joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420d20
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4a12d8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea ecx, [ebp - 0xc]
push ecx
mov dword [ebp - 0x14], ebx
xor esi, esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov word [ebp - 8], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x420d79
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x14]
push edx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x420d81
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x420d92
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov dword [ebp - 0x10], ebx
cmp esi, ebx
je 0x420da7
push 0x49bf54
lea ecx, [ebp - 0x18]
push ecx
mov dword [ebp - 0x18], esi
call sub.MSVCR100.dll__CxxThrowException
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
pop esi
xor ecx, ebp
pop ebx
call fcn.0043e52a
mov esp, ebp
pop ebp
ret

Function at 0x420dc0
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x4a12d8]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x420e58
push 0x38
lea ecx, [ebp - 0x244]
push 0
push ecx
mov dword [ebp - 0x248], 0x3c
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x248]
lea edx, [ebp - 0x20c]
push eax
mov dword [ebp - 0x23c], str.runas
mov dword [ebp - 0x238], edx
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x22c], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x420e49
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043e52a
mov esp, ebp
pop ebp
ret
Function at 0x4210e0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x224
mov eax, dword [0x4a12d8]
xor eax, esp
mov dword [esp + 0x220], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x42113a
lea eax, [esp + 0x10]
push eax
push 0x20019
push 0
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x421179
cmp eax, 2
jne 0x421154
push str.Key_not_found._n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.0043e52a
mov esp, ebp
pop ebp
ret
push str.Error_opening_key._n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.0043e52a
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [esi + eax*2 - 2], 0x5c
lea edi, [esi + eax*2]
je 0x42119b
mov ecx, 0x5c
mov word [edi], cx
add edi, 2
xor edx, edx
mov word [edi], dx
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x14]
push 0
push 0
push 0
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x34]
push edx
push 0
push eax
mov dword [esp + 0x34], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x42124e
lea ecx, [ecx]
xor ecx, ecx
mov word [edi], cx
mov eax, 0x208
mov ecx, esi
lea esp, [esp]
cmp word [ecx], 0
je 0x4211ee
add ecx, 2
dec eax
jne 0x4211e0
jmp 0x421212
test eax, eax
je 0x421212
mov ecx, 0x208
sub ecx, eax
lea edx, [esp + 0x20]
mov eax, 0x208
push edx
sub eax, ecx
lea ecx, [esi + ecx*2]
mov edx, Ordinal_2
call fcn.004207a0
push esi
push ebx
call fcn.004210e0
add esp, 8
test eax, eax
je 0x42124e
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x14]
push 0
push 0
push 0
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x34]
push edx
push 0
push eax
mov dword [esp + 0x34], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x4211d0
xor ecx, ecx
mov word [edi - 2], cx
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [esp + 0x22c]
pop edi
neg eax
pop esi
sbb eax, eax
pop ebx
xor ecx, esp
inc eax
call fcn.0043e52a
mov esp, ebp
pop ebp
ret
Function at 0x421310
Capabilities:
Persist via default file association registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x4a12d8]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.00420d20
test eax, eax
jne 0x421331
call fcn.00420dc0
push esi
lea eax, [ebp - 0x418]
push eax
push str.LudiumLab_shellopencommand
push Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov ecx, dword [ebp - 0x418]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
push 0x30
push str.URL:LudiumLab_Protocol
push 1
push 0
push 0x480e4c
push Ordinal_2
call esi
push 0
push 0x47fe8a
push 1
push str.URL_Protocol
push 0x480e4c
push Ordinal_2
call esi
push 0x104
lea edx, [ebp - 0x414]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x20c]
push str.__s_____1_
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x20c]
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4213c6
sub eax, edx
sar eax, 1
lea edx, [eax + eax + 4]
push edx
lea eax, [ebp - 0x20c]
push eax
push 1
push 0
push str.LudiumLab_shellopencommand
push Ordinal_2
call esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0043e52a
mov esp, ebp
pop ebp
ret

