joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e082
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x468370
call fcn.0042e8d0
push 1
call fcn.0042e36c
pop ecx
test al, al
je 0x42e06c
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.0042e33a
mov byte [ebp - 0x24], al
mov eax, dword [0x46beb4]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x42e06c
test eax, eax
jne 0x42df90
mov dword [0x46beb4], ecx
push 0x44b424
push 0x44b408
call fcn.00434349
pop ecx
pop ecx
test eax, eax
je 0x42df73
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x42e05c
push 0x44b404
push 0x44b3d4
call fcn.00434302
pop ecx
pop ecx
mov dword [0x46beb4], 2
jmp 0x42df95
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.0042e4de
pop ecx
call fcn.0042e678
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x42dfc6
push esi
call fcn.0042e44a
pop ecx
test al, al
je 0x42dfc6
mov esi, dword [esi]
push edi
push 2
push edi
mov ecx, esi
call dword [0x44b3d0]
call esi
call fcn.0042e67e
mov esi, eax
cmp dword [esi], edi
je 0x42dfe4
push esi
call fcn.0042e44a
pop ecx
test al, al
je 0x42dfe4
push dword [esi]
call fcn.004345dd
pop ecx
call fcn.0042e79e
movzx eax, ax
push eax
call fcn.004342b8
push eax
push edi
push 0x400000
call main
mov esi, eax
call fcn.0042e7d4
test al, al
je 0x42e073
test bl, bl
jne 0x42e012
call fcn.004345b8
push edi
push 1
call fcn.0042e4fb
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x42e05c
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
push 7
call fcn.0042e684
push esi
call fcn.00434603
push dword [ebp - 0x20]
call fcn.004345c7
int3
call fcn.0042e5c0
jmp 0x42df06

Function at 0x42e5c0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
mov ecx, dword [0x46b008]
push esi
push edi
mov edi, 0xbb40e64e
mov esi, 0xffff0000
cmp ecx, edi
and ecx, ecx
ror ecx, 0xc
sub edx, edi
shr edi, 0x1c
neg edx
sub eax, 0xd76fecde
xor esi, 0xcd43808
rol edi, 0x1b
neg esi
shr ebx, 0x1b
xor ebx, esi
or ebx, 0xffe353bb
dec ebx
sub eax, 0x648a9ec2
add ecx, dword [0x46b850]
and esi, 0xe1976e09
or dword [esi - 0x69], ebp
loope 0x42e59b
sti
Function at 0x42e678
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
dec ecx
jne 0x42e64e
shr edx, 0x1d
ror ebx, 0x1e
dec edx
test dword [0x46b90d], 0x2079f4b6
jbe 0x42e695
sub edi, 0x5050871e
mov ecx, 0x38e724ab
xchg edx, eax
test dword [0x46b71e], esi
jl 0x42e6a9
mov edx, 0x71cad85a
and edx, 0xb943ed1e
cmp ebp, ecx
jo 0x42e6b5
xchg edi, edx
or ebx, edi
call fcn.0040535f
mov dword [0x46c9bf], 0x94cc40d2
sub edx, 0xd5189090
rol ebx, 0x15
inc ebx
xor eax, edi
dec ecx
jne 0x42e69a
not esi
dec ecx
neg ecx
mov ecx, 0x755aba1f
and eax, ebp
not esi
test dword [0x46b51c], ebp
jns 0x42e6f1
call fcn.00413f03
shr edx, 0xb
test dword [0x46b856], 0x5a4998bc
jae 0x42e706
mov edx, dword [0x46ba0d]
sub edi, 0x53ba86f
shr eax, 0xd
dec ecx
jne 0x42e6e0
