joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43e68b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x67e2d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
xor edi, edi
push 0x208
push edi
push eax
mov dword [ebp - 0x210], edi
call fcn.0056b050
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push edi
push edi
push 0x8026
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ecx, esi
test eax, eax
js 0x43e6e4
lea eax, [ebp - 0x20c]
push eax
jmp 0x43e6e9
push 0x5f1b30
call fcn.00413f09
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00506d7f
mov esp, ebp
pop ebp
ret 4

Function at 0x43e702
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push 4
pop eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ecx + 4]
or eax, 0x20019
push eax
push 0
push dword [ecx + 0x10]
push dword [ecx + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x43e736
mov esi, dword [ebp + 0xc]
jmp 0x43e768
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 4]
test eax, eax
push dword [ebp - 8]
cmovne ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 4]
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00412ac4
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x43fd6c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
lea eax, [ebp - 4]
xor edi, edi
push eax
mov eax, dword [ecx + 4]
or eax, 0x20019
push eax
push edi
push dword [ecx + 0x10]
push dword [ecx + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43fdb3
push esi
push edi
push edi
push edi
push edi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x43fdb3
inc edi
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00412ac4
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 4

Function at 0x43ff17
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jg 0x43ff2c
xor eax, eax
jmp 0x43ff69
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push ebx
push esi
push eax
call fcn.0043fec6
pop ecx
push dword [ebp + 8]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
test esi, esi
je 0x43ff56
push dword [ebp - 4]
call fcn.0043ff6d
pop ecx
cmp ebx, 0xffffffff
je 0x43ff65
test bl, 0x10
jne 0x43ff65
xor eax, eax
inc eax
jmp 0x43ff67
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x450b18
Capabilities:
Create http request

Disassembly:
push 0x22c
mov eax, 0x5c93d8
call fcn.00506dfb
mov esi, ecx
mov dword [ebp - 0x21c], esi
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x220], esi
mov dword [esi + 4], ecx
mov dword [esi + 8], ecx
mov dword [ebp - 4], ecx
mov dword [esi], vtable.CInternetSession.0
test eax, eax
jne 0x450b80
push 0x104
lea eax, [ebp - 0x218]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push dword [ebp + 0x18]
push ebx
push edi
push dword [ebp + 0xc]
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [esi + 4], eax
test eax, eax
jne 0x450bbc
push str.Failed_to_open_an_internet_session
push eax
lea eax, [ebp - 0x238]
push eax
call fcn.00450a03
add esp, 0xc
lea eax, [ebp - 0x238]
push 0x6717f8
push eax
call fcn.0056b1aa
mov eax, esi
call fcn.00506da5
ret 0x14

Function at 0x4518d7
Capabilities:
Hide graphical window

Disassembly:
push 4
mov eax, 0x5c97f5
call fcn.00506dc7
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 2
call fcn.00452d1c
mov eax, dword [ebp + 8]
lea ebx, [esi + 0x2c8]
mov dword [esi + 0x2c0], eax
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 3
mov dword [esi], vtable.CTipDlg.0
mov dword [esi + 0x10], vtable.CTipDlg.1.0
mov dword [esi + 0x14], vtable.CTipDlg.2.0
mov dword [esi + 0x18], vtable.CTipDlg.3.0
mov dword [esi + 0x2c4], eax
call fcn.0041279d
push eax
mov ecx, ebx
call fcn.00411d94
mov byte [ebp - 4], 4
lea edi, [esi + 0x2cc]
call fcn.0041279d
push eax
mov ecx, edi
call fcn.00411d94
mov byte [ebp - 4], 5
call fcn.0041279d
push eax
lea ecx, [esi + 0x2d0]
call fcn.00411d94
lea eax, [ebp + 0x10]
mov byte [ebp - 4], 6
push eax
mov ecx, ebx
call fcn.00411f3a
lea eax, [ebp + 0x14]
mov ecx, edi
push eax
call fcn.00411f3a
lea eax, [ebp + 0x18]
push eax
lea ecx, [esi + 0x2d0]
call fcn.00411f3a
mov al, byte [ebp + 0x1c]
mov ecx, esi
push 0
mov byte [esi + 0x2d4], al
mov eax, SysReAllocString
push eax
push eax
push eax
push eax
push 0x80
push eax
push 0x6193a4
push 0
call fcn.005237e1
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp + 0x14]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp + 0x18]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov eax, esi
call fcn.00506d90
ret 0x18
Function at 0x4569a9
Capabilities:
Suspend thread

