joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432280
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x46c004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 4
push eax
xor esi, esi
mov dword [ebp - 0x10], 3
push esi
lea eax, [ebp - 0xc]
mov dword [ebp - 8], esi
push eax
push str.SoftwareSASGeneration
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
mov ebx, ecx
call fcn.004325f0
add esp, 0x10
test al, al
je 0x4322f8
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x4322f8
lea eax, [ebp - 8]
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push str.SoftwareSASGeneration
call fcn.004325f0
add esp, 0x10
push 1
push 4
lea eax, [ebp - 0x10]
push eax
sub esp, 8
call fcn.00432720
add esp, 0x14
push str.wmsgapi.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x432329
push str.wmsgapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x43234e
push str.WmsgSendMessage
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43234e
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push ecx
push 0
push 0x208
push ebx
call eax
test esi, esi
je 0x4323b3
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x102
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
sete al
test al, al
je 0x4323a3
push 4
push esi
push 4
push 0
push str.SoftwareSASGeneration
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0043de43
mov esp, ebp
pop ebp
ret
Function at 0x4325f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x46c004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x14]
xor bl, bl
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
push 0x101
push 0
push edx
push connect
mov dword [ebp - 0xc], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x432679
test esi, esi
je 0x432644
mov eax, dword [esi]
mov dword [ebp - 8], eax
jmp 0x43264b
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0
push edi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x432670
test esi, esi
je 0x43266e
mov eax, dword [ebp - 8]
mov dword [esi], eax
mov bl, 1
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043de43
mov esp, ebp
pop ebp
ret

Function at 0x432720
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x46c004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 8]
push eax
push 0x102
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push connect
mov dword [ebp - 8], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
sete al
test al, al
jne 0x432790
cmp byte [ebp + 0x18], al
je 0x4327bc
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x102
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
sete al
test al, al
je 0x4327bc
test esi, esi
je 0x4327bc
push ebx
push dword [ebp + 0x14]
push esi
push 4
push 0
push str.SoftwareSASGeneration
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
test eax, eax
sete bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0043de43
mov esp, ebp
pop ebp
ret
Function at 0x432810
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x46c004]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov dword [ebp - 0x6c], edx
xor edi, edi
mov dword [ebp - 0x68], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x208
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x432923
push 0x208
push ebx
push edi
push esi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
test eax, eax
je 0x432911
push 0x44
lea eax, [ebp - 0x64]
push edi
push eax
call fcn.00440480
add esp, 0xc
mov dword [ebp - 0x64], 0x44
xorps xmm0, xmm0
mov dword [ebp - 0x5c], str.WinSta0Winlogon
xor eax, eax
mov dword [ebp - 0x38], 1
movups xmmword [ebp - 0x18], xmm0
push str.Wow64DisableWow64FsRedirection
push str.kernel32.dll
mov word [ebp - 0x34], ax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4328b8
lea ecx, [ebp - 0x1c]
push ecx
call eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, dword [ebp - 0x68]
mov ecx, eax
call fcn.00432de0
mov dword [ebp - 0x68], eax
test eax, eax
je 0x432911
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x64]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x6c]
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
push dword [ebp - 0x68]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x432911
mov eax, dword [ebp - 0x18]
push dword [ebp - 0x14]
mov edi, dword [ebp - 0x10]
mov dword [0x46d900], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push ebx
push 0
call ecx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 8]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043de43
mov esp, ebp
pop ebp
ret
Function at 0x432940
Capabilities:
Get session information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x46c004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 8]
