joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10011e70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
mov esi, 1
call fcn.100028f0
mov edi, dword [ebp + 0x10]
sub eax, edi
je 0x10011f2a
nop
push edi
dec eax
push ebx
mov dword [ebp + 0x10], eax
call fcn.10003870
cmp eax, 3
jne 0x10011efd
push edi
push ebx
call fcn.100029e0
push 0
push edi
push ebx
test eax, eax
je 0x10011ebd
call fcn.10003660
push edx
push eax
push str._lld
jmp 0x10011ecd
call fcn.10003740
sub esp, 8
fstp qword [esp]
push str._.14g
push dword [ebp + 0xc]
call fcn.100286c0
add esp, 0x10
test esi, esi
je 0x10011ee0
test eax, eax
jg 0x10011f23
xor esi, esi
mov eax, dword [ebp + 0x10]
inc edi
test eax, eax
jne 0x10011e90
test esi, esi
jne 0x10011f2a
push esi
push esi
push ebx
call fcn.10004420
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
lea eax, [ebp + 8]
push eax
push edi
push ebx
call fcn.10004060
test esi, esi
je 0x10011ee0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp eax, dword [ebp + 8]
jne 0x10011ee0
mov esi, 1
jmp 0x10011ee2
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 0xc

Function at 0x10014dd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov edx, dword [ebp + 0x14]
xorps xmm0, xmm0
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x1c]
push ebx
push esi
mov esi, dword [ebp + 0x10]
movlpd qword [ebp - 0x28], xmm0
mov ebx, dword [ebp - 0x24]
push edi
mov edi, 0xff
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0x28]
mov dword [ebp - 8], edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0x10
nop dword [eax]
xor eax, esi
xor edi, ebx
mov ebx, dword [ebp - 4]
xor esi, edi
xor ebx, dword [ebp - 0x10]
xor ecx, edx
xor edx, ebx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x18], edx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov dword [edx], esi
mov esi, dword [ebp - 0x18]
mov dword [edx + 4], esi
mov esi, dword [ebp - 8]
mov edx, dword [ebp - 4]
xor esi, eax
mov eax, dword [ebp + 0xc]
xor edx, ecx
mov dword [ebp - 0x20], esi
mov dword [eax + 8], esi
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [ebp - 4], 0
mov dword [esi + 0xc], edx
mov esi, dword [ebp - 8]
shld eax, esi, 0x11
shl esi, 0x11
xor dword [ebp - 0x1c], esi
mov esi, eax
xor esi, ecx
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], esi
mov dword [ecx + 0x14], esi
mov esi, edi
shrd edi, ebx, 0x13
shl esi, 0xd
or dword [ebp - 4], edi
shr ebx, 0x13
or esi, ebx
mov dword [ecx + 0x10], eax
sub dword [ebp - 0x14], 1
mov ebx, dword [ebp - 4]
mov dword [ecx + 0x1c], esi
mov dword [ebp - 0x10], esi
mov esi, dword [ebp - 0x20]
mov edi, esi
mov dword [ecx + 0x18], ebx
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 8], esi
mov esi, dword [ebp - 0x24]
mov dword [ebp - 4], edx
mov edx, dword [ebp - 0x18]
jne 0x10014e10
push dword [ebp + 0x14]
mov esi, dword [ebp + 8]
push dword [ebp + 0x10]
push esi
call fcn.10002dc0
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push esi
call fcn.10002dc0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x10015ca0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x1002f040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
push str._5_4
push esi
mov dword [ebp - 0x220], eax
mov eax, dword [ebp + 0x14]
push str._s_s
push edi
mov dword [ebp - 0x21c], eax
call fcn.10002d90
push eax
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov ebx, eax
add esp, 0x14
test ebx, ebx
jne 0x10015d03
push esi
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x10015e31