cmp dword [sym.imp.WINTRUST.dll_WinVerifyTrust], ebx
jae 0x42e720
call fcn.00444ac5
call fcn.0042e4bf
neg edx
mov edi, 0x2e8018f6
mov ebx, edx
shr esi, 0x13
xchg edx, esi
xor ecx, 0x4d46af0d
mov ecx, 0xe6e015bc
dec eax
sub eax, 0xa6317023
neg ecx
xor ebx, 0x5b1c81df
mov edx, 0xb4a9079f
add ecx, 0x1b102c0f
ror edx, 0x1b
sub edx, dword [0x46cf98]
xchg ecx, edx
xor esi, dword [0x46ccc9]
call fcn.00415251
ror ebx, 0x12
mov dword [0x46cba3], edx
or ebx, dword [0x46ccb1]
call fcn.00424ffa
mov dword [0x46c8b3], esi
xor ecx, 0xc23e96c9
sub ebx, ebp
call fcn.00426395
ror edi, 1
add ecx, esi
xor ebx, 0xe5b9f88b
mov ecx, 0xaf0533e5
int 0x46
add byte [ebx], dh
add eax, 0x46ce1f
inc ecx
or ebx, dword [0x46cf67]
dec ecx
xor ebx, 0xe5b9f88b
sub ecx, esi
rol edi, 1
call fcn.0040dcc6
add ebx, ebp
xor ecx, 0xc23e96c9
sub dword [0x46c8c6], ecx
enter 0x46, 0x31
adc eax, 0x46caf6
test dl, 0x46
invalid
Function at 0x42e67e
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
dec ecx
jne 0x42e64e
shr edx, 0x1d
ror ebx, 0x1e
dec edx
test dword [0x46b90d], 0x2079f4b6
jbe 0x42e695
sub edi, 0x5050871e
mov ecx, 0x38e724ab
xchg edx, eax
test dword [0x46b71e], esi
jl 0x42e6a9
mov edx, 0x71cad85a
and edx, 0xb943ed1e
cmp ebp, ecx
jo 0x42e6b5
xchg edi, edx
or ebx, edi
call fcn.0040535f
mov dword [0x46c9bf], 0x94cc40d2
sub edx, 0xd5189090
rol ebx, 0x15
inc ebx
xor eax, edi
dec ecx
jne 0x42e69a
not esi
dec ecx
neg ecx
mov ecx, 0x755aba1f
and eax, ebp
not esi
test dword [0x46b51c], ebp
jns 0x42e6f1
call fcn.00413f03
shr edx, 0xb
test dword [0x46b856], 0x5a4998bc
jae 0x42e706
mov edx, dword [0x46ba0d]
sub edi, 0x53ba86f
shr eax, 0xd
dec ecx
jne 0x42e6e0
cmp dword [sym.imp.WINTRUST.dll_WinVerifyTrust], ebx
jae 0x42e720
call fcn.00444ac5
call fcn.0042e4bf
neg edx
mov edi, 0x2e8018f6
mov ebx, edx
shr esi, 0x13
xchg edx, esi
xor ecx, 0x4d46af0d
mov ecx, 0xe6e015bc
dec eax
sub eax, 0xa6317023
neg ecx
xor ebx, 0x5b1c81df
mov edx, 0xb4a9079f
add ecx, 0x1b102c0f
ror edx, 0x1b
sub edx, dword [0x46cf98]
xchg ecx, edx
xor esi, dword [0x46ccc9]
call fcn.00415251
ror ebx, 0x12
mov dword [0x46cba3], edx
or ebx, dword [0x46ccb1]
call fcn.00424ffa
mov dword [0x46c8b3], esi
xor ecx, 0xc23e96c9
sub ebx, ebp
call fcn.00426395
ror edi, 1
add ecx, esi
xor ebx, 0xe5b9f88b
mov ecx, 0xaf0533e5
int 0x46
add byte [ebx], dh
add eax, 0x46ce1f
inc ecx
or ebx, dword [0x46cf67]
dec ecx
xor ebx, 0xe5b9f88b
sub ecx, esi
rol edi, 1
call fcn.0040dcc6
add ebx, ebp
xor ecx, 0xc23e96c9
sub dword [0x46c8c6], ecx
enter 0x46, 0x31
adc eax, 0x46caf6
test dl, 0x46
invalid

Function at 0x42e684
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
add eax, 0x46b90d
mov dh, 0xf4
jns 0x42e6ad
inc ebx
mov ecx, 0x270e93b
Function at 0x42e79e
Capabilities:
Hash data using murmur3

Disassembly:
dec ecx
jne 0x42e64e
shr edx, 0x1d
ror ebx, 0x1e
dec edx