mov dword [ebp - 0x18], ecx
push eax
lea eax, [ebp - 0x10]
xor ebx, ebx
push eax
push 1
push ebx
push ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ebx
call dword [sym.imp.WTSAPI32.dll_WTSEnumerateSessionsW]
test eax, eax
je 0x4329e1
push edi
xor edi, edi
cmp dword [ebp - 8], ebx
jbe 0x4329d7
push esi
xor esi, esi
nop dword [eax]
lea eax, [ebp - 0xc]
mov dword [ebp - 0x14], 0
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], 0
push eax
mov eax, dword [ebp - 0x10]
push 8
push dword [esi + eax]
push 0
call dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
test eax, eax
je 0x4329cd
mov ecx, dword [ebp - 0x14]
cmp dword [ecx], 0
jne 0x4329c2
mov eax, dword [ebp - 0x10]
mov ebx, 1
mov edx, dword [ebp - 0x18]
mov eax, dword [esi + eax]
mov dword [edx], eax
push ecx
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
test ebx, ebx
jne 0x4329d6
inc edi
add esi, 0xc
cmp edi, dword [ebp - 8]
jb 0x432980
pop esi
push dword [ebp - 0x10]
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
pop edi
mov ecx, dword [ebp - 4]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0043de43
mov esp, ebp
pop ebp
ret
Function at 0x432c40
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [0x46c004]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x6c], edx
xor esi, esi
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x208
push esi
mov dword [ebp - 0x58], eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x432d2f
push 0x208
push edi
push esi
push dword [ebp - 0x58]
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
test eax, eax
je 0x432d23
push 0x44
lea eax, [ebp - 0x54]
push esi
push eax
call fcn.00440480
add esp, 0xc
mov dword [ebp - 0x54], 0x44
xorps xmm0, xmm0
mov dword [ebp - 0x28], 1
xor eax, eax
movups xmmword [ebp - 0x68], xmm0
push str.Wow64DisableWow64FsRedirection
push str.kernel32.dll
mov word [ebp - 0x24], ax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x432cec
lea ecx, [ebp - 0x58]
push ecx
call eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x6c]
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x70]
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x432d23
mov ecx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x68]
push dword [ebp - 0x64]
mov esi, dword [ebp - 0x60]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043de43
mov esp, ebp
pop ebp
ret

Function at 0x432d50
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [0x46ca80]
push edi
xor edi, edi
cmp eax, 0xffffffff
je 0x432d62
movsx eax, al
pop edi
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 0x20a
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
xor eax, eax
push 0x104
push esi
push str._systemroot__syswow64
mov word [esi], ax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x432da1
push esi
push eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
push 0x2000010
push 3
push 0
push 7
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x432dce
mov edi, 1
push eax
mov dword [0x46ca80], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop ebx
mov eax, edi
pop edi
ret
Function at 0x432e90
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x46c004]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x10]
mov word [ebp - 0xc], 0x500
push eax
mov dword [ebp - 0x14], 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 8], eax
test eax, eax
je 0x432f00
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x14]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0x14]
neg eax
sbb eax, eax
and dword [ebp - 8], eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043de43
mov esp, ebp
pop ebp
ret
Function at 0x432f10
Capabilities:
Enumerate services

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x46c004]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x46d98c], 0
push ebx
mov ebx, ecx
mov dword [ebp - 0x20], edx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [ebp - 0x18], ebx
jne 0x433075
push edi
push 4
push 0
push 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [0x46d98c], 1
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x433074
mov esi, dword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
lea eax, [ebp - 8]
push 0
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 1
push 0x30
push 0
push edi
call esi
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x433067
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x433064
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push ebx
push 1
push 0x30
push 0
push edi
call esi
test eax, eax
je 0x43304d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
mov dword [ebp - 0x1c], eax
call fcn.004331d0
mov esi, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
xor eax, eax
test esi, esi
je 0x43304d
lea ecx, [ebx + 0x24]
nop
mov edx, dword [ecx]
cmp edx, dword [ebp - 0x1c]
je 0x433016
cmp edx, dword [ebp - 0x14]
je 0x433016
inc eax
add ecx, 0x2c
cmp eax, esi
jb 0x433000
jmp 0x43304d
imul esi, eax, 0x2c
mov dword [0x46d98c], 2
push dword [esi + ebx]
push 0x104
push 0x46d990
call fcn.004444c4
mov edx, dword [ebp - 0x20]
add esp, 0xc
test edx, edx
je 0x43304d
mov ecx, dword [ebp - 0x14]
xor eax, eax
cmp dword [esi + ebx + 0x24], ecx
sete al
mov dword [edx], eax
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push ebx
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ebx, dword [ebp - 0x18]
jmp 0x43306d
mov ebx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
cmp dword [0x46d98c], 2
jne 0x433111
test ebx, ebx
je 0x4330e1
cmp word [0x46d990], 0
je 0x4330f6
mov ecx, 0x46d990
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4330a0
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
mov dword [ebx], ecx
test ecx, ecx
je 0x4330e1
mov edx, 0x46d990
nop
movzx eax, word [edx]
lea edx, [edx + 2]
mov word [ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x4330d0
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043de43
mov esp, ebp
pop ebp
ret
pop esi
mov dword [ebx], 0
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043de43
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.0043de43
mov esp, ebp
pop ebp
ret
Function at 0x433130
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x46c004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
mov edi, ecx
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x4331b8
push 0x228
lea eax, [ebp - 0x22c]
push ebx
push eax
call fcn.00440480
add esp, 0xc
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x4331b1
nop dword [eax + eax]
cmp edi, dword [ebp - 0x228]
je 0x4331ac
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x433190
jmp 0x4331b1
mov ebx, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043de43
mov esp, ebp
pop ebp
ret

Function at 0x4331d0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x46c004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
mov edi, ecx
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x433259
push 0x228
lea eax, [ebp - 0x22c]
push ebx
push eax
call fcn.00440480
add esp, 0xc
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x433252
nop dword [eax + eax]
cmp edi, dword [ebp - 0x228]
je 0x43324c
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x433230
jmp 0x433252
mov ebx, dword [ebp - 0x218]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043de43
mov esp, ebp
pop ebp
ret
Function at 0x4333f0
Capabilities:
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x46c004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x100000
push 0
push ebx
mov dword [ebp - 0x14], edx
mov esi, 1
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x20], eax
call fcn.00440480
add esp, 0xc
mov dword [ebp - 8], 0x103
xor edi, edi
mov dword [ebp - 0xc], 0
push edi
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], edi
push eax
push edi
push edi
push edi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
cmp dword [ebp - 0xc], edi
je 0x433475
push edi
lea eax, [ebp - 0x10]
push eax
mov eax, 0x100000
sub eax, esi
push eax
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [ebp - 0x10]
mov edi, eax
add ebx, edx
add esi, edx
jmp 0x433478
mov edx, dword [ebp - 0x10]
cmp esi, 0x100000
mov eax, 1
mov ecx, esi
cmove esi, eax
mov eax, dword [ebp - 0x18]
cmp ecx, 0x100000
cmovne eax, ebx
mov ebx, eax
test edi, edi
je 0x43349e
test edx, edx
jne 0x4334c4
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebp - 8]
cmp eax, 0x103
jne 0x4334d2
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 8]
cmp eax, 0x103
je 0x433431
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x4334db
mov dword [ecx], esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043de43
mov esp, ebp
pop ebp
ret
Function at 0x4334f0
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov eax, dword [0x46c004]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
push edi
mov dword [ebp - 0x7c], eax
xor edi, edi
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x78], eax
test ecx, ecx
je 0x433536
test edx, edx
je 0x43353e
push edx
push ecx
push str.__s___s
call fcn.00430820
add esp, 0xc
jmp 0x433551
test edx, edx
je 0x433694
test ecx, ecx
cmovne edx, ecx
push edx
push 0x468278
call fcn.00430820
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x433694
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], edi