Function at 0x421400
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov dword [ebp - 0x10], 4
cmp edi, reloc.XINPUT1_3.dll_Ordinal_2
jne 0x421457
push str.IsWow64Process
push str.kernel32
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x421457
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
je 0x421457
cmp dword [ebp - 8], 0
mov esi, str.SoftwareWow6432NodeMicrosoftInternet_ExplorerMainFeatureControlFEATURE_BROWSER_EMULATION
jne 0x42145c
mov esi, str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_BROWSER_EMULATION
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp - 4]
push ecx
push 0x20019
push 0
push esi
push edi
call ebx
cmp eax, 2
je 0x4214ee
lea edx, [ebp - 0x10]
push edx
mov edx, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0x14]
push ecx
push 0
push edx
push eax
mov dword [ebp - 0x14], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
jne 0x4214da
call fcn.00420d20
test eax, eax
jne 0x4214ac
call fcn.00420dc0
lea ecx, [ebp - 4]
push ecx
push 0xf003f
push 0
push esi
push edi
call ebx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
push 4
lea edx, [ebp - 0xc]
push edx
push 4
push 0
push eax
push ecx
mov dword [ebp - 0xc], 0x2af9
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x421500
Capabilities:
Query or enumerate registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x624
mov eax, dword [0x4a12d8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x620]
push eax
push 0x20019
push 0
push 0x480e4c
push Ordinal_2
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x421564
cmp eax, 2
jne 0x421559
call fcn.00421310
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043e52a
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
mov ecx, dword [ebp - 0x620]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call edi
lea edx, [ebp - 0x620]
push edx
push 0x20019
push 0
push str.LudiumLab_shellopencommand
push Ordinal_2
call esi
test eax, eax
je 0x4215cb
cmp eax, 2
jne 0x4215c0
call fcn.00420d20
test eax, eax
jne 0x4215a5
call fcn.00420dc0
call fcn.00421290
call fcn.00421310
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043e52a
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
mov edx, dword [ebp - 0x620]
lea eax, [ebp - 0x624]
push eax
lea ecx, [ebp - 0x61c]
push ecx
push 0
push edx
mov dword [ebp - 0x624], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov esi, eax
mov eax, dword [ebp - 0x620]
push eax
call edi
test esi, esi
je 0x42163a
cmp esi, 2
jne 0x42162f
call fcn.00420d20
test eax, eax
jne 0x421614
call fcn.00420dc0
call fcn.00421290
call fcn.00421310
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043e52a
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x414]
push str.__s_____1_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x61c]
lea eax, [ebp - 0x414]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x42169c
test dx, dx
je 0x421698
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x42169c
add eax, 4
add ecx, 4
test dx, dx
jne 0x421676
xor eax, eax
jmp 0x4216a1
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4216bd
call fcn.00420d20
test eax, eax
jne 0x4216b3
call fcn.00420dc0
call fcn.00421290
call fcn.00421310
lea esi, [ebp - 0x20c]
mov eax, esi
lea edx, [eax + 2]
jmp 0x4216d0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4216d0
sub eax, edx
sar eax, 1
dec eax
js 0x421706
mov ecx, 0x5c
jmp 0x4216f0
cmp word [ebp + eax*2 - 0x20c], cx
je 0x4216ff
dec eax
jns 0x4216f0
jmp 0x421706
lea esi, [ebp + eax*2 - 0x20a]
push esi
mov edi, reloc.XINPUT1_3.dll_Ordinal_2
call fcn.00421400
push esi
mov edi, reloc.EpicWrapperDll.dll_Ordinal_1
call fcn.00421400
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043e52a
mov esp, ebp
pop ebp
ret
Function at 0x421750
Capabilities:
Create process on windows
Terminate process