push str.LUA_NOENV
push 0xfff0b9d8
push edi
call fcn.100026d0
push 0xffffffffffffffff
push edi
call fcn.100035e0
push 0xfffffffffffffffe
push edi
mov esi, eax
call fcn.10003480
test esi, esi
jne 0x10015e31
push 0x1002bc1c
push ebx
call sub.ntdll.dll_strstr
add esp, 8
mov dword [ebp - 0x218], eax
test eax, eax
jne 0x10015d4b
push ebx
jmp 0x10015e37
mov esi, ebx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x10015d50
lea eax, [ebp - 0x214]
sub esi, ecx
push eax
push edi
call fcn.10003f50
mov eax, dword [ebp - 0x218]
cmp ebx, eax
jae 0x10015db2
sub eax, ebx
push eax
push ebx
lea eax, [ebp - 0x214]
push eax
call fcn.10003d80
mov ecx, dword [ebp - 0x20c]
cmp ecx, dword [ebp - 0x210]
jb 0x10015da2
push 1
lea eax, [ebp - 0x214]
push eax
call fcn.10004af0
mov ecx, dword [ebp - 0x20c]
mov eax, dword [ebp - 0x214]
mov byte [eax + ecx], 0x3b
inc dword [ebp - 0x20c]
push dword [ebp - 0x21c]
lea eax, [ebp - 0x214]
push eax
call fcn.10003db0
mov ecx, dword [ebp - 0x218]
lea eax, [ebx - 2]
add eax, esi
cmp ecx, eax
jae 0x10015e23
mov edx, dword [ebp - 0x20c]
cmp edx, dword [ebp - 0x210]
jb 0x10015dfb
push 1
lea eax, [ebp - 0x214]
push eax
call fcn.10004af0
mov edx, dword [ebp - 0x20c]
mov ecx, dword [ebp - 0x218]
mov eax, dword [ebp - 0x214]
sub esi, ecx
mov byte [eax + edx], 0x3b
lea eax, [esi - 2]
inc dword [ebp - 0x20c]
add eax, ebx
push eax
lea eax, [ecx + 2]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.10003d80
lea eax, [ebp - 0x214]
push eax
call fcn.10004b10
jmp 0x10015e3d
push dword [ebp - 0x21c]
push edi
call fcn.10002eb0
push 0x105
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x10015ea5
cmp eax, 0x105
je 0x10015ea5
lea eax, [ebp - 0x10c]
push 0x5c
push eax
call sub.ntdll.dll_strrchr
add esp, 8
test eax, eax
je 0x10015ea5
mov byte [eax], 0
lea eax, [ebp - 0x10c]
push eax
push 0x1002bbe8
push 0
push 0xffffffffffffffff
push edi
call fcn.100036b0
push eax
push edi
call fcn.10004570
push 0xffffffffffffffff
push 0xfffffffffffffffe
push edi
call fcn.10003200
push 0xfffffffffffffffe
push edi
call fcn.10003480
jmp 0x10015eb3
push str.unable_to_get_ModuleFileName
push edi
call fcn.10004300
add esp, 8
push dword [ebp - 0x220]
push 0xfffffffffffffffd
push edi
call fcn.10003270
push 0xfffffffffffffffe
push edi
call fcn.10003480
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10028ecb
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10016d20
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
mov eax, dword [0x1002f040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0xd8]
push esi
push edi
mov edi, dword [ebp + 8]
push eax
push edi
mov dword [ebp - 0xdc], ebx
call fcn.10016190
mov esi, eax
test esi, esi
je 0x10016d83
mov ecx, dword [ebp - 0xd8]
sub esi, edi
mov edx, dword [ebp - 0xd4]
mov al, 3
mov dword [ebx], ecx
mov dword [ebx + 4], edx
mov byte [ebx + 8], al
lea eax, [esi + 1]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10028ecb
mov esp, ebp
pop ebp
ret 8
push 0x1002bee0
push edi
call dword [sym.imp.ntdll.dll_strpbrk]
add esp, 8
test eax, eax
je 0x10016db6
movzx ebx, byte [eax]
or ebx, 0x20
cmp ebx, 0x6e
jne 0x10016db8
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10028ecb
mov esp, ebp
pop ebp
ret 8
xor ebx, ebx
push ebx
lea eax, [ebp - 0xd8]
push eax
push edi
call fcn.10016110
mov esi, eax
test esi, esi
jne 0x10016e53
push 0x2e
push edi
call sub.ntdll.dll_strchr
mov esi, eax
add esp, 8
test esi, esi
je 0x10016da1
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10016de6