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x1c], edi
push eax
lea edx, [ebp - 0x1c]
mov dword [ebp - 0x18], edi
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], edi
call fcn.004332f0
add esp, 8
test al, al
je 0x433684
push 0x40
lea eax, [ebp - 0x70]
push 0
push eax
call fcn.00440480
mov eax, dword [ebp - 0x14]
add esp, 0xc
mov dword [ebp - 0x34], eax
xorps xmm0, xmm0
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x74]
mov dword [ebp - 0x74], 0x44
push eax
push dword [ebp - 0xc]
movups xmmword [ebp - 0x2c], xmm0
push 0
push 0x8000000
push 1
push 0
push 0
push ebx
push 0
mov dword [ebp - 0x48], 0x100
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x80], eax
test eax, eax
je 0x433632
test esi, esi
je 0x4335fd
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4335fd
push 0
lea eax, [ebp - 0xc]
push eax
push ecx
push esi
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x100000
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x433632
push dword [ebp - 0x78]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x2c]
push edi
call fcn.004333f0
mov ecx, dword [ebp - 0x7c]
add esp, 8
test ecx, ecx
je 0x433632
mov dword [ecx], eax
cmp dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x7c], edx
je 0x433664
test edx, edx
je 0x433664
push dword [ebp - 0x10]
call esi
push dword [ebp - 0x7c]
call esi
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x78]
test ecx, ecx
je 0x433674
test eax, eax
je 0x433674
push ecx
call esi
push dword [ebp - 0xc]
call esi
cmp dword [ebp - 0x80], 0
je 0x433684
push dword [ebp - 0x28]
call esi
push dword [ebp - 0x2c]
call esi
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 8]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043de43
mov esp, ebp
pop ebp
ret
Function at 0x4336b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x46c004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x68], eax
xor edi, edi
mov eax, dword [ebp + 0x14]
mov esi, edx
push 0x44
mov dword [ebp - 0x6c], eax
xor ebx, ebx
lea eax, [ebp - 0x50]
mov dword [ebp - 0x54], ecx
push edi
push eax
call fcn.00440480
mov eax, dword [ebp - 0x54]
add esp, 0xc
xorps xmm0, xmm0
movups xmmword [ebp - 0x64], xmm0
test eax, eax
je 0x43370a
test esi, esi
je 0x43370e
push esi
push eax
push str.__s___s
call fcn.00430820
add esp, 0xc
jmp 0x433721
test esi, esi
je 0x433723
test eax, eax
cmovne esi, eax
push esi
push 0x468278
call fcn.00430820
add esp, 8
mov edi, eax
push str.Wow64DisableWow64FsRedirection
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x433744
lea ecx, [ebp - 0x54]
push ecx
call eax
lea eax, [ebp - 0x64]
mov dword [ebp - 0x50], 0x44
push eax
lea eax, [ebp - 0x50]
mov ecx, 0xc000000
push eax
push dword [ebp - 0x68]
xor eax, eax
cmp byte [ebp + 0xc], al
push 0
cmovne eax, ecx
push eax
push 0
push 0
push 0
push edi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4337aa
cmp byte [ebp + 0x10], bl
je 0x433789
push 0xffffffffffffffff
push dword [ebp - 0x64]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x60]
mov ebx, dword [ebp - 0x5c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov ecx, dword [ebp - 0x6c]
test ecx, ecx
je 0x4337a5
mov eax, dword [ebp - 0x64]
mov dword [ecx], eax
jmp 0x4337aa
push dword [ebp - 0x64]
call esi
test edi, edi
je 0x4337be
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043de43
mov esp, ebp
pop ebp
ret
Function at 0x433860
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x46c004]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push edi
lea edi, [ebp - 0x18]
mov dword [ebp - 0x24], 0
mov esi, edx
mov dword [ebp - 0x20], 0
push 0x60
mov edx, 0x240
mov dword [ebp - 0x10], 0
test edi, edi
mov dword [ebp - 0xc], 0
xorps xmm0, xmm0
mov dword [ebp - 0x38], 0x18
movups xmmword [ebp - 0x34], xmm0
mov eax, 0x40
mov dword [ebp - 0x34], 0
cmovs eax, edx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x10]
push 3
push eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x28], 0
push eax
push 0x12019f
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], 0
push eax
call dword [sym.imp.ntdll.dll_ZwOpenFile]
test eax, eax
js 0x43391e
push 0
lea eax, [ebp - 0x1c]
xorps xmm0, xmm0
push eax
push 0x2000
push esi
lea eax, [ebp - 0x10]
movlpd qword [ebp - 0x1c], xmm0
push eax
push 0
push 0
push 0
push dword [ebp - 0x20]
call dword [sym.imp.ntdll.dll_ZwWriteFile]
push dword [ebp - 0x20]
mov esi, eax
call dword [sym.imp.ntdll.dll_ZwClose]
mov eax, esi
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
pop esi
call fcn.0043de43
mov esp, ebp
pop ebp
ret
Function at 0x450037
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044fcf7