joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d97f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
push SysReAllocStringLen
push dword [ebp + 8]
call fcn.0041d8ff
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 4], eax
je 0x41da16
push esi
push eax
call fcn.0041d95d
mov esi, dword [ebp + 0x10]
test esi, esi
pop ecx
mov dword [ebp - 8], eax
je 0x41d9b1
mov dword [esi], eax
jmp 0x41d9b4
lea esi, [ebp - 8]
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x41d9da
add eax, 0x10
push eax
lea ecx, [ebp + 0xc]
call fcn.00446080
mov edi, dword [ebp + 0xc]
and dword [ebp + 0xc], 0
lea ecx, [ebp + 0xc]
call fcn.0043f290
test edi, edi
je 0x41da0a
and dword [ebp + 0xc], 0
push 0
lea eax, [ebp + 0xc]
push eax
push dword [esi]
push edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp + 0xc]
test eax, eax
jge 0x41d9f9
xor eax, eax
push 6
mov dword [esi], eax
add eax, edi
push 0
push eax
call fcn.004afe00
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
jmp 0x41da19
mov edi, dword [ebp + 0xc]
mov eax, edi
pop edi
leave
ret

Function at 0x41da1e
Capabilities:
Delete file

Disassembly:
mov eax, 0x4e4a30
call fcn.004afe60
sub esp, 0xc
push esi
push edi
mov esi, 0x5194ec
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
and dword [ebp - 4], 0
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
call fcn.00415774
pop ecx
push dword [ebp + 8]
mov byte [ebp - 0x14], al
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp byte [ebp - 0x14], 0
mov edi, eax
je 0x41da6b
push dword [ebp - 0x18]
call fcn.00415785
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x41e138
Capabilities:
Parse pe header

Disassembly:
cmp dword [esp + 8], 0x40
jb 0x41e14d
mov eax, dword [esp + 4]
mov dword [ecx + 0xc], eax
cmp word [eax], 0x5a4d
je 0x41e151
xor eax, eax
jmp 0x41e1bc
mov edx, dword [eax + 0x3c]
push esi
lea esi, [edx + 0xf8]
cmp dword [esp + 0xc], esi
jae 0x41e165
xor eax, eax
jmp 0x41e1bb
add eax, edx
mov dword [ecx + 0x10], eax
cmp dword [eax], 0x4550
jne 0x41e161
mov dx, word [eax + 0x16]
test dh, 0x20
je 0x41e161
test dl, 2
je 0x41e161
cmp word [eax + 0x14], 0xe0
jne 0x41e161
mov esi, dword [ecx + 0x10]
add eax, 0xf8
xor edx, edx
mov dword [ecx + 0x14], eax
cmp word [esi + 6], dx
jbe 0x41e1b8
add eax, 0x10
mov esi, dword [eax + 4]
add esi, dword [eax]
cmp esi, dword [esp + 0xc]
ja 0x41e161
mov esi, dword [ecx + 0x10]
movzx esi, word [esi + 6]
inc edx
add eax, 0x28
cmp edx, esi
jl 0x41e19e
xor eax, eax
inc eax
pop esi
ret 8
Function at 0x41e2ed
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
cmp dword [0x51908c], ebx
push esi
je 0x41e353
cmp byte [ebp + 8], bl
je 0x41e353
mov eax, dword [0x5191e8]
cmp word [eax], bx
je 0x41e353
test byte [0x519434], 2
mov esi, eax
je 0x41e334
push ebx
lea ecx, [ebp - 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push esi
push dword [0x51908c]
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
jmp 0x41e353
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
lea ecx, [ebp - 4]
push ecx
shl eax, 1
push eax
push esi
push dword [0x51908c]
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, 0x10000
push esi
mov ecx, 0x5191e8
call fcn.004462b0
mov eax, dword [0x5191e8]
mov word [eax], bx
mov dword [0x5191f0], esi
pop esi
mov dword [0x5191ec], ebx
pop ebx
leave
ret

Function at 0x41e81c
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
xor esi, esi
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
cmp dword [ebp + 0x10], esi
je 0x41e854
cdq
jmp 0x41e867
cmp dword [ebp + 0xc], esi
je 0x41e861
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
jmp 0x41e867
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
pop esi
leave
ret