Disassembly:
mov eax, dword [0x1445a50]
push esi
push edi
mov edi, dword [sym.imp.mfc100u.dll_new]
test eax, eax
jne 0x42177c
push 4
call edi
add esp, 4
test eax, eax
je 0x421775
mov esi, eax
call fcn.00426050
jmp 0x421777
xor eax, eax
mov dword [0x1445a50], eax
mov eax, dword [eax]
imul eax, eax, 0x1bc
mov ecx, dword [eax + 0x4a1810]
mov eax, dword [eax + 0x4a180c]
push 0
push ecx
push eax
xor ecx, ecx
call fcn.0040e0f0
mov eax, dword [0x1445a50]
add esp, 0xc
test eax, eax
jne 0x4217c2
push 4
call edi
add esp, 4
test eax, eax
je 0x4217bb
mov esi, eax
call fcn.00426050
jmp 0x4217bd
xor eax, eax
mov dword [0x1445a50], eax
mov ecx, dword [eax]
imul ecx, ecx, 0x1bc
mov edx, dword [ecx + 0x4a1824]
push 5
push 0
push 0
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop edi
pop esi
ret

Function at 0x4219f0
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x4a12d8]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.00421500
call fcn.00421800
mov eax, dword [0x1445a50]
test eax, eax
jne 0x421a37
push 4
call dword [sym.imp.mfc100u.dll_new]
add esp, 4
test eax, eax
je 0x421a30
push esi
mov esi, eax
call fcn.00426050
pop esi
jmp 0x421a32
xor eax, eax
mov dword [0x1445a50], eax
push eax
lea eax, [ebp - 0x204]
call fcn.004261c0
push 5
push 0
push 0
lea eax, [ebp - 0x204]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043e52a
mov esp, ebp
pop ebp
ret

Function at 0x421a80
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.d3dcompiler_43.dll
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0x104], eax
call ebx
push str.d3d9.dll
mov dword [edi + 0x110], eax
call esi
mov dword [edi + 0x100], eax
call ebx
cmp dword [edi + 0x100], 0
mov dword [edi + 0x110], eax
je 0x421aca
cmp dword [edi + 0x104], 0
jne 0x421b23
mov eax, dword [0x1445a50]
test eax, eax
jne 0x421af2
push 4
call dword [sym.imp.mfc100u.dll_new]
add esp, 4
test eax, eax
je 0x421aeb
mov esi, eax
call fcn.00426050
jmp 0x421aed
xor eax, eax
mov dword [0x1445a50], eax
mov eax, dword [eax]
imul eax, eax, 0x1bc
mov ecx, dword [eax + 0x4a17f8]
mov eax, dword [eax + 0x4a17f4]
push 0
push ecx
push eax
xor ecx, ecx
call fcn.0040e0f0
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [edi + 0x100]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Direct3DCreate9
push ecx
call esi
mov edx, dword [edi + 0x100]
push str.Direct3DCreate9Ex
push edx
mov dword [edi + 0x108], eax
call esi
pop esi
mov dword [edi + 0x10c], eax
pop ebx
ret
Function at 0x421b60
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1420
call fcn.0043e650
mov eax, dword [0x4a12d8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0x100
lea eax, [ebp - 0x40c]
xor edi, edi
push eax
push edi
mov dword [ebp - 0x1410], edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x40c]
push 0x5c
push ecx
call dword [sym.imp.MSVCR100.dll_wcsrchr]
mov ebx, eax
add esp, 8
cmp ebx, edi
jne 0x421bb4
lea ebx, [ebp - 0x40c]
jmp 0x421bb7
add ebx, 2
lea edx, [ebp - 0x1418]
push edx
push 0x1000
lea eax, [ebp - 0x140c]
push eax
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
je 0x421cfa
mov eax, dword [ebp - 0x1418]
shr eax, 2
mov dword [ebp - 0x1414], eax
cmp eax, edi
jbe 0x421cfa
push esi
mov esi, dword [ebp + edi*4 - 0x140c]
test esi, esi
je 0x421ce3
mov eax, dword [0x482330]
mov ecx, dword [str._unknown_]
mov edx, dword [0x48232c]
push 0x1f4
mov dword [ebp - 0x204], eax
mov dword [ebp - 0x20c], ecx
mov ecx, dword [0x482334]
mov dword [ebp - 0x208], edx
mov edx, dword [0x482338]
lea eax, [ebp - 0x1f8]
push 0
push eax
mov dword [ebp - 0x200], ecx
mov dword [ebp - 0x1fc], edx
call sub.MSVCR100.dll_memset
add esp, 0xc
push esi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x421cd6
lea ecx, [ebp - 0x1420]
push ecx
push 4
lea edx, [ebp - 0x141c]
push edx
push esi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x421cd6
mov ecx, dword [ebp - 0x141c]
push 0x104
lea eax, [ebp - 0x20c]
push eax
push ecx
push esi
call dword [sym.imp.PSAPI.DLL_GetModuleBaseNameW]
mov ecx, ebx
lea eax, [ebp - 0x20c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x421cc7
test dx, dx
je 0x421cc3
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x421cc7
add eax, 4
add ecx, 4
test dx, dx
jne 0x421ca1
xor eax, eax
jmp 0x421ccc
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x421cd6
inc dword [ebp - 0x1410]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1414]
inc edi
cmp edi, eax
jb 0x421bf0
mov eax, 1
pop esi
cmp dword [ebp - 0x1410], eax
jg 0x421cfc
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0043e52a
mov esp, ebp
pop ebp
ret
Function at 0x424c70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x4a12d8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov ecx, 8
mov esi, str.C:SoraStreamSorastreamPlatform_
mov edi, 0x4a3188
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x808]
push eax
push 0
push 0
push 0x47d814
movsw word es:[edi], word [esi]
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
jne 0x424d42
mov edx, dword [ebp - 0x808]
push eax
push eax
push 0x800
lea ecx, [ebp - 0x804]
push ecx
push 0xffffffffffffffff
push edx
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, dword [sym.imp.MSVCR100.dll_sprintf]
push str.Logs
push 0x482e8c
push str.LudiumLab
lea eax, [ebp - 0x804]
push eax
push str._s_s_s_s
push 0x4a3988
call esi
push str.Baldrick.exe
push 0x4a3188
push str._sSoftware_s
push 0x4a4188
call esi
push str.TFormation_Win32.dll
push 0x4a3188
push str._sSoftware_s
push 0x4a4988
call esi
push str.TFormation_x64.dll
push 0x4a3188
push str._sSoftware_s
push 0x4a5188
call esi
add esp, 0x48
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0043e52a
mov esp, ebp
pop ebp
ret

