joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431a60
Capabilities:
Get session user name
Get user security identifier

Disassembly:
sub esp, 0xe28
mov eax, dword [0x4832f0]
xor eax, esp
mov dword [esp + 0xe20], eax
push ebx
push ebp
push esi
xor ebx, ebx
push 0xbff
lea eax, [esp + 0x2d]
push ebx
push eax
mov byte [esp + 0x34], bl
call fcn.0044e9d0
add esp, 0xc
push 0xff
lea ecx, [esp + 0xc2d]
push ebx
push ecx
mov dword [esp + 0x24], 0xc00
mov byte [esp + 0xc34], bl
call fcn.0044e9d0
add esp, 0xc
push 0xff
lea edx, [esp + 0xd2d]
push ebx
push edx
mov byte [esp + 0xd34], bl
call fcn.0044e9d0
mov eax, 0x100
add esp, 0xc
push ebx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x14], ebx
call fcn.0040ace0
mov ebp, eax
add esp, 4
mov dword [esp + 0x14], ebp
cmp ebp, ebx
je 0x431b19
push ebp
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x431b19
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xe20]
xor ecx, esp
call fcn.0044b6ee
add esp, 0xe28
ret
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0xc2c]
push ecx
push 2
call sub.Secur32.dll_GetUserNameExA
movzx esi, al
cmp esi, ebx
je 0x431baf
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0xd30]
push ecx
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0xc3c]
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
mov esi, eax
cmp esi, ebx
je 0x431baf
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x2c]
xor edx, edx
push ecx
mov word [edi], dx
call sub.ADVAPI32.dll_ConvertSidToStringSidW
mov esi, eax
cmp esi, ebx
je 0x431baf
mov ebp, dword [esp + 0x10]
cmp ebp, ebx
je 0x431bab
mov edx, edi
mov eax, ebp
sub edx, ebp
lea ecx, [ecx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, bx
jne 0x431b90
push ebp
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esi, 1
mov ebp, dword [esp + 0x14]
cmp ebp, ebx
je 0x431bb9
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov ecx, dword [esp + 0xe2c]
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0044b6ee
add esp, 0xe28
ret
Function at 0x432940
Capabilities:
Query service status

Disassembly:
sub esp, 0x1c
push esi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x43295e
pop esi
add esp, 0x1c
ret
push edi
push 0x14
push str.360bprot
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x432982
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
xor eax, eax
pop esi
add esp, 0x1c
ret
lea eax, [esp + 8]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x4329a6
call edi
push esi
call edi
pop edi
xor eax, eax
pop esi
add esp, 0x1c
ret
cmp dword [esp + 0x10], 4
jne 0x432999
call edi
push esi
call edi
pop edi
mov eax, 1
pop esi
add esp, 0x1c
ret

Function at 0x432a30
Capabilities:
Create service
Start service

Disassembly:
push ebx
mov edx, dword [esp + 0xc]
push esi
push edi
mov ebx, dword [esp + 0x20]
xor edi, edi
push edi
push edi
push edi
push edi
push eax
mov eax, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x30]
push edi
push edx
mov edx, dword [esp + 0x30]
push eax
push 0xf01ff
push ecx
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov esi, eax
test esi, esi
jne 0x432a73
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x432a87
mov edi, 1
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x432aa0
Capabilities:
Delete service

Disassembly:
push ebx
push edi
push 0xf003f
push 0
push 0
mov ebx, 1
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x432abf
pop edi
pop ebx
ret
mov eax, dword [esp + 0xc]
push ebp
push esi
push 0x10000
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
je 0x432af2
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
call ebp
push edi
call ebp
pop esi
pop ebp
pop edi
mov eax, ebx
pop ebx
ret
push edi
xor ebx, ebx
call ebp
pop esi
pop ebp
pop edi
mov eax, ebx
pop ebx
ret
Function at 0x432b00
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
sub esp, 0x20c
mov eax, dword [0x4832f0]
xor eax, esp
mov dword [esp + 0x208], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0xa]
push ecx
mov word [esp + 0xc], ax
call fcn.0044e9d0
add esp, 0xc
call fcn.00406350
test eax, eax
je 0x432b51
mov eax, 1
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.0044b6ee
add esp, 0x20c
ret
push esi
push 0x470c24
call fcn.00432aa0
mov esi, eax
add esp, 4
test esi, esi
jne 0x432b7b
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.0044b6ee
add esp, 0x20c
ret
push 0x104
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, 0x104
lea eax, [esp + 4]
cmp word [eax], 0
je 0x432bba
add eax, 2
sub ecx, 1
jne 0x432b94
mov eax, esi
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.0044b6ee
add esp, 0x20c
ret
test ecx, ecx
je 0x432c00
mov eax, 0x104
sub eax, ecx
push 0x7fffffff
mov ecx, 0x104
push str.drivershookport.sys
sub ecx, eax
lea edx, [esp + eax*2 + 0xc]
call fcn.00402f40
test eax, eax
jl 0x432c00
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x432c00
push 4
push eax
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [esp + 0x20c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0044b6ee
add esp, 0x20c
ret

