f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 4]
test eax, eax
je 0x43428c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, edi
pop edi
pop ebx
leave
ret 0xc
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x44c4c4
push edi
call esi
test eax, eax
je 0x4342e6
push 0x44c4d4
push edi
call esi
push 0x44c9ba
push edi
mov ebx, eax
call esi
push 0x44c4f4
push edi
mov dword [ebp - 0xc], eax
call esi
mov dword [ebp - 0x14], eax
test ebx, ebx
je 0x4342d5
cmp dword [ebp - 0xc], 0
je 0x4342d5
test eax, eax
jne 0x4342d9
xor ebx, ebx
jmp 0x4342e6
lea eax, [ebp - 0x10]
push eax
call ebx
push 1
call dword [ebp - 0xc]
mov ebx, eax
lea eax, [ebp - 4]
push eax
push 0x4026d0
push 1
push 0
mov esi, 0x450c2c
push esi
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test edi, edi
js 0x434382
push 0x10
push 0x4026c0
push esi
call fcn.00409228
add esp, 0xc
test eax, eax
je 0x43432d
push 0x10
push 0x4026b0
push esi
call fcn.00409228
add esp, 0xc
test eax, eax
jne 0x434337
mov dword [0x450c48], 1
cmp dword [ebp + 8], 0
je 0x434366
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.00433f94
mov edi, eax
test edi, edi
js 0x434382
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push 0
push dword [ebp - 8]
push eax
call dword [ecx + 0x54]
mov edi, eax
test edi, edi
js 0x434382
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
and dword [ebp - 4], 0
mov dword [ecx], eax
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x434382
mov ecx, dword [ebp - 8]
and dword [ebp - 8], 0
mov dword [eax], ecx
pop esi
test ebx, ebx
je 0x434272
push dword [ebp - 0x10]
call dword [ebp - 0x14]
test eax, eax
jne 0x434272
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x434898
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x120
mov eax, dword [0x44f9f8]
xor eax, ebp
mov dword [ebp + 0x6c], eax
push ebx
mov ebx, dword [ebp + 0x7c]
push edi
mov edi, dword [ebp + 0x78]
push 0x11c
lea eax, [ebp - 0xb0]
push 0
push eax
call fcn.00408720
add esp, 0xc
cmp dword [0x450c50], 0
jne 0x4349a9
lea eax, [ebp - 0xb0]
push eax
mov dword [ebp - 0xb0], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
movzx eax, word [ebp + 0x64]
movzx ecx, word [ebp + 0x66]
shl eax, 0x10
or eax, ecx
cmp dword [ebp - 0xac], 4
mov dword [0x450c54], eax
jne 0x43491b
mov dword [0x450c50], 1
jmp 0x4349a9
cmp dword [ebp - 0xac], 5
jne 0x434968
cmp dword [ebp - 0xa8], 0
jne 0x434939
mov dword [0x450c50], 2
jmp 0x4349a9
cmp dword [ebp - 0xa8], 1
jne 0x43494e
mov dword [0x450c50], 3
jmp 0x4349a9
xor eax, eax
cmp dword [ebp - 0xa8], 2
setne al
dec eax
and eax, 0xfffffffb
add eax, 9
mov dword [0x450c50], eax
jmp 0x4349a9
cmp dword [ebp - 0xac], 6
jne 0x43499f
cmp dword [ebp - 0xa8], 0
jne 0x434988
xor eax, eax
cmp byte [ebp + 0x6a], 1
setne al
add eax, 5
jmp 0x434961
cmp dword [ebp - 0xa8], 1
jne 0x43499f
xor eax, eax
cmp byte [ebp + 0x6a], 1
setne al
add eax, 7
jmp 0x434961
mov dword [0x450c50], 9
mov eax, dword [0x450c50]
mov ecx, dword [ebp + 0x6c]
mov dword [edi], eax
mov eax, dword [0x450c54]
pop edi
mov dword [ebx], eax
xor ecx, ebp
pop ebx
call fcn.00408498
add ebp, 0x70
leave
ret 8

Function at 0x434a4a
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x44f9f8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ebx
mov word [ebp - 8], 0x500
mov dword [ebp - 0x10], ebx
call fcn.004349ca
cmp dword [ebp - 0x14], ebx
je 0x434a88
mov dword [esi], 1
jmp 0x434abc
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [esi], eax
cmp eax, ebx
je 0x434abc
push esi
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x434abc
mov dword [esi], ebx
cmp dword [ebp - 0x10], ebx
pop esi
pop ebx
je 0x434acb
push dword [ebp - 0x10]
call fcn.0043649e
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.00408498
leave
ret 4
Function at 0x434b8c
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
and dword [ebp - 4], edi
xor esi, esi
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0x10]
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x434bd4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x434bce
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test edi, edi
js 0x434bde
add esi, dword [ebp - 4]
cmp esi, dword [ebp + 0x10]
jb 0x434b9b
jmp 0x434bee
push edi
push 0x34c
push 0x44ca86
call fcn.004314ce
mov eax, edi
pop edi
pop esi
leave
ret 0xc

Function at 0x434bf6
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
lea ebp, [esp - 0xf98]
mov eax, 0x1018
call fcn.0040b8c0
mov eax, dword [0x44f9f8]
xor eax, ebp
mov dword [ebp + 0xf94], eax
mov eax, dword [ebp + 0xfa0]
push ebx
mov ebx, dword [ebp + 0xfb0]
push esi
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 0xfa4]
xor esi, esi
push edi
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x70], esi
xor edi, edi
mov ecx, dword [ebp + 0xfa8]
xor edx, edx
cmp ecx, edx
jne 0x434c56
cmp dword [ebp + 0xfac], edx
jne 0x434c56
mov dword [ebp - 0x74], 0x1000
jmp 0x434c7e
mov eax, dword [ebp + 0xfac]
sub ecx, edi
sbb eax, esi
cmp eax, edx
jb 0x434c78
ja 0x434c6e
cmp ecx, 0x1000
jbe 0x434c78
mov ecx, 0x1000
mov dword [ebp - 0x74], edx
jmp 0x434c7b
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x74], ecx
push edx
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x74]
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x434cfb
cmp dword [ebp - 0x74], 0
je 0x434cb3
push dword [ebp - 0x74]
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x80]
call fcn.00434b8c
mov dword [ebp - 0x70], eax
test eax, eax
js 0x434cde
add edi, dword [ebp - 0x74]
adc esi, 0
cmp esi, dword [ebp + 0xfac]
ja 0x434cd5
jb 0x434ccb
cmp edi, dword [ebp + 0xfa8]
jae 0x434cd5
cmp dword [ebp - 0x74], 0
jne 0x434c39
test ebx, ebx
je 0x434cde
mov dword [ebx], edi
mov dword [ebx + 4], esi
mov ecx, dword [ebp + 0xf94]
mov eax, dword [ebp - 0x70]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408498
add ebp, 0xf98
leave
ret 0x14
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x434d0f
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x70], eax
test eax, eax
jl 0x434d1d
mov dword [ebp - 0x70], 0x80004005
push dword [ebp - 0x70]
push 0x36c
push 0x44ca86
call fcn.004314ce
jmp 0x434cde