test dword [0x46b90d], 0x2079f4b6
jbe 0x42e695
sub edi, 0x5050871e
mov ecx, 0x38e724ab
xchg edx, eax
test dword [0x46b71e], esi
jl 0x42e6a9
mov edx, 0x71cad85a
and edx, 0xb943ed1e
cmp ebp, ecx
jo 0x42e6b5
xchg edi, edx
or ebx, edi
call fcn.0040535f
mov dword [0x46c9bf], 0x94cc40d2
sub edx, 0xd5189090
rol ebx, 0x15
inc ebx
xor eax, edi
dec ecx
jne 0x42e69a
not esi
dec ecx
neg ecx
mov ecx, 0x755aba1f
and eax, ebp
not esi
test dword [0x46b51c], ebp
jns 0x42e6f1
call fcn.00413f03
shr edx, 0xb
test dword [0x46b856], 0x5a4998bc
jae 0x42e706
mov edx, dword [0x46ba0d]
sub edi, 0x53ba86f
shr eax, 0xd
dec ecx
jne 0x42e6e0
cmp dword [sym.imp.WINTRUST.dll_WinVerifyTrust], ebx
jae 0x42e720
call fcn.00444ac5
call fcn.0042e4bf
neg edx
mov edi, 0x2e8018f6
mov ebx, edx
shr esi, 0x13
xchg edx, esi
xor ecx, 0x4d46af0d
mov ecx, 0xe6e015bc
dec eax
sub eax, 0xa6317023
neg ecx
xor ebx, 0x5b1c81df
mov edx, 0xb4a9079f
add ecx, 0x1b102c0f
ror edx, 0x1b
sub edx, dword [0x46cf98]
xchg ecx, edx
xor esi, dword [0x46ccc9]
call fcn.00415251
ror ebx, 0x12
mov dword [0x46cba3], edx
or ebx, dword [0x46ccb1]
call fcn.00424ffa
mov dword [0x46c8b3], esi
xor ecx, 0xc23e96c9
sub ebx, ebp
call fcn.00426395
ror edi, 1
add ecx, esi
xor ebx, 0xe5b9f88b
mov ecx, 0xaf0533e5
int 0x46
add byte [ebx], dh
add eax, 0x46ce1f
inc ecx
or ebx, dword [0x46cf67]
dec ecx
xor ebx, 0xe5b9f88b
sub ecx, esi
rol edi, 1
call fcn.0040dcc6
add ebx, ebp
xor ecx, 0xc23e96c9
sub dword [0x46c8c6], ecx
enter 0x46, 0x31
adc eax, 0x46caf6
test dl, 0x46
invalid
Function at 0x42e7d4
Capabilities:
Hash data using murmur3

Disassembly:
dec ecx
jne 0x42e64e
shr edx, 0x1d
ror ebx, 0x1e
dec edx
test dword [0x46b90d], 0x2079f4b6
jbe 0x42e695
sub edi, 0x5050871e
mov ecx, 0x38e724ab
xchg edx, eax
test dword [0x46b71e], esi
jl 0x42e6a9
mov edx, 0x71cad85a
and edx, 0xb943ed1e
cmp ebp, ecx
jo 0x42e6b5
xchg edi, edx
or ebx, edi
call fcn.0040535f
mov dword [0x46c9bf], 0x94cc40d2
sub edx, 0xd5189090
rol ebx, 0x15
inc ebx
xor eax, edi
dec ecx
jne 0x42e69a
not esi
dec ecx
neg ecx
mov ecx, 0x755aba1f
and eax, ebp
not esi
test dword [0x46b51c], ebp
jns 0x42e6f1
call fcn.00413f03
shr edx, 0xb
test dword [0x46b856], 0x5a4998bc
jae 0x42e706
mov edx, dword [0x46ba0d]
sub edi, 0x53ba86f
shr eax, 0xd
dec ecx
jne 0x42e6e0
cmp dword [sym.imp.WINTRUST.dll_WinVerifyTrust], ebx
jae 0x42e720
call fcn.00444ac5
call fcn.0042e4bf
neg edx
mov edi, 0x2e8018f6
mov ebx, edx
shr esi, 0x13
xchg edx, esi
xor ecx, 0x4d46af0d
mov ecx, 0xe6e015bc
dec eax
sub eax, 0xa6317023
neg ecx
xor ebx, 0x5b1c81df
mov edx, 0xb4a9079f
add ecx, 0x1b102c0f
ror edx, 0x1b
sub edx, dword [0x46cf98]
xchg ecx, edx
xor esi, dword [0x46ccc9]
call fcn.00415251
ror ebx, 0x12
mov dword [0x46cba3], edx
or ebx, dword [0x46ccb1]
call fcn.00424ffa
mov dword [0x46c8b3], esi
xor ecx, 0xc23e96c9
sub ebx, ebp
call fcn.00426395
ror edi, 1
add ecx, esi
xor ebx, 0xe5b9f88b
mov ecx, 0xaf0533e5
int 0x46
add byte [ebx], dh
add eax, 0x46ce1f
inc ecx
or ebx, dword [0x46cf67]
dec ecx
xor ebx, 0xe5b9f88b
sub ecx, esi
rol edi, 1
call fcn.0040dcc6
add ebx, ebp
xor ecx, 0xc23e96c9
sub dword [0x46c8c6], ecx
enter 0x46, 0x31
adc eax, 0x46caf6
test dl, 0x46
invalid

Function at 0x42e864
Capabilities:
Hash data using murmur3

Disassembly:
sub ebx, esp
dec edx
xor dword [0x46c880], ecx
add bh, dh
rol byte [edi - 0x7bcaf62f], 1
retf 0x46
xchg ecx, edx
not eax
inc edx
add ebx, esp
sub esi, 0xf21dbdce
xor edx, edi
dec eax
call fcn.0040cd8c
rol ebx, 0x16
xor edx, 0x3a8171fc
push edx
xchg edi, edx
or edi, dword [0x46ccb4]
xor esi, edi
xor edx, edi
add ebx, esi
add ebx, dword [0x46cf90]
and dword [0x46cb84], esi
ror edx, 1
xchg esi, edx
dec edx
and dword [0x46c910], ebx
xor esi, ecx
or ecx, dword [0x46cc07]
ror ecx, 8
and dword [0x46cb42], eax
add dword [0x46cba8], eax
retf
inc esi
add cl, al
ror dword [eax], 0x33
int1
inc edx
xchg esi, edx
rol edx, 1
and dword [0x46c9c4], eax
sub ebx, esi
xor edx, edi
xor esi, edi
xchg edi, edx
mov edx, 0xc44d717a
dec edi
sub eax, edi
xchg edx, eax
ror eax, 0xa
call fcn.0043fd75
xchg ecx, eax
mov dword [0x46c9af], esi
sub edx, dword [0x46cf8a]
mov dword [0x46cad8], ecx
add dword [0x46c9ce], ecx
inc esi
add byte [edi - 0x2cc2fc10], al
int 0x46
add byte [edi - 0x37c2f610], al
leave
inc esi
add byte [ecx], ah
or eax, 0x46c89c
Function at 0x42e916
Capabilities:
Hash data using murmur3

Disassembly:
inc esi
add byte [edi - 0x2cc2fc10], al
int 0x46
add byte [edi - 0x37c2f610], al
leave
inc esi
add byte [ecx], ah
or eax, 0x46c89c
xchg ecx, eax
rol eax, 0xa
xchg edx, eax
add eax, edi
inc edi
add edx, 0xc9098f29
dec ecx
ror ecx, 0x1a
xor ebx, ebp
sub dword [0x46c991], 0x2ef7d7d6
add dword [0x46cba3], eax
xor edi, 0x8077c23d
sub edi, dword [0x46ccf1]
call fcn.00408c04
xor edi, dword [0x46cdde]
sub ebx, 0x216b5e05
add edx, 0x458494c9
add dword [0x46c8ec], eax
rol eax, 0x11
xor ecx, ebp
xor edi, dword [0x46cefe]
add eax, dword [0x46cc7a]
not esi
xor ecx, dword [0x46cd4c]
call fcn.004308f5
not esi
xor ecx, ebp
ror eax, 0x11
sub edx, 0x458494c9
add ebx, 0x216b5e05
call fcn.0043569b
xor edi, 0x8077c23d
xor dword [0x46c9d8], 0x5864ee23
xor ebx, ebp
rol ecx, 0x1a
inc ecx
xor edx, 0xbf646cc6
or dword [0x46ca69], ecx
ror ebx, 0x1b
sub dword [0x46cbe2], 0xc8c15a7f
neg edi
xchg esi, edx
not edx
call 0x429ede
add dword [0x46ca6d], ebx
xor esi, edi
rol edi, 0x18
not esi
mov dword [0x46c82e], 0xc716c35d
rol edi, 0x1e
sub ecx, ebx
not esi
sub ebx, ebp
inc esi
or eax, dword [0x46ce09]
sub ebx, dword [0x46ce68]
sub ebx, dword [0x46cdf9]

Function at 0x42ea42
Capabilities:
Hash data using murmur3

Disassembly:
ror edi, 0x18
xor esi, edi
movzx edi, byte [esi - 2]
movzx eax, byte [edx - 2]
sub edi, eax
je 0x42ffc3
xor ecx, ecx