Function at 0x432c20
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x469048
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x4832f0]
xor eax, esp
mov dword [esp + 0x38], eax
push esi
mov eax, dword [0x4832f0]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
xor eax, eax
xor ecx, ecx
mov dword [esp + 0x3c], 7
mov dword [esp + 0x38], eax
mov word [esp + 0x28], cx
lea ecx, [esp + 0x24]
mov dword [esp + 0x4c], eax
call fcn.004090f0
test eax, eax
jne 0x432c8d
cmp dword [esp + 0x3c], 8
jb 0x432c89
mov edx, dword [esp + 0x28]
push edx
call fcn.0044b6e3
add esp, 4
xor eax, eax
jmp 0x432cf0
push str._nhplib.dat
lea ecx, [esp + 0x28]
lea esi, [esp + 0xc]
call fcn.00404d90
add esp, 4
cmp dword [eax + 0x18], 8
jb 0x432cad
mov eax, dword [eax + 4]
jmp 0x432cb0
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esp + 0x20], 8
jb 0x432ccb
mov eax, dword [esp + 0xc]
push eax
call fcn.0044b6e3
add esp, 4
push 0x470c38
call fcn.00432aa0
add esp, 4
cmp dword [esp + 0x3c], 8
mov esi, eax
jb 0x432cee
mov ecx, dword [esp + 0x28]
push ecx
call fcn.0044b6e3
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.0044b6ee
add esp, 0x48
ret
Function at 0x432fb0
Capabilities:
Delete file

Disassembly:
sub esp, 0x238
mov eax, dword [0x4832f0]
xor eax, esp
mov dword [esp + 0x234], eax
push esi
push edi
push 0x208
mov esi, ecx
xor edi, edi
lea ecx, [esp + 0x2e]
xor eax, eax
push edi
push ecx
mov word [esp + 0x34], ax
call fcn.0044e9d0
lea eax, [esp + 0x34]
mov ecx, eax
add esp, 0xc
mov edx, 0x104
sub esi, ecx
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x433011
movzx ecx, word [esi + eax]
cmp cx, di
je 0x433011
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x432ff1
jmp 0x433015
cmp edx, edi
jne 0x433018
sub eax, 2
xor edx, edx
mov word [eax], dx
xor eax, eax
mov dword [esp + 0x20], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov word [esp + 0x24], ax
lea edx, [esp + 8]
mov eax, 0x10
lea ecx, [esp + 0x28]
push edx
mov word [esp + 0x1c], ax
mov dword [esp + 0x22], edi
mov dword [esp + 0xc], edi
mov dword [esp + 0x26], edi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
xor ecx, ecx
test eax, eax
setge cl
pop edi
pop esi
mov eax, ecx
mov ecx, dword [esp + 0x234]
xor ecx, esp
call fcn.0044b6ee
add esp, 0x238
ret