Function at 0x41ead8
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x4e4ab0
call fcn.004afe60
push ecx
push ebx
push esi
mov esi, ecx
lea ecx, [esi + 0x68]
mov dword [ebp - 0x10], esi
call fcn.0041d325
xor ebx, ebx
lea ecx, [esi + 0x90]
mov dword [ebp - 4], ebx
call fcn.00446250
lea ecx, [esi + 0x94]
mov byte [ebp - 4], 1
call fcn.00446060
mov ecx, dword [ebp - 0xc]
mov eax, SysReAllocStringLen
mov dword [esi + 0x48], eax
mov dword [esi + 0xa0], eax
mov dword [esi + 0x9c], eax
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xb4], ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov word [esi + 0x98], bx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
mov dword [esi + 0xb0], ebx
mov byte [esi + 0xa4], bl
mov dword [esi + 0x4c], ebx
mov byte [esi + 0x80], bl
mov dword [esi + 0xbc], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0xa8], ebx
mov dword [esi + 0xac], ebx
mov dword [esi + 0xc0], 0x12d
mov word [esi + 0xc4], 0x131
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x41ecf1
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ebp, dword [esp + 0x38]
mov esi, eax
add esi, ebp
xor ebx, ebx
cmp ebp, 0x4e20
jb 0x41ed19
push ebx
call fcn.004412a0
pop ecx
cmp ebp, ebx
jg 0x41ed96
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41eda0
cmp byte [0x5152e8], bl
jle 0x41eda0
cmp ecx, 0x7d0
jbe 0x41ed3d
mov ecx, 0x3e8
jmp 0x41ed45
cmp ecx, 0x64
jbe 0x41ed45
push 0x64
pop ecx
push 0x4bf
push ecx
push ebx
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
jmp 0x41ed8e
call edi
mov ecx, esi
sub ecx, eax
test ecx, ecx
jle 0x41ed96
push 3
push ebx
push ebx
push ebx
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x41ed96
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp byte [0x5152e8], bl
jg 0x41ed5a
call edi
mov ecx, esi
sub ecx, eax
cmp ecx, ebx
jg 0x41ed26
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret 4

Function at 0x41edac
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
push ebx
push esi
push edi
push 0x325
lea ecx, [ebp - 8]
call fcn.00446280
mov esi, dword [ebp - 8]
push esi
push 0x324
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov ebx, dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_CharUpperW]
push ebx
call edi
push esi
call edi
cmp word [esi], 0
je 0x41ee40
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
add eax, 0x10
mov dword [ebp - 0xc], eax
push esi
call fcn.0041e86a
cmp eax, dword [ebp - 0xc]
pop ecx
jb 0x41ee2f
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
dec eax
dec eax
je 0x41ee29
dec eax
jne 0x41ee2f
mov ax, word [esi]
mov word [edi + 2], ax
mov cx, word [esi]
xor eax, eax
inc eax
cmp cx, word [ebx]
mov dword [ebp - 4], eax
jb 0x41ee2f
mov esi, eax
jmp 0x41ee43
mov ax, word [esi]
mov word [edi], ax
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esi + eax*2 + 2]
cmp word [esi], 0
jne 0x41edf6
mov esi, dword [ebp - 4]
lea ecx, [ebp - 8]
call fcn.0043f290
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x41f3c6
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push esi
push edi
mov esi, 0x4f0594
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
mov byte [ebp - 1], 0
mov byte [ebp - 2], 0
mov edi, 0x519150
movsx ax, byte [ebp - 2]
add eax, 0x41
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 5
jne 0x41f460
movsx ebx, byte [ebp - 1]
lea eax, [ebp - 0x10]
push eax
push ebx
lea eax, [ebp - 0x218]
push str.HKLMSYSTEMCurrentControlSetControlSession_ManagerEnvironmentCDROM_u_s
push eax
call esi
add esp, 0x10
push 0
lea eax, [ebp - 0x218]
push eax
mov ecx, edi
call fcn.0046f690
lea eax, [ebp - 0x10]
push eax
push ebx
lea eax, [ebp - 0x218]
push str.CDROM_u
push eax
call esi
add esp, 0x10
inc byte [ebp - 1]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x218]
push eax
mov ecx, edi
call fcn.00444550
inc byte [ebp - 2]
cmp byte [ebp - 2], 0x1a
jl 0x41f3f0
cmp byte [ebp - 1], 0
pop edi
pop esi
pop ebx
jle 0x41f484
mov ecx, dword [ebp + 8]
xor eax, eax
push eax
push eax
push eax
push str.THREAD_Envi
call fcn.00435957
leave
ret

Function at 0x41f754
Capabilities:
Check mutex on windows

Disassembly:
push esi
push dword [esp + 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x41f772
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, esi
pop esi
ret
Function at 0x41f7e1
Capabilities:
Persist via run registry key