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 0xa4]
call fcn.0045595f
mov ecx, esi
pop esi
jmp fcn.0045511e

Function at 0x45850a
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5caad6
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x67e2d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
lea ecx, [edi + 8]
mov eax, dword [esi]
mov dword [edi], eax
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
lea eax, [esi + 8]
push eax
call fcn.00411f3a
lea eax, [esi + 0xc]
push eax
lea ecx, [edi + 0xc]
call fcn.00411f3a
lea eax, [esi + 0x10]
push eax
lea ecx, [edi + 0x10]
call fcn.00411f3a
lea eax, [esi + 0x14]
push eax
lea ecx, [edi + 0x14]
call fcn.00411f3a
lea eax, [esi + 0x18]
push eax
lea ecx, [edi + 0x18]
call fcn.00411f3a
lea eax, [esi + 0x1c]
push eax
lea ecx, [edi + 0x1c]
call fcn.00411f3a
lea eax, [esi + 0x20]
push eax
lea ecx, [edi + 0x20]
call fcn.00411f3a
lea eax, [esi + 0x24]
push eax
lea ecx, [edi + 0x24]
call fcn.00411f3a
lea eax, [esi + 0x28]
push eax
lea ecx, [edi + 0x28]
call fcn.00411f3a
mov eax, dword [esi + 0x2c]
lea ecx, [edi + 0x30]
mov dword [edi + 0x2c], eax
lea eax, [esi + 0x30]
push eax
call fcn.00457d41
mov eax, dword [esi + 0x3c]
mov dword [edi + 0x3c], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x45ed1e
Capabilities:
Check if file exists

Disassembly:
push 0x10
mov eax, 0x5cb7ca
call fcn.00506dc7
mov edi, ecx
push dword [ebp + 8]
and dword [ebp - 4], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45eda1
push 0x61c3ac
lea ecx, [ebp + 0xc]
call fcn.0042e677
test eax, eax
jne 0x45ed55
mov dword [edi + 0x60], 1
mov eax, dword [ebp + 0xc]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x10], esp
mov esi, esp
push eax
mov dword [ebp - 0x14], esi
call fcn.00412393
add eax, 0x10
mov dword [esi], eax
mov ecx, esp
mov byte [ebp - 4], 1
push dword [ebp + 8]
call fcn.00413f09
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0
call fcn.00452e6a
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 2
push eax
lea ecx, [edi + 0x20]
call fcn.0045ab74
lea ecx, [ebp - 0x1c]
call fcn.004570ec
mov ecx, dword [ebp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
call fcn.00506d90
ret 8
Function at 0x460423
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x67e2d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
xor edi, edi
push 0x208
push edi
push eax
mov dword [ebp - 0x210], edi
call fcn.0056b050
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push edi
push edi
push 0x8016
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ecx, esi
test eax, eax
js 0x46047c
lea eax, [ebp - 0x20c]
push eax
jmp 0x460481
push 0x5f1b30
call fcn.00413f09
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00506d7f
mov esp, ebp
pop ebp
ret 4

Function at 0x46049a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x67e2d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
xor edi, edi
push 0x208
push edi
push eax
mov dword [ebp - 0x210], edi
call fcn.0056b050
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push edi
push edi
push 0x8018
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ecx, esi
test eax, eax
js 0x4604f3
lea eax, [ebp - 0x20c]
push eax
jmp 0x4604f8
push 0x5f1b30
call fcn.00413f09
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00506d7f
mov esp, ebp
pop ebp
ret 4

Function at 0x4606bf
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x67e2d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
xor edi, edi
push 0x208
push edi
push eax
mov dword [ebp - 0x210], edi
call fcn.0056b050
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push edi
push edi
push 0x1a
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ecx, esi
test eax, eax
js 0x460715
lea eax, [ebp - 0x20c]
push eax
jmp 0x46071a
push 0x5f1b30
call fcn.00413f09
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00506d7f
mov esp, ebp
pop ebp
ret 4
Function at 0x464744
Capabilities:
Check if file exists