Function at 0x4330a0
Capabilities:
Check if file exists
Copy file
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
sub esp, 0x210
mov eax, dword [0x4832f0]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
mov ebx, dword [esp + 0x218]
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x4330d4
mov ecx, esi
call fcn.00432fb0
jmp 0x43315f
push 0x208
lea eax, [esp + 0xc]
push 0
push eax
call fcn.0044e9d0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4330f9
mov eax, 0x80
and eax, 0xfffffff8
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.0044dc6d
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x43315f
call fcn.0044dc7f
cdq
mov ecx, 0x3e8
idiv ecx
mov ecx, 0x104
push edx
push esi
lea edx, [esp + 0x10]
push str._s._03d
push edx
call fcn.00402ee0
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
add esp, 0x10
push 1
lea eax, [esp + 0xc]
push eax
push esi
call edi
push 4
push 0
lea ecx, [esp + 0x10]
push ecx
call edi
push 0
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [esp + 0x214]
pop edi
pop ebx
xor ecx, esp
call fcn.0044b6ee
add esp, 0x210
ret
Function at 0x433180
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x469dbb
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x4832f0]
xor eax, esp
mov dword [esp + 0x42c], eax
push esi
mov eax, dword [0x4832f0]
xor eax, esp
push eax
lea eax, [esp + 0x438]
mov dword fs:[0], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x2e]
push ecx
mov word [esp + 0x30], ax
call fcn.0044e9d0
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x242]
push eax
mov word [esp + 0x244], dx
call fcn.0044e9d0
add esp, 0x18
call fcn.00406350
test eax, eax
je 0x4331ff
xor eax, eax
jmp 0x43332f
push 0x104
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, 0x104
lea eax, [esp + 0x24]
cmp word [eax], 0
je 0x433228
add eax, 2
sub ecx, 1
jne 0x433218
jmp 0x43324d
test ecx, ecx
je 0x43324d
mov eax, 0x104
sub eax, ecx
push 0x7fffffff
mov ecx, 0x104
push str.drivers
sub ecx, eax
lea edx, [esp + eax*2 + 0x2c]
call fcn.00402f40
push 0x208
lea edx, [esp + 0x230]
push 0
push edx
call fcn.0044e9d0
add esp, 0xc
push str.hookport.sys
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x234]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
xor edx, edx
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], 0
mov word [esp + 0xc], dx
lea ecx, [esp + 8]
mov dword [esp + 0x440], edx
call fcn.004090f0
test eax, eax
jne 0x4332b8
push eax
push 0x474a60
lea esi, [esp + 0x10]
call fcn.004018a0
jmp 0x4332d8
push 9
push str.Download
lea eax, [esp + 0x10]
call fcn.00405090
push 0xd
push 0x474438
lea eax, [esp + 0x10]
call fcn.00405090
cmp dword [esp + 0x20], 8
mov esi, dword [esp + 0xc]
jae 0x4332e7
lea esi, [esp + 0xc]
lea eax, [esp + 0x22c]
push eax
mov ecx, esi
call fcn.00432d10
add esp, 4
test eax, eax
jne 0x433301
xor esi, esi
jmp 0x433319
push esi
lea esi, [esp + 0x230]
call fcn.004330a0
add esp, 4
mov esi, eax
neg esi
sbb esi, esi
neg esi
cmp dword [esp + 0x20], 8
jb 0x43332d
mov ecx, dword [esp + 0xc]
push ecx
call fcn.0044b6e3
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x438]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x42c]
xor ecx, esp
call fcn.0044b6ee
add esp, 0x43c
ret
Function at 0x433840
Capabilities:
Copy file