Function at 0x424d60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1040
call fcn.0043e650
mov eax, dword [0x4a12d8]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
lea ecx, [ebp - 0x1034]
push ecx
mov dword [ebp - 0x1038], eax
call dword [sym.imp.MSVCR100.dll__ftime64]
lea edx, [ebp - 0x1034]
push edx
lea eax, [ebp - 0x24]
push 0x1a
push eax
call dword [sym.imp.MSVCR100.dll__ctime64_s]
mov edx, dword [esi*4 + 0x4a2abc]
push ebx
push edi
lea ecx, [ebp - 0x24]
push ecx
push edx
push str._s:_t_.24s_t__s__t_s_n
lea eax, [ebp - 0x1024]
push 0xfff
push eax
call dword [sym.imp.MSVCR100.dll__snprintf]
mov esi, eax
add esp, 0x2c
cmp esi, 0xffffffff
jne 0x424dd7
mov esi, 0xfff
mov eax, dword [ebp - 0x1038]
push 0
lea ecx, [ebp - 0x103c]
push ecx
mov ecx, dword [eax + 8]
push esi
lea edx, [ebp - 0x1024]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov byte [ebp + esi - 0x1024], 0
test eax, eax
jne 0x424e2a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ss_log_write_simple_failed_with_error__d__n
call dword [sym.imp.libssclient.dll_ss_OutputDebugStringA]
add esp, 8
xor eax, eax
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0043e52a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
xor ecx, ebp
mov eax, 1
pop esi
call fcn.0043e52a
mov esp, ebp
pop ebp
ret
Function at 0x425050
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x4a12d8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, ecx
push edi
mov esi, ecx
lea edi, [eax + 1]
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x425070
sub eax, edi
cmp eax, 4
jbe 0x4250a0
cmp byte [ecx], 0x5c
jne 0x4250a0
cmp byte [ecx + 1], 0x5c
jne 0x4250a0
cmp byte [ecx + 2], 0x3f
jne 0x4250a0
cmp byte [ecx + 3], 0x5c
jne 0x4250a0
mov eax, dword [ecx]
mov dword [ebp - 0x108], eax
lea esi, [ecx + 4]
mov al, byte [esi]
test al, al
je 0x42513b
mov edx, 1
sub edx, ecx
lea ebx, [ebp - 0x108]
mov dword [ebp - 0x10c], edx
sub ebx, esi
jmp 0x4250c7
mov edx, dword [ebp - 0x10c]
cmp al, 0x5c
je 0x4250cf
cmp al, 0x2f
jne 0x42512a
lea eax, [esi - 1]
mov ecx, 1
add edx, eax
lea esp, [esp]
cmp ecx, edx
jge 0x4250e9
cmp byte [eax], 0x5c
je 0x4250ee
cmp byte [eax], 0x2f
jne 0x4250f2
inc ecx
dec eax
jmp 0x4250e0
mov edx, esi
sub edx, ecx
cmp byte [edx], 0x3a
je 0x42512a
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test edi, edi
jne 0x42512a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x425179
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov cl, byte [esi]
mov al, byte [esi + 1]
mov byte [ebx + esi], cl
inc esi
mov byte [ebx + esi], 0
test al, al
jne 0x4250c1
push 0
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x425163
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x425179
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043e52a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0043e52a
mov esp, ebp
pop ebp
ret