Disassembly:
mov eax, 0x4e5073
call fcn.004afe60
sub esp, 0xc
add dword [ebp + 8], 2
push esi
push edi
lea ecx, [ebp - 0x14]
call fcn.00446250
xor esi, esi
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], esi
call fcn.00446250
push 0x2c
push dword [ebp + 8]
mov byte [ebp - 4], 1
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov edi, eax
cmp edi, esi
je 0x41f8d0
push ebx
push 1
push esi
lea eax, [ebp - 0x14]
mov word [edi], si
push eax
push dword [ebp + 8]
mov esi, 0x519150
mov ecx, esi
call fcn.00453300
mov ebx, dword [ebp - 0x14]
push 1
push 0
lea eax, [ebp - 0x10]
push eax
add edi, 2
push edi
mov ecx, esi
mov dword [ebp + 8], ebx
call fcn.00453300
cmp byte [ebp + 0xc], 0
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x18], esi
je 0x41f887
lea ecx, [ebp + 8]
call fcn.0041d38d
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
push dword [ebp + 8]
push 1
push esi
push 0x4efb58
push SysReAllocStringLen
jmp 0x41f8c3
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
call esi
shl eax, 1
push eax
push ebx
push 1
push str.RegisteredOwner
mov edi, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push edi
mov ebx, SysReAllocStringLen
push ebx
call fcn.004402a0
add esp, 0x18
push dword [ebp - 0x18]
call esi
shl eax, 1
push eax
push dword [ebp - 0x18]
push 1
push str.RegisteredOrganization
push edi
push ebx
call fcn.004402a0
add esp, 0x18
xor esi, esi
pop ebx
jmp 0x41f8d3
xor esi, esi
inc esi
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0
call fcn.0043f290
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0043f290
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x41fe18
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
test edi, edi
jge 0x41fe29
call fcn.0041fdbd
mov edi, eax
mov eax, dword [esp + 0x14]
test eax, eax
mov esi, dword [esp + 0xc]
jg 0x41fe3d
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
dec eax
js 0x41fe49
inc eax
xor word [esi], di
inc esi
inc esi
dec eax
jne 0x41fe41
mov eax, edi
pop edi
shl eax, 0x10
pop esi
ret
Function at 0x41ff9a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2e0
and dword [ebp - 8], 0
or dword [ebp - 4], 0xffffffff
and dword [ebp - 0x10], 0
cmp byte [0x519208], 0
mov dword [ebp - 0xc], 4
jne 0x420061
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
mov ebx, str.SysStartuped
push ebx
mov edi, str.SOFTWAREPELOGON
push edi
mov esi, SysReAllocStringLen
push esi
mov byte [0x519208], 1
call fcn.00440200
add esp, 0x18
cmp dword [ebp - 8], 0
jne 0x42005e
push 1
push 0x25
lea eax, [ebp - 0x2e0]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.SysStartup.ini
lea eax, [ebp - 0x2e0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x2e0]
push eax
call fcn.004abec0
test eax, eax
pop ecx
je 0x420036
mov dword [ebp - 4], 1
push 4
lea eax, [ebp - 4]
push eax
push 4
push ebx
push edi
push esi
call fcn.004402a0
add esp, 0x18
cmp dword [ebp - 4], 1
jne 0x42005e
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x2e0]
push eax
call fcn.004316cd
pop edi
pop esi
pop ebx
leave
ret

Function at 0x420133
Capabilities:
Log keystrokes via application hook

Disassembly:
cmp dword [0x519070], 0
jne 0x420156
push 0
push dword [0x51907c]
push 0x420063
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x519070], eax
ret

Function at 0x42054b
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push ebx
push esi
mov esi, dword [ebp + 8]
test esi, esi
push edi
jne 0x420566
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
push esi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x22c], 0x22c
mov dword [ebp - 0x228], ebx
mov ecx, 0x89
lea edi, [ebp - 0x224]
push 2
rep stosd dword es:[edi], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
lea eax, [ebp - 0x22c]
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x4205b5
cmp dword [ebp - 0x224], esi
je 0x4205bb
lea eax, [ebp - 0x22c]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4205a0
jmp 0x4205c1
mov ebx, dword [ebp - 0x214]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
dec dword [ebp + 0xc]
cmp dword [ebp + 0xc], 0
mov esi, ebx
jg 0x420566
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x4206ae
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
push edi
je 0x4206d2
cmp dword [ebp + 0xc], 2
jne 0x420701
mov edi, dword [ebp + 0x14]
push 0x104
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x4206d5
mov edi, dword [ebp + 0x10]
cmp dword [ebp + 0x18], 0
je 0x4206e5
push dword [ebp + 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [esi + 2]
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push edi
push esi
mov ecx, 0x519150
call fcn.00444550
pop esi
pop edi
pop ebp
ret
Function at 0x4207ac
Capabilities:
Set environment variable