Disassembly:
push 0xffffffffffffffff
push 0x4693e0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x4832f0]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4832f0]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov ebp, 7
xor ebx, ebx
xor eax, eax
mov dword [esp + 0x48], ebp
mov dword [esp + 0x44], ebx
mov word [esp + 0x34], ax
lea ecx, [esp + 0x30]
mov dword [esp + 0x58], ebx
call fcn.004090f0
test eax, eax
jne 0x4338b4
cmp dword [esp + 0x48], 8
jb 0x4338ad
mov ecx, dword [esp + 0x34]
push ecx
call fcn.0044b6e3
add esp, 4
xor eax, eax
jmp 0x4339b8
push 0xf
push str.360Protect.dat
lea eax, [esp + 0x38]
call fcn.00405090
xor edx, edx
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], dx
lea ecx, [esp + 0x14]
mov byte [esp + 0x58], 1
call fcn.004090f0
test eax, eax
jne 0x433935
push ebx
push 0x474a60
lea esi, [esp + 0x1c]
call fcn.004018a0
mov esi, 8
cmp dword [esp + 0x2c], esi
jb 0x43390c
mov eax, dword [esp + 0x18]
push eax
call fcn.0044b6e3
add esp, 4
xor ecx, ecx
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], cx
cmp dword [esp + 0x48], esi
jb 0x4338ad
mov edx, dword [esp + 0x34]
push edx
call fcn.0044b6e3
add esp, 4
xor eax, eax
jmp 0x4339b8
push 9
push str.Download
lea eax, [esp + 0x1c]
call fcn.00405090
push 0xf
push str.360Protect.dat
lea eax, [esp + 0x1c]
call fcn.00405090
mov ecx, dword [esp + 0x34]
mov esi, 8
cmp dword [esp + 0x48], esi
jae 0x433968
lea ecx, [esp + 0x34]
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x2c], esi
jae 0x433976
lea eax, [esp + 0x18]
push ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edi, eax
cmp dword [esp + 0x2c], esi
jb 0x433994
mov eax, dword [esp + 0x18]
push eax
call fcn.0044b6e3
add esp, 4
xor ecx, ecx
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], cx
cmp dword [esp + 0x48], esi
jb 0x4339b6
mov edx, dword [esp + 0x34]
push edx
call fcn.0044b6e3
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.0044b6ee
add esp, 0x48
ret
Function at 0x434110
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x469360
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x4832f0]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
mov eax, dword [0x4832f0]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
xor eax, eax
push ecx
push 0x477d74
lea edx, [esp + 0x1c]
xor ebx, ebx
mov dword [esp + 0x50], ebx
push 0x14
push edx
mov word [esp + 0x24], ax
mov dword [esp + 0x26], eax
mov dword [esp + 0x2a], eax
mov dword [esp + 0x2e], eax
mov dword [esp + 0x32], eax
mov dword [esp + 0x36], eax
mov dword [esp + 0x3a], eax
mov dword [esp + 0x3e], eax
mov dword [esp + 0x42], eax
mov dword [esp + 0x46], eax
mov word [esp + 0x4a], ax
call fcn.0044c3dd
sub esp, 0xc
mov esi, esp
xor eax, eax
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebx
mov word [esi + 4], ax
lea eax, [esp + 0x30]
mov dword [esp + 0x2c], esp
lea edx, [eax + 2]
jmp 0x4341b0
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4341b0
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x34]
push ecx
call fcn.004018a0
sub esp, 0x1c
mov eax, esp
mov dword [esp + 0x44], esp
push 0xffffffffffffffff
mov byte [esp + 0x84], 1
push ebx
lea ecx, [esp + 0x94]
xor edx, edx
mov dword [eax + 0x18], 7
mov dword [eax + 0x14], ebx
push ecx
mov word [eax + 4], dx
call fcn.00401950
mov edx, dword [esp + 0x88]
push edx
mov byte [esp + 0x84], bl
call fcn.00434040
cmp dword [esp + 0x6c], 8
jb 0x434223
mov eax, dword [esp + 0x58]
push eax
call fcn.0044b6e3
add esp, 4
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.0044b6ee
add esp, 0x40
ret 0x20
Function at 0x434250
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x469360
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x4832f0]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
mov eax, dword [0x4832f0]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
xor eax, eax
push ecx
push 0x474718
lea edx, [esp + 0x1c]
xor ebx, ebx
mov dword [esp + 0x50], ebx
push 0x14
push edx
mov word [esp + 0x24], ax
mov dword [esp + 0x26], eax
mov dword [esp + 0x2a], eax
mov dword [esp + 0x2e], eax
mov dword [esp + 0x32], eax
mov dword [esp + 0x36], eax
mov dword [esp + 0x3a], eax
mov dword [esp + 0x3e], eax
mov dword [esp + 0x42], eax
mov dword [esp + 0x46], eax
mov word [esp + 0x4a], ax
call fcn.0044c3dd
sub esp, 0xc
mov esi, esp
xor eax, eax
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebx
mov word [esi + 4], ax
lea eax, [esp + 0x30]
mov dword [esp + 0x2c], esp
lea edx, [eax + 2]
jmp 0x4342f0
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4342f0
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x34]
push ecx
call fcn.004018a0
sub esp, 0x1c
mov eax, esp
mov dword [esp + 0x44], esp
push 0xffffffffffffffff
mov byte [esp + 0x84], 1
push ebx
lea ecx, [esp + 0x94]
xor edx, edx
mov dword [eax + 0x18], 7
mov dword [eax + 0x14], ebx
push ecx
mov word [eax + 4], dx
call fcn.00401950
mov edx, dword [esp + 0x88]
push edx
mov byte [esp + 0x84], bl
call fcn.00434040
cmp dword [esp + 0x6c], 8
jb 0x434363
mov eax, dword [esp + 0x58]
push eax
call fcn.0044b6e3
add esp, 4
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.0044b6ee
add esp, 0x40
ret 0x20