sub ecx, edx
cmp ecx, 0xc8
ja 0x10016da1
lea edx, [ebp - 0xd0]
mov ecx, edi
sub edx, edi
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x10016e01
call dword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_localeconv]
sub esi, edi
push ebx
mov eax, dword [eax]
mov al, byte [eax]
mov byte [ebp + esi - 0xd0], al
lea eax, [ebp - 0xd8]
push eax
lea eax, [ebp - 0xd0]
push eax
call fcn.10016110
mov esi, eax
test esi, esi
je 0x10016da1
mov eax, edi
lea ecx, [ebp - 0xd0]
sub eax, ecx
add esi, eax
test esi, esi
je 0x10016da1
mov ebx, dword [ebp - 0xdc]
sub esi, edi
movsd xmm0, qword [ebp - 0xd8]
mov al, 0x13
mov ecx, dword [ebp - 4]
pop edi
movsd qword [ebx], xmm0
xor ecx, ebp
mov byte [ebx + 8], al
lea eax, [esi + 1]
pop esi
pop ebx
call fcn.10028ecb
mov esp, ebp
pop ebp
ret 8
Function at 0x10016f40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
call dword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_localeconv]
mov ecx, dword [ebp + 8]
xor edi, edi
xor esi, esi
xorps xmm1, xmm1
mov eax, dword [eax]
movsx eax, byte [eax]
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
mov al, byte [ecx]
mov byte [ebp + 0xb], al
movzx eax, al
test byte [eax + 0x1002abc1], 8
je 0x10016f93
nop
mov al, byte [ecx + 1]
inc ecx
mov byte [ebp + 0xb], al
movzx eax, al
test byte [eax + 0x1002abc1], 8
jne 0x10016f80
mov al, byte [ebp + 0xb]
lea edx, [ecx + 1]
cmp al, 0x2d
jne 0x10016fa6
mov dword [ebp - 0x10], 1
jmp 0x10016fae
cmp al, 0x2b
mov dword [ebp - 0x10], esi
cmovne edx, ecx
cmp byte [edx], 0x30
jne 0x100170e8
mov al, byte [edx + 1]
cmp al, 0x78
je 0x10016fc6
cmp al, 0x58
jne 0x100170e8
movsd xmm2, qword [0x1002bf50]
add edx, 2
mov al, byte [edx]
movsx ecx, al
mov dword [ebp - 0xc], edx
mov byte [ebp + 0xb], al
cmp ecx, dword [ebp - 0x14]
jne 0x10016ff1
cmp dword [ebp - 4], 0
jne 0x10017043
mov dword [ebp - 4], 1
inc edx
jmp 0x10016fd1
movzx eax, al
test byte [eax + 0x1002abc1], 0x10
je 0x10017043
test edi, edi
jne 0x1001700c
cmp byte [ebp + 0xb], 0x30
jne 0x1001700c
inc dword [ebp - 8]
jmp 0x10017039
inc edi
cmp edi, 0x1e
jg 0x10017038
test byte [ecx + 0x1002abc1], 2
je 0x10017020
add ecx, 0xffffffd0
jmp 0x10017026
or ecx, 0x20
sub ecx, 0x57
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm2
addsd xmm1, xmm0
jmp 0x10017039
inc esi
cmp dword [ebp - 4], 0
je 0x10017040
dec esi
inc edx
jmp 0x10016fd1
mov eax, dword [ebp - 8]
add eax, edi
je 0x100170e8
mov eax, dword [ebp + 0xc]
shl esi, 2
mov dword [eax], edx
mov al, byte [edx]
cmp al, 0x70
je 0x10017060
cmp al, 0x50
jne 0x100170c1
mov al, byte [edx + 1]
inc edx
xor ecx, ecx
cmp al, 0x2d
jne 0x10017075
mov edx, dword [ebp - 0xc]
lea edi, [ecx + 1]
add edx, 2
jmp 0x10017081
cmp al, 0x2b
jne 0x1001707f
mov edx, dword [ebp - 0xc]
add edx, 2
xor edi, edi
mov al, byte [edx]
mov byte [ebp + 0xb], al
movzx eax, al
test byte [eax + 0x1002abc1], 2
je 0x100170e8
movsx eax, byte [ebp + 0xb]
lea ecx, [ecx + ecx*4]
inc edx
lea ecx, [ecx - 0x18]
lea ecx, [eax + ecx*2]
mov al, byte [edx]
mov byte [ebp + 0xb], al
movzx eax, al
test byte [eax + 0x1002abc1], 2
jne 0x10017092
mov eax, ecx
neg eax
test edi, edi
cmove eax, ecx
add esi, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
cmp dword [ebp - 0x10], 0
je 0x100170ce
xorps xmm1, xmmword [0x1002bf60]
push esi
sub esp, 8
movsd qword [esp], xmm1
call dword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_ldexp]
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
fldz
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x1001bb40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 6], 0
jne 0x1001bb8c
mov edx, dword [edi + 8]
push esi
mov esi, dword [edi + 0xc]
xor edx, esi
test esi, esi
je 0x1001bb7d
push ebx
lea ebx, [edi + 0xf]
add ebx, esi
mov ecx, edx
lea ebx, [ebx - 1]
mov eax, edx
shl ecx, 5
shr eax, 2
add ecx, eax
movzx eax, byte [ebx + 1]
add ecx, eax
xor edx, ecx
sub esi, 1
jne 0x1001bb60
pop ebx
pop esi
mov dword [edi + 8], edx
mov eax, edx
mov byte [edi + 6], 1
pop edi
pop ebp
ret 4
mov eax, dword [edi + 8]
pop edi
pop ebp
ret 4
Function at 0x401400
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x415178]
push esi
mov esi, dword [esp + 8]
push 0
push esi
push eax
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageW]
lea eax, [esi - 0x35]
cmp eax, 0xc5
pop esi
ja case.0x40142b.54
movzx ecx, byte [eax + 0x4014e8]
jmp dword [ecx*4 + 0x4014bc]
mov edx, dword [0x4151a4]
push edx
call fcn.00403dc0
add esp, 4
ret
jmp 0x403b50
jmp fcn.00403f50
push 0
call fcn.004031d0
add esp, 4
ret
push 1
call fcn.004031d0
add esp, 4
ret
mov dword [esp + 8], 1
mov dword [esp + 4], 0x41515c
jmp fcn.00403c50
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], 0x41515c
jmp fcn.00403c50
mov dword [esp + 8], 2
mov dword [esp + 4], 0x41515c
jmp fcn.00403c50
jmp 0x403070
mov dword [esp + 8], 1
mov dword [esp + 4], 0x41515c
jmp fcn.00402c90
sub esp, 0x414
mov eax, dword [0x41401c]
xor eax, esp
mov dword [esp + 0x410], eax
push 0x206
lea eax, [esp + 6]
push 0
push eax
mov word [esp + 0xc], 0
call fcn.00404be0
add esp, 0xc
push 0x104
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0x206
lea edx, [esp + 0x20e]
push 0
push edx
mov word [esp + 0x214], 0
call fcn.00404be0
lea eax, [esp + 0xc]
push eax
push str._sMediaWindows_Navigation_Start.wav
lea ecx, [esp + 0x21c]
push 0x104
push ecx
call fcn.0040535a
add esp, 0x1c
push 0x20001
push 0
lea edx, [esp + 0x210]
push edx
call dword [sym.imp.WINMM.dll_PlaySoundW]
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.00404bc9
add esp, 0x414
ret
push ecx
cmp dword [0x4151bc], 0
je 0x403b9b
push esi
call fcn.00403600
mov esi, eax
neg esi
sbb esi, esi
add esi, 1
push esi
call fcn.00403670
add esp, 4
cmp dword [0x415188], 2
jne 0x403b93
lea eax, [esp + 4]
push eax
push esi
push 0x100023
push 0x53564544
call fcn.004021e0
add esp, 0x10
mov eax, 1
pop esi
pop ecx
ret
xor eax, eax
pop ecx
ret
Function at 0x403070
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x415178]
push esi
mov esi, dword [esp + 8]
push 0
push esi
push eax
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageW]
lea eax, [esi - 0x35]
cmp eax, 0xc5
pop esi
ja case.0x40142b.54
movzx ecx, byte [eax + 0x4014e8]
jmp dword [ecx*4 + 0x4014bc]
mov edx, dword [0x4151a4]
push edx
call fcn.00403dc0
add esp, 4
ret
jmp 0x403b50
jmp fcn.00403f50
push 0
call fcn.004031d0
add esp, 4
ret
push 1
call fcn.004031d0
add esp, 4
ret
mov dword [esp + 8], 1
mov dword [esp + 4], 0x41515c
jmp fcn.00403c50
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], 0x41515c
jmp fcn.00403c50
mov dword [esp + 8], 2
mov dword [esp + 4], 0x41515c
jmp fcn.00403c50
jmp 0x403070
mov dword [esp + 8], 1
mov dword [esp + 4], 0x41515c
jmp fcn.00402c90
sub esp, 0x414
mov eax, dword [0x41401c]
xor eax, esp
mov dword [esp + 0x410], eax
push 0x206
lea eax, [esp + 6]
push 0
push eax
mov word [esp + 0xc], 0
call fcn.00404be0
add esp, 0xc
push 0x104
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0x206
lea edx, [esp + 0x20e]
push 0
push edx
mov word [esp + 0x214], 0
call fcn.00404be0
lea eax, [esp + 0xc]
push eax
push str._sMediaWindows_Navigation_Start.wav
lea ecx, [esp + 0x21c]
push 0x104
push ecx
call fcn.0040535a
add esp, 0x1c
push 0x20001
push 0
lea edx, [esp + 0x210]
push edx
call dword [sym.imp.WINMM.dll_PlaySoundW]
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.00404bc9
add esp, 0x414
ret
push ecx
cmp dword [0x4151bc], 0
je 0x403b9b
push esi
call fcn.00403600
mov esi, eax
neg esi
sbb esi, esi
add esi, 1
push esi
call fcn.00403670
add esp, 4
cmp dword [0x415188], 2
jne 0x403b93
lea eax, [esp + 4]
push eax
push esi
push 0x100023
push 0x53564544
call fcn.004021e0
add esp, 0x10
mov eax, 1
pop esi
pop ecx
ret
xor eax, eax
pop ecx
ret

Function at 0x403490
Capabilities:
Get common file path

Disassembly:
sub esp, 0x414
mov eax, dword [0x41401c]
xor eax, esp
mov dword [esp + 0x410], eax
cmp dword [0x4155d8], 0
jne 0x403541
push 0x206
lea eax, [esp + 6]
push 0
push eax
mov word [esp + 0xc], 0
call fcn.00404be0
add esp, 0xc
push 0x104
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x206
lea edx, [esp + 0x20e]
push 0
push edx
mov word [esp + 0x214], 0
call fcn.00404be0
lea eax, [esp + 0xc]
push eax
push str._sPowrProf.dll
lea ecx, [esp + 0x21c]
push 0x104
push ecx
call fcn.0040535a
add esp, 0x1c
lea edx, [esp + 0x208]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [0x4155d8], eax
je 0x40355b
push str.GetPwrCapabilities
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4155dc], eax
mov eax, 1
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.00404bc9
add esp, 0x414
ret
mov ecx, dword [esp + 0x410]
xor ecx, esp
xor eax, eax
call fcn.00404bc9
add esp, 0x414
ret
Function at 0x403dc0
Capabilities:
Create thread

Disassembly:
cmp dword [0x41400c], 0
je 0x403e3e
cmp dword [esp + 4], 0
je 0x403e1f
mov eax, dword [0x4151b8]
test eax, eax
je 0x403de6
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, 1
ret
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
push 0x4033b0
push 0
push 0
mov dword [0x4151b8], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x403e6c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
ret
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
cmp eax, 0xffffffff
je 0x403e6c
push str._monitoroff
push eax
call fcn.004048c0
add esp, 8
mov eax, 1
ret
cmp dword [esp + 4], 0
je 0x403e55
mov eax, dword [0x4151b8]
test eax, eax
je 0x403e55
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor eax, eax
cmp dword [0x4155ec], eax
setne al
add eax, 1
push eax
call fcn.00403350
add esp, 4
mov eax, 1
ret

Function at 0x403e80
Capabilities:
Write file on windows

Disassembly:
cmp dword [esp + 4], 0
push esi
je 0x403ecd
mov eax, dword [0x414018]
cmp eax, 2
jne 0x403eae
push 0x104
push 0x4153c8
push 0x40f5c4
call fcn.00403a10
add esp, 0xc
mov dword [0x414018], eax
cmp eax, 1
jne 0x403f3e
push 0
push 0
push 3
push 0
push 0
push 0x40000000
push 0x4153c8
jmp 0x403f0c
mov eax, dword [0x414014]
cmp eax, 2
jne 0x403ef3
push 0x104
push 0x4151c0
push 0x40f5b4
call fcn.00403a10
add esp, 0xc
mov dword [0x414014], eax
cmp eax, 1
jne 0x403f3e
push 0
push 0
push 3
push 0
push 0
push 0x40000000
push 0x4151c0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x403f3e
push 0
push 0
push 1
lea eax, [esp + 0x14]
push eax
push esi
mov byte [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x404030
Capabilities:
Check os version

Disassembly:
sub esp, 0x11c
mov eax, dword [0x41401c]
xor eax, esp
mov dword [esp + 0x118], eax
lea eax, [esp + 4]
push eax
mov dword [esp + 8], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [esp + 8]
cmp eax, 0xa
mov ecx, 1
jb 0x40406b
mov dword [0x4155e4], ecx
cmp eax, 7
jb 0x404078
mov dword [0x4155e8], ecx
jmp 0x404093
cmp eax, 6
jne 0x404099
mov eax, dword [esp + 0xc]
cmp eax, 3
jb 0x40408e
mov dword [0x4155e8], ecx
jmp 0x404093
cmp eax, 2
jb 0x404099
mov dword [0x4155ec], ecx
push esi
push str.IsWow64Process
push str.kernel32
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4040ed
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
mov edx, dword [esp + 4]
mov dword [0x4155e0], edx
pop esi
mov ecx, dword [esp + 0x118]
xor ecx, esp
call fcn.00404bc9
add esp, 0x11c
ret
mov ecx, dword [esp + 0x11c]
mov eax, dword [esp + 4]
pop esi
xor ecx, esp
mov dword [0x4155e0], eax
call fcn.00404bc9
add esp, 0x11c
ret
Function at 0x404110
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push 0x44
lea eax, [esp + 0x14]
push 0
push eax
call fcn.00404be0
xor eax, eax
add esp, 0xc
cmp dword [esp + 0x68], eax
mov dword [esp], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x44
mov word [esp + 0x40], 5
mov dword [esp + 0x18], str.Winsta0Default
jne 0x40415a
mov dword [esp + 0x18], str.Winsta0Winlogon
mov eax, dword [esp + 0x5c]
lea ecx, [esp]
push ecx
mov ecx, dword [esp + 0x68]
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x68]
push 0
push eax
mov eax, dword [esp + 0x68]
push 0x410
push 0
push 0
push 0
push ecx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x4041b6
mov eax, dword [esp]
cmp eax, 0xffffffff
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x4041a0
push eax
call esi
mov eax, dword [esp + 8]
cmp eax, 0xffffffff
je 0x4041ac
push eax
call esi
mov eax, 1
pop esi
add esp, 0x54
ret
xor eax, eax
add esp, 0x54
ret

Function at 0x4041c0
Capabilities:
Get session information

Disassembly:
sub esp, 0x1c
push esi
mov esi, dword [esp + 0x28]
test esi, esi
jne 0x4041d3
xor eax, eax
pop esi
add esp, 0x1c
ret
push ebp
mov ebp, dword [esp + 0x28]
push edi
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x10]
push ecx
push 0x10
push ebp
push 0
mov dword [esp + 0x20], 0
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x40420f
mov eax, dword [esp + 0xc]
movzx edi, word [eax]
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
test di, di
jne 0x4042dd
lea edx, [esp + 0x30]
push edx
push 0xf01ff
mov dword [esp + 0x38], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4042dd
mov eax, dword [esp + 0x30]
push esi
push 1
push 2
push 0
push 0xf01ff
push eax
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x404265
mov ecx, dword [esp + 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebp
xor eax, eax
pop esi
add esp, 0x1c
ret
mov edx, dword [esp + 0x30]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
lea eax, [esp + 0x1c]
push eax
push str.SeTcbPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x4042d8
mov edx, dword [esi]
push 0
push 0
push 0
lea ecx, [esp + 0x24]
push ecx
push 0
push edx
mov dword [esp + 0x30], 1
mov dword [esp + 0x3c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x4042d8
mov ecx, dword [esi]
push 4
lea eax, [esp + 0x14]
push eax
push 0xc
push ecx
mov dword [esp + 0x20], ebp
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
je 0x4042d8
pop edi
pop ebp
mov eax, 1
pop esi
add esp, 0x1c
ret
mov edx, dword [esi]
push edx
call edi
pop edi
pop ebp
xor eax, eax
pop esi
add esp, 0x1c
ret