Function at 0x425400
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.0043e650
lea eax, [ebp - 4]
push eax
push 0x400
lea ecx, [ebp - 0x1004]
push ecx
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x4254a5
mov edx, dword [ebp - 4]
cmp edx, 4
jb 0x4254a5
shr edx, 2
or ecx, 0xffffffff
xor eax, eax
push esi
test edx, edx
je 0x425497
lea ebx, [ebx]
mov esi, dword [ebp + eax*4 - 0x1004]
cmp esi, edi
jae 0x42546b
cmp ecx, 0xffffffff
je 0x425469
cmp dword [ebp + ecx*4 - 0x1004], esi
jae 0x42546b
mov ecx, eax
inc eax
cmp eax, edx
jb 0x425450
cmp ecx, 0xffffffff
je 0x425497
mov edx, dword [ebp + 8]
mov eax, dword [ebp + ecx*4 - 0x1004]
push 0x104
lea esi, [ebp + ecx*4 - 0x1004]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x42549e
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x426050
Capabilities:
Identify system language via api

Disassembly:
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
and eax, 0xff
cmp eax, 0x406
jg 0x4260c8
je case.0x426079.6
sub eax, 3
cmp eax, 0x1a
ja case.0x426079.4
movzx eax, byte [eax + 0x426134]
jmp dword [eax*4 + 0x426104]
mov dword [esi], 2
mov eax, esi
ret
mov dword [esi], 0
mov eax, esi
ret
mov dword [esi], 1
mov eax, esi
ret
mov dword [esi], 3
mov eax, esi
ret
mov dword [esi], 4
mov eax, esi
ret
mov dword [esi], 5
mov eax, esi
ret
mov dword [esi], 6
mov eax, esi
ret
mov dword [esi], 0xa
mov eax, esi
ret
cmp eax, 0x416
jg 0x4260e4
je case.0x426079.22
sub eax, 0x413
je case.0x426079.19
dec eax
jne case.0x426079.4
mov dword [esi], 7
mov eax, esi
ret
cmp eax, 0x41d
je case.0x426079.8
cmp eax, 0x813
jne case.0x426079.4
mov dword [esi], 8
mov eax, esi
ret
mov dword [esi], 9
mov eax, esi
ret

Function at 0x426390
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, eax
push esi
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x42640a
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x426409
push edi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x426409
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x426402
push edi
push ebx
push eax
call sub.MSVCR100.dll_memcpy
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [ebp - 4]
push eax
push 1
push esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jns 0x426409
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret