joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42d442
Capabilities:
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
push ebx
push ebx
push dword [esi + 4]
mov dword [ebp - 8], ebx
push dword [esi]
push dword [ebp + 0xc]
call fcn.004351e4
mov dword [ebp - 4], eax
cmp eax, ebx
jge 0x42d478
push 0x44bb18
push eax
call fcn.00431454
pop ecx
pop ecx
jmp 0x42d5e5
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x42d55e
mov eax, dword [ebp - 8]
cmp eax, ebx
je 0x42d5e4
xor edi, edi
mov dword [ebp - 0xc], ebx
push ebx
lea ecx, [ebp - 0xc]
push ecx
sub eax, edi
push eax
mov eax, dword [ebp + 0x1c]
add eax, edi
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x42d59c
add edi, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
cmp dword [ebp - 0xc], ebx
je 0x42d4d2
cmp edi, eax
jb 0x42d4a4
add dword [esi], edi
adc dword [esi + 4], ebx
cmp dword [ebp + 0x10], 0xffffffff
je 0x42d526
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 0x10]
xor edi, edi
mov dword [ebp - 0x10], ebx
call fcn.004351e4
cmp eax, ebx
jge 0x42d501
push 0x44bb18
push eax
call fcn.00431454
pop ecx
pop ecx
jmp 0x42d526
push ebx
lea eax, [ebp - 0x10]
push eax
push 8
pop eax
sub eax, edi
push eax
lea eax, [esi + edi*8]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_WriteFile]
add edi, dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
je 0x42d526
cmp edi, 8
jb 0x42d501
mov eax, dword [ebp + 0x24]
cmp eax, ebx
je 0x42d550
cmp dword [eax], ebx
je 0x42d550
push dword [ebp + 0xc]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [esi + 4]
push dword [esi]
push eax
call fcn.0042192a
mov dword [ebp - 4], eax
cmp eax, ebx
jl 0x42d5d7
cmp dword [ebp - 8], ebx
jne 0x42d479
jmp 0x42d5e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x42d572
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp eax, ebx
jl 0x42d580
mov dword [ebp - 4], 0x80004005
push dword [ebp - 4]
push 0x1ad
push 0x44bb88
call fcn.00431468
push 0x44bd08
push dword [ebp - 4]
jmp 0x42d5dd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x42d5b0
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp eax, ebx
jl 0x42d5be
mov dword [ebp - 4], 0x80004005
push dword [ebp - 4]
push 0x1b9
push 0x44bb88
call fcn.00431468
push 0x44bce4
jmp 0x42d597
push 0x44bcc6
push eax
call fcn.00431454
pop ecx
pop ecx
pop edi
mov eax, dword [ebp - 4]
pop ebx
leave
ret 0x20
Function at 0x42d7ae
Capabilities:
Connect to http server

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
xor ebx, ebx
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
mov dword [ebp - 4], ebx
rep stosd dword es:[edi], eax
xor esi, esi
mov dword [ebp - 8], esi
cmp dword [ebp - 4], esi
je 0x42d7de
push dword [ebp - 4]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [ebp - 4], esi
cmp ebx, esi
je 0x42d7eb
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
xor ebx, ebx
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp + 0x14]
push dword [eax]
call fcn.00436cd0
mov esi, eax
xor edx, edx
cmp esi, edx
jl 0x42d91a
mov edi, dword [ebp + 0x24]
cmp edi, edx
je 0x42d813
mov ecx, edi
cmp word [edi], dx
jne 0x42d816
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp + 0x20]
cmp esi, edx
je 0x42d824
mov eax, esi
cmp word [esi], dx
jne 0x42d827
mov eax, dword [ebp - 0x18]
push edx
push edx
xor edx, edx
cmp dword [ebp - 0x24], 1
setne dl
lea edx, [edx + edx + 1]
push edx
push ecx
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp + 0x10]
call dword [sym.imp.WININET.dll_InternetConnectW]
mov ebx, eax
test ebx, ebx
je 0x42d929
test esi, esi
je 0x42d88e
cmp word [esi], 0
je 0x42d88e
test edi, edi
je 0x42d88e
cmp word [edi], 0
je 0x42d88e
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
call edi
push eax
push esi
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionW]
push 0x2b
push ebx
call esi
test eax, eax
je 0x42d88e
push dword [ebp + 0x24]
call edi
push eax
push dword [ebp + 0x24]
push 0x2c
push ebx
call esi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x1c]
mov eax, dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x24]
push dword [ebp + 0x18]
push ebx
call fcn.0042d0d0
mov esi, eax
test esi, esi
js 0x42d964
push dword [ebp + 0x30]
mov edi, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0042d5ee
mov esi, eax
test esi, esi
js 0x42d970
cmp dword [ebp - 8], 0
jne 0x42d7c8
mov eax, dword [ebp + 0x28]
mov dword [eax], ebx
mov eax, dword [ebp + 0x2c]
xor ebx, ebx
and dword [ebp - 4], ebx
mov ecx, edi
mov dword [eax], ecx
lea eax, [ebp - 0x24]
push eax
call fcn.00436a9a
cmp dword [ebp - 4], 0
je 0x42d906
push dword [ebp - 4]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
test ebx, ebx
je 0x42d911
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x2c
push 0x44bddc
push esi
call fcn.00431454
pop ecx
pop ecx
jmp 0x42d8ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x42d93d
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
js 0x42d948
mov esi, 0x80004005
push esi
push 0x213
push 0x44bb88
call fcn.00431468
mov eax, dword [ebp + 0x14]
push dword [eax]
push 0x44bdbe
jmp 0x42d97a
mov eax, dword [ebp + 0x14]
push dword [eax]
push 0x44bd9c
jmp 0x42d97a
mov eax, dword [ebp + 0x14]
push dword [eax]
push 0x44bd78
push esi
call fcn.00431454
add esp, 0xc
jmp 0x42d8ee
Function at 0x42dcbe
Capabilities:
Create http request
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
or dword [ebp - 0x10], 0xffffffff
push ebx
push esi
push edi
xor ebx, ebx
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp + 0x18]
push ebx
push dword [edi]
lea eax, [ebp - 8]
push eax
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
call fcn.0042f9d0
mov esi, eax
cmp esi, ebx
jge 0x42dd15
push 0x44bf9e
push esi
call fcn.00431454
pop ecx
pop ecx
jmp 0x42de6f
push ebx
push ebx
push ebx
push ebx
push 0x44bf94
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [ebp - 4], eax
cmp eax, ebx
jne 0x42dd61
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x42dd3f
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, ebx
jl 0x42dd4a
mov esi, 0x80004005
push esi
push 0x93
push 0x44bb88
call fcn.00431468
push 0x44bf74
jmp 0x42dd08
lea eax, [ebp - 0xc]
push eax
push 0x78
push 0x44bf54
push 0x40312c
call fcn.00436d32
mov eax, dword [ebp - 0xc]
cmp eax, ebx
jbe 0x42ddb3
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionW]
imul eax, eax, 0x3e8
push 4
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 2
push dword [ebp - 4]
call esi
push 4
lea eax, [ebp - 0xc]
push eax
push 6
push dword [ebp - 4]
call esi
push 4
lea eax, [ebp - 0xc]
push eax
push 5
push dword [ebp - 4]
call esi
lea eax, [ebp - 0x2c]
push eax
push dword [edi + 8]
lea eax, [ebp - 8]
push dword [edi + 4]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x24]
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.0042d988
mov esi, eax
cmp esi, ebx
jge 0x42ddee
push dword [ebp - 8]
push 0x44bf2a
push esi
call fcn.00431454
add esp, 0xc
jmp 0x42de6f
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0x24]
lea esi, [ebp - 0x1c]
call fcn.0042d2fc
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push dword [ebp - 0x10]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x24]
push dword [edi + 8]
push dword [edi + 4]
push eax
push dword [ebp - 4]
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.0042da48
mov esi, eax
cmp esi, ebx
jge 0x42de4d
push dword [ebp - 8]
push 0x44bf0e
push esi
call fcn.00431454
add esp, 0xc
jmp 0x42de60
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x42de60
cmp word [eax], bx
je 0x42de60
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x10], 0xffffffff
je 0x42de6f
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x14], ebx
je 0x42de7c
push dword [ebp - 0x14]
call fcn.0042ea70
cmp dword [ebp - 4], ebx
je 0x42de8a
push dword [ebp - 4]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
cmp dword [ebp - 8], ebx
je 0x42de97
push dword [ebp - 8]
call fcn.0042ea70
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x20
Function at 0x42e7ca
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
push 0x44
pop esi
xor ebx, ebx
push esi
lea eax, [ebp - 0x58]
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.00408720
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
add esp, 0xc
cmp eax, ebx
jne 0x42e800
mov eax, 0x43b5fe
push eax
push dword [ebp + 8]
lea eax, [ebp - 4]
push 0x43f164
push eax
call fcn.0042ff34
mov edi, eax
add esp, 0x10
cmp edi, ebx
jl 0x42e880
mov ax, word [ebp + 0x10]
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 4]
mov dword [ebp - 0x58], esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x42e875
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x42e858
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jl 0x42e863
mov edi, 0x80004005
push edi
push 0xa6
push 0x44c41e
call fcn.00431468
jmp 0x42e880
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov dword [ebp - 0x14], ebx
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x10], ebx
je 0x42e893
push dword [ebp - 0x10]
call esi
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x14], ebx
je 0x42e8a0
push dword [ebp - 0x14]
call esi
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 4], ebx
je 0x42e8ad
push dword [ebp - 4]
call fcn.0042ea70
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x430646
Capabilities:
Create directory
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
cmp eax, ebx
je 0x43070b
cmp word [eax], bx
je 0x43070b
push ebx
push eax
lea eax, [ebp - 4]
push eax
call fcn.0042f9d0
mov esi, eax
cmp esi, ebx
jl 0x43078e
lea eax, [ebp - 4]
push eax
call fcn.004305ee
mov esi, eax
cmp esi, ebx
jl 0x43078e
mov ebx, dword [ebp + 0x14]
xor edi, edi
inc edi
cmp dword [ebp + 0x10], edi
jb 0x430782
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
call fcn.0042ff34
mov esi, eax
add esp, 0xc
test esi, esi
js 0x43078e
push dword [ebp - 8]
push dword [ebp - 4]
push 0x44c532
push ebx
call fcn.0042ff34
mov esi, eax
add esp, 0x10
test esi, esi
js 0x43078e
xor esi, esi
push esi
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x430782
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x430763
inc edi
mov esi, 0x800700b7
cmp edi, dword [ebp + 0x10]
jbe 0x4306a3
jmp 0x43078e
mov edi, 0x104
push edi
lea eax, [ebp - 4]
push eax
call fcn.0042e95c
mov esi, eax
cmp esi, ebx
jl 0x43078e
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x430694
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x430746
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, ebx
jl 0x430751
mov esi, 0x80004005
push esi
push 0x2cf
push 0x44c4fe
call fcn.00431468
jmp 0x43078e
cmp eax, 3
jne 0x430772
push esi
push dword [ebx]
call fcn.004356f2
jmp 0x430780
cmp eax, esi
jle 0x430780
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
js 0x43078e
push ebx
call fcn.004305ee
mov esi, eax
cmp dword [ebp - 8], 0
je 0x43079c
push dword [ebp - 8]
call fcn.0042ea70
cmp dword [ebp - 4], 0
je 0x4307aa
push dword [ebp - 4]
call fcn.0042ea70
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x10

Function at 0x4307b4
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push esi
mov esi, dword [esp + 0xc]
push 0x104
push esi
call fcn.0042e95c
test eax, eax
js 0x4307e6
push dword [esi]
push 0
push 0
push dword [esp + 0x14]
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x4307e6
push esi
call fcn.004305ee
pop esi
ret 8
Function at 0x430b48
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push edi
xor ebx, ebx