Function at 0x4348e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x469af8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4832f0]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
mov eax, dword [0x4832f0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor ebx, ebx
xor eax, eax
mov dword [esp + 0xc], ebx
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], ebx
mov word [esp + 0x14], ax
lea esi, [esp + 0x10]
mov dword [esp + 0x38], ebx
call fcn.00408ff0
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], ebx
test eax, eax
jne 0x434959
push ebx
xor ecx, ecx
push 0x474a60
mov esi, edi
mov word [edi + 4], cx
call fcn.004018a0
jmp 0x43496e
push 0xffffffffffffffff
xor eax, eax
push ebx
lea ecx, [esp + 0x18]
mov word [edi + 4], ax
push ecx
mov eax, edi
call fcn.00401950
cmp dword [esp + 0x28], 8
jb 0x434982
mov edx, dword [esp + 0x14]
push edx
call fcn.0044b6e3
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0044b6ee
add esp, 0x30
ret
Function at 0x4354c0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x468fa8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4832f0]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push esi
push edi
mov eax, dword [0x4832f0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor ebx, ebx
xor eax, eax
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], ebx
mov word [esp + 0x14], ax
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], ebx
call fcn.004090f0
test eax, eax
jne 0x435532
cmp dword [esp + 0x28], 8
jb 0x43552b
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0044b6e3
add esp, 4
xor al, al
jmp 0x4355b2
push 0xf
push str.360NetBase.dll
lea eax, [esp + 0x18]
call fcn.00405090
mov eax, dword [esp + 0x14]
mov esi, 8
cmp dword [esp + 0x28], esi
jae 0x435555
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43559d
mov edi, dword [esp + 0x14]
cmp dword [esp + 0x28], esi
jae 0x43556e
lea edi, [esp + 0x14]
push 0x4dfa00
call fcn.00403570
test eax, eax
je 0x43559d
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x28], esi
jae 0x43558a
lea eax, [esp + 0x14]
push eax
call fcn.00435460
mov ecx, eax
call fcn.004352b0
test eax, eax
je 0x43559d
mov bl, 1
cmp dword [esp + 0x28], esi
jb 0x4355b0
mov edx, dword [esp + 0x14]
push edx
call fcn.0044b6e3
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0044b6ee
add esp, 0x2c
ret
Function at 0x43b4f0
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push ecx
push edi
xor edi, edi
cmp edx, edi
jne 0x43b4fd
xor eax, eax
pop edi
pop ecx
ret
cmp byte [0x484a58], 0x4d
jne 0x43b50f
cmp byte [0x484a59], 0x5a
je 0x43b521
xor eax, eax
mov cl, 0x64
xor byte [eax + 0x484a58], cl
inc eax
cmp eax, 0x2f998
jb 0x43b513
push esi
push edi
push edi
push 2
push edi
push 1
push 0x40000000
push edx
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x43b567
push edi
lea eax, [esp + 0xc]
push eax
push 0x2f998
push 0x484a58
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x43b560
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, edi
pop edi
pop ecx
ret
Function at 0x43be00
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x68
push ebx
push ebp
push esi
push edi
push 0x40
xor ebx, ebx
lea eax, [esp + 0x38]
push ebx
push eax
xor ebp, ebp
call fcn.0044e9d0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor eax, eax
add esp, 0xc
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], 0x44
mov dword [esp + 0x38], str.Winsta0default
cmp dword [0x4e0fa8], ebx
jne 0x43be65
push str.CreateEnvironmentBlock
push str.Userenv.DLL
call edi
push eax
call esi
mov dword [0x4e0fa8], eax
cmp dword [0x4e0fac], ebx
jne 0x43be81
push str.DestroyEnvironmentBlock
push str.Userenv.DLL
call edi
push eax
call esi
mov dword [0x4e0fac], eax
cmp dword [esp + 0x80], ebx
je 0x43bf8f
push ebx
call fcn.0040ace0
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x43bf8f
cmp dword [0x4e0fa8], ebx
je 0x43bf88
cmp dword [0x4e0fac], ebx
je 0x43bf88
mov edi, dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov dword [esp + 0x1c], ebx
push ebx
push esi
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x20], ebx
call dword [0x4e0fa8]
test eax, eax
je 0x43bf76
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x43bf76
lea edx, [esp + 0x20]
push edx
mov edx, dword [esp + 0x84]
lea ecx, [esp + 0x34]
push ecx
push ebx
push eax
mov eax, dword [esp + 0x8c]
push 0x8000420
push ebx
push ebx
push ebx
push edx
push eax
push esi
call edi
test eax, eax
je 0x43bf67
mov ecx, dword [esp + 0x20]
push 0x2710
push ecx
mov dword [esp + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x43bf51
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x18]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x84]
mov dword [ecx], eax
cmp eax, ebx
jne 0x43bf51
mov ebp, 1
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x14]
push ecx
call dword [0x4e0fac]
cmp ebp, ebx
jne 0x43bf88
mov eax, dword [esp + 0x1c]
inc eax
cmp eax, 3
mov dword [esp + 0x1c], eax
jl 0x43bec3
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x68
ret