Disassembly:
mov eax, 0x4e4ac2
call fcn.004afe60
push ecx
push ebx
push esi
push edi
push 0x411
lea ecx, [ebp - 0x10]
mov byte [0x51915d], 1
call fcn.00446280
xor esi, esi
push 0x822
push esi
push dword [ebp - 0x10]
mov dword [ebp - 4], esi
call fcn.004afe00
mov edi, dword [ebp - 0x10]
add esp, 0xc
push 0x104
add edi, 0x410
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.PE_IDBASE
push 0x1000
mov esi, 0x519150
push esi
call fcn.00448b60
push str.WM_PE_BASE
push 0x5000
push esi
call fcn.00448b60
push str.PE_MENU_IDBASE
push 0x100
push esi
call fcn.00448b60
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add esp, 0x24
push edi
push 0x4f08e2
call esi
push edi
mov ebx, 0x519150
push str.MyName
mov ecx, ebx
call fcn.00444550
push 0x5c
push 0
push edi
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
xor edi, edi
cmp eax, edi
je 0x42087d
lea edi, [eax + 2]
push edi
push 0x4f08ce
call esi
push edi
push str.MyName0
mov ecx, ebx
call fcn.00444550
xor edi, edi
push edi
push edi
push str.Desktop
call fcn.00420704
push edi
push edi
push str.Favorites
call fcn.00420704
push edi
push edi
push str.Programs
call fcn.00420704
push edi
push edi
push str.SendTo
call fcn.00420704
push edi
push edi
push str.Personal
call fcn.00420704
push edi
push str.Start_Menu
push 0x4effa4
call fcn.00420704
add esp, 0x48
push edi
push str.Cache
push str.IECache
call fcn.00420704
push edi
push edi
push str.Startup
call fcn.00420704
push str.MicrosoftInternet_ExplorerQuick_Launch
push str.AppData
push str.QuickLaunch
call fcn.00420704
or dword [ebp - 4], 0xffffffff
add esp, 0x24
lea ecx, [ebp - 0x10]
call fcn.0043f290
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x420975
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x14b8
call fcn.004af1d0
push esi
mov esi, 0x5152ec
and word [ebp - 0x14b8], 0
mov edx, dword [esi]
mov word [ebp - 0x64], 0x26
lea ecx, [ebp - 0x62]
movsx ax, byte [edx]
mov word [ecx], ax
inc ecx
inc ecx
inc edx
test ax, ax
jne 0x42099b
push 0xa28
lea eax, [ebp - 0x14b8]
push eax
lea eax, [ebp - 0x62]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [ebp - 0x14b8]
push eax
lea eax, [ebp - 0x64]
push eax
mov ecx, 0x519150
call fcn.00444550
add esi, 4
cmp esi, 0x515300
jl 0x420988
pop esi
leave
ret
Function at 0x4215b7
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x4e4a1e
call fcn.004afe60
sub esp, 0x8c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 6
pop ecx
mov esi, str.format.com
lea edi, [ebp - 0x98]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
call esi
push dword [ebp + 8]
mov edi, eax
call esi
add eax, edi
lea eax, [eax + eax + 0x1a]
add eax, 0x1e
push eax
lea ecx, [ebp - 0x14]
call fcn.00446080
mov edx, dword [ebp - 0x14]
and dword [ebp - 4], 0
push 0x10
pop ecx
xor eax, eax
mov dword [ebp - 0x80], 0x44
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
and word [ebp - 0x50], ax
or dword [ebp - 0x54], 1
lea eax, [ebp - 0x98]
push eax
push edx
mov dword [ebp + 0xc], edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push dword [ebp + 0xc]
call edi
push 0x4ef8e0
push dword [ebp + 0xc]
call edi
cmp word [ebx], 0x22
jne 0x421665
inc ebx
inc ebx
push ebx
call esi
test eax, eax
jle 0x421665
lea eax, [ebx + eax*2 - 2]
cmp word [eax], 0x22
jne 0x421665
and word [eax], 0
push ebx
push dword [ebp + 0xc]
call edi
push 0x4f12d4
push ebx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x421685
push str.__y
push dword [ebp + 0xc]
call edi
mov eax, dword [ebp + 8]
mov ax, word [eax]
mov esi, str..D:
lea edi, [ebp - 0x3c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x18], 8
mov word [ebp - 0x34], ax
mov dword [ebp + 8], 0x12b
mov ebx, 0x519150
xor edi, edi
push edi
push edi
push 3
push edi
push edi
push SysReAllocStringLen
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jne 0x4216e0
push 0x64
mov ecx, ebx
call fcn.0041ecf1
dec dword [ebp + 8]
jns 0x4216ae
jmp 0x4216e3
push eax
call esi
mov dword [ebp - 0x1c], 2
mov dword [ebp + 8], 0x1d
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x80]
push eax
push edi
push edi
push edi
push 1
push edi
push edi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x421723
push str.Cannot_format_drive:
call fcn.00420ed4
dec dword [ebp - 0x1c]
pop ecx
jns 0x421753
push 8
pop esi
jmp 0x421764
push dword [ebp - 0x28]
call esi
push 0xffffffffffffffff
push dword [ebp - 0x2c]
mov dword [ebp - 0x10], edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebp - 0x10]
push dword [ebp - 0x2c]
mov dword [ebp - 0x18], eax
call esi
cmp dword [ebp - 0x10], edi
je 0x421761
push 0x64
mov ecx, ebx
call fcn.0041ecf1
dec dword [ebp + 8]
jns 0x4216f1
mov esi, dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0043f290
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4227c3
Capabilities:
Acquire debug privileges

Disassembly:
cmp byte [esp + 4], 0
push esi
mov esi, ecx
mov byte [esi], 0
je 0x4227f1
test byte [0x519468], 4
jne 0x4227f1
push 2
mov byte [esi], 1
or byte [0x519468], 4
push str.SeDebugPrivilege
call fcn.00420c19
pop ecx
pop ecx
mov eax, esi
pop esi
ret 4

Function at 0x4227f7
Capabilities:
Acquire debug privileges

Disassembly:
cmp byte [ecx], 0
je 0x422811
and byte [0x519468], 0xfb
push 4
push str.SeDebugPrivilege
call fcn.00420c19
pop ecx
pop ecx
ret

Function at 0x422812
Capabilities:
Create directory

Disassembly:
mov eax, 0x4e4b9c
call fcn.004afe60
sub esp, 0xc
push ebx
push esi
push edi
mov edi, 0x5194ec
push edi
mov dword [ebp - 0x10], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
and dword [ebp - 4], 0
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
call fcn.00415774
pop ecx
mov byte [ebp - 0x14], al
mov ebx, dword [sym.imp.SHLWAPI.dll_StrChrW]
push 0x5c
push dword [ebp + 8]
mov byte [ebp - 4], 1
jmp 0x42287d
push dword [ebp + 8]
and word [esi], 0
call fcn.004abc80
test eax, eax
pop ecx
jne 0x422872
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov word [esi], 0x5c
add esi, 2
push 0x5c
push esi
call ebx
mov esi, eax
test esi, esi
jne 0x422857
cmp byte [ebp - 0x14], al
mov byte [ebp - 4], al
je 0x422896
push dword [ebp - 0x18]
call fcn.00415785
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x422955
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 8], 0
jne 0x42297c
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.0041e138
test eax, eax
je 0x42297c
call fcn.0041e1bf
test eax, eax
mov dword [esp + 0xc], eax
jne 0x422983
xor eax, eax
jmp 0x422a45
mov ecx, dword [esi + 0x10]
mov ecx, dword [ecx + 0x34]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push ebp
push edi
push 0x40
mov ebp, 0x3000
push ebp
push eax
push ecx
call ebx
mov edi, eax
test edi, edi
jne 0x4229bb
push 0x40
push ebp
push dword [esp + 0x20]
push eax
call ebx
mov edi, eax
test edi, edi
jne 0x4229bb
xor eax, eax
jmp 0x422a42
push dword [esp + 0x14]
mov ecx, esi
push edi
call fcn.0041e230
mov eax, dword [esi + 0x10]
xor ebx, ebx
cmp dword [eax + 0xa0], ebx
jbe 0x4229e8
cmp dword [eax + 0xa4], ebx
jbe 0x4229e8
push edi
mov ecx, esi
call fcn.0041dffa
test eax, eax
je 0x4229b4
push edi
mov ecx, esi
call fcn.0041e059
test eax, eax
jne 0x422a03
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x4229b4
mov eax, dword [esi + 0x10]
mov dword [eax + 0x34], edi
mov eax, dword [esi + 0x10]
mov eax, dword [eax + 0x28]
push ebx
xor ebp, ebp
inc ebp
push ebp
add eax, edi
push edi
mov dword [esi + 4], eax
call eax
test eax, eax
jne 0x422a3b
push ebx
push ebx
push edi
call dword [esi + 4]
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [esi + 4], ebx
jmp 0x4229b4
mov dword [esi], ebp
mov dword [esi + 8], edi
mov eax, ebp
pop edi
pop ebp
pop ebx
pop esi
ret 8