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp dword [0x44fc58], 0xffffffff
mov dword [ebp + 8], eax
jne 0x430b84
push ebx
push edi
push 0x450b74
call fcn.0042fc32
mov ebx, eax
test ebx, ebx
js 0x430bdc
xor ebx, ebx
jmp 0x430bdc
test eax, eax
je 0x430bdc
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
sub eax, esi
push eax
lea eax, [esi + edi]
push eax
push dword [0x44fc58]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x430bc2
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x430bbc
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
js 0x430bcc
add esi, dword [ebp - 4]
cmp esi, dword [ebp + 8]
jb 0x430b88
jmp 0x430bdc
push ebx
push 0x30d
push 0x44c590
call fcn.00431468
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4

Function at 0x43112c
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
lea ebp, [esp - 0x3a4]
sub esp, 0x424
mov eax, dword [0x44f9f8]
xor eax, ebp
mov dword [ebp + 0x3a0], eax
push ebx
push esi
push edi
mov edi, dword [0x44fc60]
mov eax, 0x104
push eax
mov dword [ebp - 0x80], eax
xor ebx, ebx
lea eax, [ebp + 0x198]
push eax
push ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x74], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, 0x208
test eax, eax
jne 0x43118e
push esi
lea eax, [ebp + 0x198]
push ebx
push eax
call fcn.00408720
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x198]
push eax
call fcn.00435016
test eax, eax
jns 0x4311ac
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x7c], ebx
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x4311c7
lea eax, [ebp - 0x70]
mov byte [eax], bl
inc eax
dec esi
jne 0x4311c1
push ebx
lea eax, [ebp - 0x74]
push eax
call fcn.00436e6e
push dword [ebp - 0x74]
xor esi, esi
push 0x44c6cc
inc esi
push esi
call fcn.004310a4
mov eax, dword [ebp - 0x7c]
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
mov eax, dword [ebp - 0x78]
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
lea eax, [ebp + 0x198]
push eax
push 0x44c6ae
push esi
call fcn.004310a4
lea eax, [ebp - 0x70]
push eax
push 0x44c69e
push esi
call fcn.004310a4
mov eax, dword [0x44fc5c]
add esp, 0x34
sub eax, ebx
je 0x431246
dec eax
je 0x43123e
dec eax
je 0x431236
dec eax
jne 0x43124c
mov edi, dword [0x44fc6c]
jmp 0x43124c
mov edi, dword [0x44fc68]
jmp 0x43124c
mov edi, dword [0x44fc64]
jmp 0x43124c
mov edi, dword [0x44fc70]
push edi
push 0x44c682
push esi
call fcn.004310a4
add esp, 0xc
cmp dword [ebp - 0x74], ebx
pop edi
pop esi
pop ebx
je 0x43126b
push dword [ebp - 0x74]
call fcn.0042ea70
mov ecx, dword [ebp + 0x3a0]
xor ecx, ebp
xor eax, eax
call fcn.00408498
add ebp, 0x3a4
leave
ret
Function at 0x43154c
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x44f9f8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00408720
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x4315e4
push 0x5c
pop ecx
cmp cx, word [ebp + eax*2 - 0x20e]
je 0x4315bb
push 1
push 0x44c53c
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.004314fe
mov edi, eax
test edi, edi
js 0x431603
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.004314be
mov edi, eax
test edi, edi
js 0x431603
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebx], eax
test eax, eax
jne 0x431603
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4315f8
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test edi, edi
js 0x431603
mov edi, 0x80004005
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408498
leave
ret 8
Function at 0x4341b2
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor ebx, ebx
push edi
push 0x44c978
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
cmp edi, ebx
jne 0x43422c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x4341ef
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jl 0x4341fa
mov edi, 0x80004005
push edi
push 0x8d
push 0x44c928
call fcn.00431468
mov eax, dword [ebp - 8]
test eax, eax
je 0x434217
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 4]
test eax, eax
je 0x434224
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, edi
pop edi
pop ebx
leave
ret 0xc
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x44c464
push edi
call esi
test eax, eax
je 0x43427e
push 0x44c474
push edi
call esi
push 0x44c95a
push edi
mov ebx, eax
call esi
push 0x44c494
push edi
mov dword [ebp - 0xc], eax
call esi
mov dword [ebp - 0x14], eax
test ebx, ebx
je 0x43426d
cmp dword [ebp - 0xc], 0
je 0x43426d
test eax, eax
jne 0x434271
xor ebx, ebx
jmp 0x43427e
lea eax, [ebp - 0x10]
push eax
call ebx
push 1
call dword [ebp - 0xc]
mov ebx, eax
lea eax, [ebp - 4]
push eax
push 0x4026d0
push 1
push 0
mov esi, 0x450c2c
push esi
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test edi, edi
js 0x43431a
push 0x10
push 0x4026c0
push esi
call fcn.00409228
add esp, 0xc
test eax, eax
je 0x4342c5
push 0x10
push 0x4026b0
push esi
call fcn.00409228
add esp, 0xc
test eax, eax
jne 0x4342cf
mov dword [0x450c48], 1
cmp dword [ebp + 8], 0
je 0x4342fe
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.00433f2c
mov edi, eax
test edi, edi
js 0x43431a
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push 0
push dword [ebp - 8]
push eax
call dword [ecx + 0x54]
mov edi, eax
test edi, edi
js 0x43431a
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
and dword [ebp - 4], 0
mov dword [ecx], eax
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x43431a
mov ecx, dword [ebp - 8]
and dword [ebp - 8], 0
mov dword [eax], ecx
pop esi
test ebx, ebx
je 0x43420a
push dword [ebp - 0x10]
call dword [ebp - 0x14]
test eax, eax
jne 0x43420a
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x434830
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x120
mov eax, dword [0x44f9f8]
xor eax, ebp
mov dword [ebp + 0x6c], eax
push ebx
mov ebx, dword [ebp + 0x7c]
push edi
mov edi, dword [ebp + 0x78]
push 0x11c
lea eax, [ebp - 0xb0]
push 0
push eax
call fcn.00408720
add esp, 0xc
cmp dword [0x450c50], 0
jne 0x434941
lea eax, [ebp - 0xb0]
push eax
mov dword [ebp - 0xb0], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
movzx eax, word [ebp + 0x64]
movzx ecx, word [ebp + 0x66]
shl eax, 0x10
or eax, ecx
cmp dword [ebp - 0xac], 4
mov dword [0x450c54], eax
jne 0x4348b3
mov dword [0x450c50], 1
jmp 0x434941
cmp dword [ebp - 0xac], 5
jne 0x434900
cmp dword [ebp - 0xa8], 0
jne 0x4348d1
mov dword [0x450c50], 2
jmp 0x434941
cmp dword [ebp - 0xa8], 1
jne 0x4348e6
mov dword [0x450c50], 3
jmp 0x434941
xor eax, eax
cmp dword [ebp - 0xa8], 2
setne al
dec eax
and eax, 0xfffffffb
add eax, 9
mov dword [0x450c50], eax
jmp 0x434941
cmp dword [ebp - 0xac], 6
jne 0x434937
cmp dword [ebp - 0xa8], 0
jne 0x434920
xor eax, eax
cmp byte [ebp + 0x6a], 1
setne al
add eax, 5
jmp 0x4348f9
cmp dword [ebp - 0xa8], 1
jne 0x434937
xor eax, eax
cmp byte [ebp + 0x6a], 1
setne al
add eax, 7
jmp 0x4348f9
mov dword [0x450c50], 9
mov eax, dword [0x450c50]
mov ecx, dword [ebp + 0x6c]
mov dword [edi], eax
mov eax, dword [0x450c54]
pop edi
mov dword [ebx], eax
xor ecx, ebp
pop ebx
call fcn.00408498
add ebp, 0x70
leave
ret 8

Function at 0x4349e2
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x44f9f8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ebx
mov word [ebp - 8], 0x500
mov dword [ebp - 0x10], ebx
call fcn.00434962
cmp dword [ebp - 0x14], ebx
je 0x434a20
mov dword [esi], 1
jmp 0x434a54
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [esi], eax
cmp eax, ebx
je 0x434a54
push esi
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x434a54
mov dword [esi], ebx
cmp dword [ebp - 0x10], ebx
pop esi
pop ebx
je 0x434a63
push dword [ebp - 0x10]
call fcn.00436436
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.00408498
leave
ret 4