Disassembly:
push 0x20
mov eax, 0x5cc2cb
call fcn.00506dc7
mov ecx, dword [0x682eb4]
lea eax, [ebp - 0x10]
push eax
call fcn.0048264a
push dword [ebp - 0x10]
and dword [ebp - 4], 0
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call esi
test eax, eax
jne 0x464810
mov ecx, dword [0x682eb4]
lea eax, [ebp - 0x14]
push eax
call fcn.00482225
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00411f3a
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 0
lea ecx, [ecx - 0x10]
call fcn.00412ac4
lea ecx, [ebp - 0x2c]
call fcn.0042ca82
push dword [ebp - 0x10]
mov byte [ebp - 4], 2
call esi
push ecx
mov esi, esp
test eax, eax
mov dword [ebp - 0x14], esi
mov eax, dword [ebp - 0x10]
jne 0x4647e3
add eax, 0xfffffff0
push eax
call fcn.00412393
pop ecx
add eax, 0x10
lea ecx, [ebp - 0x2c]
mov dword [esi], eax
call fcn.00439b38
test eax, eax
je 0x4647fd
push ecx
mov esi, esp
mov dword [ebp - 0x14], esi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
push eax
call fcn.00412393
add eax, 0x10
pop ecx
mov dword [esi], eax
mov ecx, dword [0x682eb4]
call fcn.004d8052
lea ecx, [ebp - 0x2c]
call fcn.0042e60b
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
call fcn.00506d90
ret
Function at 0x465110
Capabilities:
Check mutex on windows
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x67e2d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x23c]
mov esi, 0x104
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x23c], esi
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0059fd7e
add esp, 0xc
lea eax, [ebp - 0x20c]
xor ebx, ebx
inc ebx
push eax
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
je 0x46521c
cmp eax, 0xb7
jne 0x46521c
push 0
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
test esi, esi
je 0x46521e
push edi
push 0xa
pop ecx
xor eax, eax
lea edi, [ebp - 0x234]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x238]
mov dword [ebp - 0x238], 0x2c
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowPlacement]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x4651f2
cmp dword [ebp - 0x230], 2
jne 0x4651e4
cmp dword [ebp - 0x234], 2
jne 0x4651e0
push 3
jmp 0x4651ef
push 9
jmp 0x4651ef
cmp dword [ebp - 0x230], 3
je 0x4651dc
push 5
push esi
call edi
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x465208
push 5
push esi
call edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call fcn.004dbd92
pop ecx
push ebx
push 0
push esi
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
jmp 0x46521e
xor ebx, ebx
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00412ac4
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00412ac4
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.00506d7f
mov esp, ebp
pop ebp
ret
Function at 0x4668ea
Capabilities:
Check if file exists

Disassembly:
push 0x68
mov eax, 0x5ccc84
call fcn.00506dc7
lea ecx, [ebp - 0x3c]
call fcn.0042ca82
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x3c]
call fcn.0042e4c9
mov eax, dword [ebp - 0x10]
mov byte [ebp - 4], 1
cmp dword [eax - 0xc], 0
je 0x466a44
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call edi
test eax, eax
je 0x466a41
push 0x5facd4
lea ecx, [ebp - 0x18]
call fcn.00413f09
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
mov byte [ebp - 4], 2
push eax
call fcn.00412393
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp - 0x20], esi
mov eax, dword [ebp - 0x10]
mov byte [ebp - 4], 3
cmp dword [eax - 0xc], 0
je 0x466a2e
push eax
call edi
test eax, eax
je 0x466a2e
push ecx
mov edi, esp
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x14], edi
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
push eax
call fcn.00412393
add eax, 0x10
mov dword [edi], eax
push esp
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 4
call fcn.004393d5
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x3c]
call fcn.00434114
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 5
call fcn.00438cb8
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x74]
call fcn.00411f3a
mov eax, dword [ebp - 0x10]
push ecx
add eax, 0xfffffff0
mov edi, esp
push eax
mov dword [ebp - 0x24], edi
call fcn.00412393
add eax, 0x10
pop ecx
mov dword [edi], eax
lea ecx, [ebp - 0x3c]
lea eax, [ebp - 0x1c]
push eax
call fcn.0042fedd
push eax
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 7
call fcn.00411f3a
mov ecx, dword [ebp - 0x1c]
mov byte [ebp - 4], 6
lea ecx, [ecx - 0x10]
call fcn.00412ac4
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x5c]
call fcn.00411f3a
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x74]
call fcn.0043e77c
lea ecx, [ebp - 0x74]
call fcn.00438f03
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
lea ecx, [esi - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov eax, dword [ebp - 0x10]
lea ecx, [eax - 0x10]
call fcn.00412ac4
lea ecx, [ebp - 0x3c]
call fcn.0042e60b
mov ecx, dword [ebp - 0x2c]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
call fcn.00506d90
ret
Function at 0x466e7c
Capabilities:
Create process on windows