test edi, edi
setg cl
lea ecx, [ecx*2 - 1]
jmp 0x42ffe1
movzx ecx, byte [esi - 1]
movzx eax, byte [edx - 1]
sub ecx, eax
je 0x42ffe1
xor eax, eax
test ecx, ecx
setg al
lea ecx, [eax*2 - 1]
jmp 0x42ffe1
test ecx, ecx
jne 0x42ffe7
xor ecx, ecx
mov eax, ecx
pop edi
jmp 0x4308f2
pop esi
pop ebx
pop ebp
Function at 0x42ea47
Capabilities:
Hash data using murmur3

Disassembly:
call fcn.00420fae
not edx
xchg esi, edx
neg edi
rol ebx, 0x1b
push edx
dec esi
call fcn.00431bf8
rol edx, 0xd
sub edi, eax
not edx
rol ebx, 0x1d
xor eax, 0xf489df81
call fcn.0040cd8c
xchg ecx, edx
xor edi, dword [0x46cd05]
add eax, dword [0x46cee4]
call fcn.004430b7
xor esi, 0x4213c8d1
call fcn.0043d5af
xor esi, 0x4213c8d1
call fcn.0041ab7f
xchg ecx, edx
call fcn.00428f31
xor eax, 0xf489df81
ror ebx, 0x1d
not edx
add edi, eax
ror edx, 0xd
call fcn.0043a591
inc esi
mov ecx, 0x47e80102
or ecx, dword [0x46cf3a]
dec eax
add edx, dword [0x46cbfe]
sub dword [0x46ca1f], esi
or eax, dword [0x46cf90]
not ecx
add ebx, dword [0x46cd9a]
or esi, dword [0x46cdf5]
xor dword [0x46cb51], 0x45696b87
xor ecx, dword [0x46cd5d]
inc ebx
not edx
xor esi, 0xd6ea0c4b
rol eax, 0xc
add edx, ebx
sub dword [0x46c9ce], eax
or dword [0x46c979], edx
sub edx, dword [0x46ce2b]
sub dword [0x46cba0], 0x4f313ece
and dword [0x46caf2], ecx
add dword [0x46c829], esi
sub edx, ebx
ror eax, 0xc
xor esi, 0xd6ea0c4b
not edx
dec ebx
mov dword [0x46cb3c], 0xc1ee4843
not ecx
inc eax
add ecx, 0x39d08588
or dword [0x46c862], 0xf9aca4c
dec eax
neg esi
xor edx, 0xef53d88f
sub ebx, edx
add dword [0x46ca30], edx
or dword [0x46cae0], 0xb8957cf9
xchg ecx, esi
call fcn.0042678b
not esi
or dword [0x46c889], 0x24175d09
or dword [0x46ca1c], edx
xor ecx, 0x426c062d
or esi, dword [0x46cf7a]
sub ebx, ecx
or dword [0x46cb11], edx
call fcn.004308f5
add ebx, ecx
xor ecx, 0x426c062d
and dword [0x46c922], 0xe99d6132
not esi
call fcn.0043d140
xchg ecx, esi
add dword [0x46c9f5], eax
add ebx, edx
xor edx, 0xef53d88f
neg esi
inc eax
sub ecx, 0x1346211f
xor edi, ecx
inc edx
sub ecx, dword [0x46cc8a]
inc esi
xor dword [0x46cb36], ecx
or eax, 0x46cb36
or edx, dword [0x46cc85]
not eax
add dword [0x46ca97], ebx
add ebx, dword [0x46cf5b]
rol esi, 6
and dword [0x46c9e4], esi
add esi, ecx
inc eax
dec edx
add dword [0x46ca3f], ebx
not esi
xor esi, edx
sub edi, ebx
Function at 0x4400c9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46c6d0
push str.AdvApi32.dll
call fcn.004038f8
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x44010c
push str.SystemFunction040
push dword [0x46c6d0]
call edi
push str.SystemFunction041
push dword [0x46c6d0]
mov dword [0x46c6c0], eax
call edi
mov dword [0x46c6c4], eax
jmp 0x440111
mov eax, dword [0x46c6c4]
cmp dword [0x46c6c0], 0
je 0x440122
test eax, eax
jne 0x4401c9
push 0x46c6d4
push str.Crypt32.dll
call fcn.004038f8
mov esi, eax
test esi, esi
js 0x4401d3
push str.CryptProtectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c0], 0
mov dword [0x46c6c8], eax
jne 0x440187
test eax, eax
jne 0x440187
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440178
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work138_s_srclibsdutilcryputil.cpp
call fcn.004038f5
jmp 0x4401d3
push str.CryptUnprotectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c4], 0
mov dword [0x46c6cc], eax
jne 0x4401c9
test eax, eax
jne 0x4401c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4401bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4401c4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x44017b
mov dword [0x46c6d8], 1
pop edi
mov eax, esi
pop esi
Function at 0x440714
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x46b008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [str.unknown]
mov eax, 0x104
push edi
push eax
mov dword [ebp - 0x424], eax
xor ebx, ebx
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x420], ebx
push eax
push ebx
mov dword [ebp - 0x41c], ebx
mov dword [ebp - 0x418], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, 0x208
test eax, eax
jne 0x440778
push edi
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.0042f710
add esp, 0xc
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00444ea2
test eax, eax
jns 0x4407a2
mov dword [ebp - 0x420], ebx
mov dword [ebp - 0x41c], ebx
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x4407c8
lea eax, [ebp - 0x414]
mov byte [eax], bl
inc eax
sub edi, 1
jne 0x4407c0
push ebx
lea eax, [ebp - 0x418]
push eax
call fcn.00448ab6
push dword [ebp - 0x418]
push str._Logging_started:__ls_
push 2
pop edi
push edi
call fcn.00440b3e
mov ecx, dword [ebp - 0x41c]
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
mov ecx, dword [ebp - 0x420]
movzx eax, cx
push eax
shr ecx, 0x10
lea eax, [ebp - 0x20c]
push ecx
push eax
push str.Executable:__ls_v_d._d._d._d
push edi
call fcn.00440b3e
lea eax, [ebp - 0x414]
push eax
push str.Computer__:__ls
push edi
call fcn.00440b3e
mov eax, dword [0x46b878]
add esp, 0x34
sub eax, ebx
je 0x440869
sub eax, 1
je 0x440861
sub eax, 1
je 0x440859
sub eax, 1
je 0x440851
sub eax, 1
jne 0x44086f
mov esi, dword [str.debug]
jmp 0x44086f
mov esi, dword [str.verbose]
jmp 0x44086f
mov esi, dword [str.standard]
jmp 0x44086f
mov esi, dword [str.warning]
jmp 0x44086f
mov esi, dword [str.none]
push esi
push str.____logging_level:__hs____
push edi
call fcn.00440b3e
add esp, 0xc
cmp dword [ebp - 0x418], 0
pop edi
pop esi
pop ebx
je 0x440895
push dword [ebp - 0x418]
call fcn.0040278d
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.0042de30
leave
ret

Function at 0x440b7c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor esi, esi
xor edi, edi
and dword [ebp - 4], esi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [0x46b874]
mov dword [ebp + 8], eax
cmp ecx, 0xffffffff
jne 0x440bb8
push edi
push ebx
push 0x46c6e8
call fcn.004024a9
mov esi, eax
test esi, esi
js 0x440c0f
xor esi, esi
jmp 0x440c0f
test eax, eax
je 0x440c0f
push 0
lea edx, [ebp - 4]
sub eax, edi
push edx
push eax
lea eax, [edi + ebx]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x440bed
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440beb
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440bff
add edi, dword [ebp - 4]
mov eax, dword [ebp + 8]
cmp edi, eax
jae 0x440c0f
mov ecx, dword [0x46b874]
jmp 0x440bbc
push esi
push 0x310
push str.c:_agent_work138_s_srclibsdutillogutil.cpp
call fcn.004038f5
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x440d4f
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
xor ebx, ebx
lea eax, [ebp - 0x58]
push 0x44
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.0042f710
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x440d81
mov eax, 0x44b524
push eax
push dword [ebp + 8]
lea eax, [ebp - 4]
push str.__ls___ls
push eax
call fcn.0040204d
mov esi, eax
add esp, 0x10
test esi, esi
js 0x440e04
mov cx, word [ebp + 0x10]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x58], 0x44
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 4]
mov word [ebp - 0x28], cx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x440df9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440de0
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440de7
mov esi, 0x80004005
push esi
push 0xcd
push str.c:_agent_work138_s_srclibsdutilprocutil.cpp
call fcn.004038f5
jmp 0x440e04
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x14], ebx
mov dword [eax], ecx
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x10], ebx
je 0x440e17
push dword [ebp - 0x10]
call edi
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x14], ebx
je 0x440e24
push dword [ebp - 0x14]
call edi
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 4], ebx
je 0x440e31
push dword [ebp - 4]
call fcn.0040278d
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x10

Function at 0x443ed2
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x46b008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
xor ebx, ebx
mov word [ebp - 8], 0x500
push eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
call fcn.00444061
cmp dword [ebp - 0x14], ebx
je 0x443f0e
mov dword [esi], 1
jmp 0x443f42
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [esi], eax
test eax, eax
je 0x443f42
push esi
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x443f42
mov dword [esi], ebx
cmp dword [ebp - 0x10], 0
pop esi
pop ebx
je 0x443f52
push dword [ebp - 0x10]
call fcn.0040278d
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.0042de30
leave
ret 4
Function at 0x443f62
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x46b008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x11c]
push edi
mov edi, dword [ebp + 0xc]
push pe_nt_image_headers32
push 0
push eax
call fcn.0042f710
mov eax, dword [0x46c7bc]
add esp, 0xc
test eax, eax
jne 0x444048
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
movzx ecx, word [ebp - 0xc]
movzx eax, word [ebp - 0xa]
shl ecx, 0x10
or ecx, eax
cmp dword [ebp - 0x11c], 4
mov dword [0x46c7c0], ecx
jne 0x443fd8
xor eax, eax
inc eax
jmp 0x444043
cmp dword [ebp - 0x11c], 5
jne 0x444009
mov ecx, dword [ebp - 0x118]
test ecx, ecx
jne 0x443fef
push 2
jmp 0x444042
cmp ecx, 1
jne 0x443ff8
push 3
jmp 0x444042
xor eax, eax
cmp ecx, 2
setne al
dec eax
and eax, 0xfffffffb
add eax, 9
jmp 0x444043
cmp dword [ebp - 0x11c], 6
jne 0x444040
cmp dword [ebp - 0x118], 0
jne 0x444029
xor eax, eax
cmp byte [ebp - 6], 1
setne al
add eax, 5
jmp 0x444043
cmp dword [ebp - 0x118], 1
jne 0x444040
xor eax, eax
cmp byte [ebp - 6], 1
setne al
add eax, 7
jmp 0x444043
push 9
pop eax
mov dword [0x46c7bc], eax
mov ecx, dword [ebp - 4]
mov dword [esi], eax
xor ecx, ebp
mov eax, dword [0x46c7c0]
mov dword [edi], eax
pop edi
pop esi
call fcn.0042de30
leave
ret 8
Function at 0x444322
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1018
call fcn.0044a320
mov eax, dword [0x46b008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x18]
push esi
push edi
xor esi, esi
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
xor ecx, ecx
mov dword [ebp - 0x1018], eax
mov dword [ebp - 0x1010], ecx
cmp dword [ebp + 0x10], 0
jne 0x444370
cmp dword [ebp + 0x14], 0
jne 0x444370
mov eax, 0x1000
jmp 0x44439b
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
sub eax, edi
sbb edx, ecx
test edx, edx
jb 0x444395
ja 0x444387
cmp eax, 0x1000
jbe 0x444395
and dword [ebp - 0x1008], 0
mov eax, 0x1000
jmp 0x44439b
mov dword [ebp - 0x1008], edx
push 0
lea ecx, [ebp - 0x1008]
mov dword [ebp - 0x1008], eax
push ecx
push eax
lea eax, [ebp - 0x1004]
push eax
push dword [ebp - 0x1014]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x44441b
mov eax, dword [ebp - 0x1008]
test eax, eax
je 0x4443eb
push eax
lea eax, [ebp - 0x1004]
push eax
push dword [ebp - 0x1018]
call fcn.00445269
mov esi, eax
test esi, esi
js 0x444449
mov eax, dword [ebp - 0x1008]
mov ecx, dword [ebp - 0x1010]
add edi, eax
adc ecx, 0
mov dword [ebp - 0x1010], ecx
cmp ecx, dword [ebp + 0x14]
ja 0x444410
jb 0x444408
cmp edi, dword [ebp + 0x10]
jae 0x444410
test eax, eax
jne 0x44435d
test ebx, ebx
je 0x444449
mov dword [ebx], edi
mov dword [ebx + 4], ecx
jmp 0x444449
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x444432
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x444439
mov esi, 0x80004005
push esi
push 0x40f
push str.c:_agent_work138_s_srclibsdutil_fileutil.cpp
call fcn.004038f5
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042de30
leave
ret 0x14