Disassembly:
push 0xe8
mov eax, 0x5ccd89
call fcn.00506dfb
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.0042fb20
xorps xmm0, xmm0
cmp eax, 0x13
jge 0x466ef8
push 0x44
lea eax, [ebp - 0xb0]
push ebx
push eax
movups xmmword [ebp - 0x5c], xmm0
call fcn.0056b050
mov eax, dword [ebp + 8]
add esp, 0xc
cmp dword [eax - 4], 1
jle 0x466eca
push dword [eax - 0xc]
lea ecx, [ebp + 8]
call fcn.00412624
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x5c]
push ecx
lea ecx, [ebp - 0xb0]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push dword [ebp - 0x5c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, eax
call esi
push dword [ebp - 0x58]
jmp 0x466ff1
push 6
pop ecx
mov esi, 0x5ff7f0
mov dword [ebp - 0x44], ebx
lea edi, [ebp - 0x38]
mov dword [ebp - 0x3c], ebx
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov dword [ebp - 0x40], ebx
lea edi, [ebp - 0x20]
mov dword [ebp - 0x4c], ebx
stosd dword es:[edi], eax
push 0x44
push ebx
mov dword [ebp - 0x48], ebx
stosd dword es:[edi], eax
movups xmmword [ebp - 0x6c], xmm0
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0xf4]
push eax
call fcn.0056b050
add esp, 0xc
lea eax, [ebp - 0x44]
mov esi, 0x2000000
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x466ff3
lea eax, [ebp - 0x3c]
push eax
push 1
push 2
push ebx
push esi
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x466fee
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x38]
push eax
call sub.ADVAPI32.dll_ConvertStringSidToSidW
test eax, eax
je 0x466fe9
mov eax, dword [ebp - 0x40]
push eax
mov dword [ebp - 0x48], 0x20
mov dword [ebp - 0x4c], eax
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
add eax, 8
push eax
lea eax, [ebp - 0x4c]
push eax
push 0x19
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
je 0x466fe0
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 1
jle 0x466fc2
push dword [eax - 0xc]
lea ecx, [ebp + 8]
call fcn.00412624
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x6c]
push ecx
lea ecx, [ebp - 0xf4]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push ebx
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov ebx, eax
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0x3c]
call esi
push dword [ebp - 0x44]
call esi
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00412ac4
mov eax, ebx
call fcn.00506da5
ret
Function at 0x467006
Capabilities:
Create directory

Disassembly:
push 0x10
mov eax, 0x5ccdc9
call fcn.00506dc7
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
jne 0x467024
xor al, al
jmp 0x4670ff
add eax, 0xfffffff0
push eax
call fcn.00412393
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp + 8], esi
mov eax, dword [esi - 0xc]
lea ecx, [ebp + 8]
xor ebx, ebx
dec eax
push eax
mov dword [ebp - 4], ebx
call fcn.0042eba7
push 0x5c
pop ecx
cmp ax, cx
je 0x46705a
push ecx
lea ecx, [ebp + 8]
call fcn.0042e49c
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], 1
call fcn.0041279d
push eax
lea ecx, [ebp - 0x10]
call fcn.00411d94
xor edi, edi
mov byte [ebp - 4], 2
cmp dword [esi - 0xc], edi
jle 0x4670bd
push edi
lea ecx, [ebp + 8]
call fcn.0042eba7
push 0x5c
pop ecx
cmp ax, cx
je 0x46709f
push edi
lea ecx, [ebp + 8]
call fcn.0042eba7
movzx eax, ax
jmp 0x4670ae
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0042e1b5
push 0x5c
pop eax
push eax
lea ecx, [ebp - 0x10]
call fcn.0042e49c
inc edi
cmp edi, dword [esi - 0xc]
jl 0x467080
xor edi, edi
cmp dword [ebp - 0x18], edi
jle 0x4670e2
push edi
lea ecx, [ebp - 0x1c]
call fcn.0042def1
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne bl
inc edi
cmp edi, dword [ebp - 0x18]
jl 0x4670c4
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00412ac4
lea ecx, [ebp - 0x1c]
call fcn.00434a10
lea ecx, [esi - 0x10]
call fcn.00412ac4
mov al, bl
call fcn.00506d90
ret
Function at 0x467491
Capabilities:
Create process on windows
Enumerate processes

Disassembly:
push 0x288
mov eax, 0x5cce7f
call fcn.00506dfb
xor esi, esi
lea eax, [ebp - 0x23c]
mov ebx, 0x22c
mov dword [ebp - 4], esi
push ebx
push esi
push eax
mov edi, esi
call fcn.0056b050
add esp, 0xc
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x23c], ebx
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x467500
lea eax, [ebp - 0x218]
push 0x5ff968
push eax
call fcn.0059b558
pop ecx
pop ecx
test eax, eax
je 0x467506
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4674dc
jmp 0x46751b
push dword [ebp - 0x234]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call ebx
test edi, edi
je 0x4675a2
push edi
call fcn.0049b047
pop ecx
test eax, eax
je 0x4675a2
push 0x44
xor esi, esi
lea eax, [ebp - 0x294]
push esi
push eax
call fcn.0056b050
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
add esp, 0xc
movups xmmword [ebp - 0x250], xmm0
cmp dword [eax - 4], 1
jle 0x467568
push dword [eax - 0xc]
lea ecx, [ebp + 8]
call fcn.00412624
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x250]
push ecx
lea ecx, [ebp - 0x294]
push ecx
push esi
push esi
push esi
push esi
push esi
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
je 0x4675c5
push dword [ebp - 0x250]
call ebx
push dword [ebp - 0x24c]
call ebx
jmp 0x4675c5
mov eax, dword [ebp + 8]
push ecx
add eax, 0xfffffff0
mov esi, esp
push eax
mov dword [ebp - 0x240], esi
call fcn.00412393
add eax, 0x10
pop ecx
mov dword [esi], eax
call fcn.00466e7c
pop ecx
mov esi, eax
test edi, edi
je 0x4675cc
push edi
call ebx
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov eax, esi
call fcn.00506da5
ret

Function at 0x4675df
Capabilities:
Get common file path

Disassembly:
push 0x210
mov eax, 0x5cceaf
call fcn.00506dfb
mov esi, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
lea eax, [ebp - 0x218]
mov dword [ebp - 4], ecx
push eax
push ecx
push ecx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov ecx, esi
test eax, eax
je 0x467628
lea eax, [ebp - 0x218]
push eax
call fcn.00413f09
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
jmp 0x467638
push 0x5f1b30
call fcn.00413f09
mov ecx, dword [ebp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov eax, esi
call fcn.00506da5
ret 8
Function at 0x467656
Capabilities:
Persist via run registry key

Disassembly:
push 0xc
mov eax, 0x5ccee7
call fcn.00506dc7
mov ebx, ecx
xor eax, eax
mov dword [ebp - 0x10], eax
push eax
push ecx
mov ecx, esp
mov dword [ebp - 4], eax
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
call fcn.00413f09
push SysReAllocString
mov ecx, ebx
call fcn.0043fb03
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0x5f1b30
call fcn.00413f09
mov edi, dword [ebp + 0xc]
push ecx
mov esi, esp
mov byte [ebp - 4], 1
add edi, 0xfffffff0
mov dword [ebp - 0x18], esi
push edi
call fcn.00412393
pop ecx
push dword [ebp + 8]
add eax, 0x10
mov ecx, ebx
mov dword [esi], eax
mov byte [ebp - 4], 0
call fcn.00434880
mov ecx, edi
call fcn.00412ac4
mov eax, dword [ebp + 8]
call fcn.00506d90
ret 8