joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4149f9
Capabilities:
Acquire debug privileges

Disassembly:
cmp byte [ecx], 0
je 0x414a16
and byte [0x4dbd84], 0xfb
push 0
push 4
push str.SeDebugPrivilege
call fcn.0041347b
add esp, 0xc
ret

Function at 0x414c5f
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, 0x4dbd30
push ebx
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
call fcn.00403ee2
mov edi, dword [sym.imp.shlwapi.dll_StrChrW]
pop ecx
push 0x5c
push dword [ebp + 8]
mov byte [ebp - 4], al
jmp 0x414cb7
push dword [ebp + 8]
and word [esi], 0
call fcn.004ac5b9
test eax, eax
pop ecx
jne 0x414cac
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
mov word [esi], 0x5c
push 0x5c
add esi, 2
push esi
call edi
mov esi, eax
test esi, esi
jne 0x414c91
cmp byte [ebp - 4], al
je 0x414ccd
push dword [ebp - 8]
call fcn.00403ef3
pop ecx
push ebx
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret

Function at 0x414e38
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x14]
movzx ecx, word [eax + 6]
mov eax, dword [eax + 0x54]
push edi
mov edi, dword [ebp + 8]
lea ecx, [ecx + ecx*4]
lea eax, [eax + ecx*8]
push eax
push dword [ebp + 0xc]
push edi
call fcn.00414356
mov eax, dword [esi + 0x14]
xor ebx, ebx
add esp, 0xc
cmp word [eax + 6], bx
mov dword [ebp - 4], ebx
jbe 0x414edb
mov eax, dword [esi + 0x18]
add eax, ebx
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x414ec9
mov edx, dword [eax + 0x10]
test edx, edx
je 0x414ec9
mov eax, dword [eax + 0x14]
add eax, dword [ebp + 0xc]
push edx
add edi, ecx
push eax
push edi
call fcn.00414356
mov eax, dword [esi + 0x18]
add esp, 0xc
add eax, ebx
push str..rsrc
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpA]
test eax, eax
jne 0x414ec6
mov eax, dword [ebp + 0xc]
mov ecx, dword [esi + 0x18]
sub edi, eax
lea ecx, [ecx + ebx + 0xc]
lea edx, [edi + eax]
add dword [ecx], edx
mov ecx, dword [esi + 0x18]
lea ecx, [ecx + ebx + 0x14]
add edi, eax
add dword [ecx], edi
mov edi, dword [ebp + 8]
mov eax, dword [esi + 0x14]
movzx eax, word [eax + 6]
inc dword [ebp - 4]
add ebx, 0x28
cmp dword [ebp - 4], eax
jl 0x414e6f
mov dword [esi + 0x10], edi
mov eax, dword [edi + 0x3c]
add eax, edi
mov dword [esi + 0x14], eax
add eax, 0xf8
pop edi
mov dword [esi + 0x18], eax
pop esi
pop ebx
leave
ret 8

Function at 0x415188
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push 0x40
lea eax, [ebp - 0x40]
push 0
push eax
call fcn.004acf60
add esp, 0xc
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x40], 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalMemoryStatusEx]
cmp dword [ebp + 8], 0
je 0x4151bd
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
leave
ret
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
leave
ret
Function at 0x415338
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 0x18]
test esi, esi
push edi
mov dword [ebp - 0xc], 0x20
je 0x415354
mov dword [ebp - 8], esi
jmp 0x41535c
lea eax, [ebp - 0xc]
mov dword [ebp - 8], eax
mov esi, eax
push dword [ebp + 0x10]
mov ax, word [esi + 2]
push dword [ebp + 0xc]
mov word [ebp - 4], ax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x415387
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov edi, eax
jmp 0x415389
xor edi, edi
test ebx, ebx
je 0x415399
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
jmp 0x41539b
xor eax, eax
xor cl, cl
test byte [esi], 1
mov byte [ebp + 0x1b], cl
je 0x4153b7
test eax, eax
je 0x415498
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov cl, byte [ebp + 0x1b]
mov ebx, eax
test ebx, ebx
je 0x415498
test edi, edi
jle 0x415498
test byte [esi], 0x40
jne 0x415427
push 0
push edi
push ebx
call fcn.00441870
add esp, 0xc
test al, al
mov byte [ebp + 0x1b], al
je 0x415427
test byte [esi], 0x20
je 0x4153f1
test al, 2
je 0x4153f1
xor eax, eax
jmp 0x4154a1
push 0
lea ecx, [ebp - 0x18]
call fcn.0044df3e
movzx eax, word [ebp - 4]
mov esi, dword [ebp + 0x14]
push eax
lea eax, [ebp - 0x18]
push esi
push eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
call fcn.00448bd0
and dword [ebp - 0x18], 0
add esp, 0xc
lea ecx, [ebp - 0x18]
call fcn.0043e48d
jmp 0x415464
mov esi, dword [ebp + 0x14]
lea eax, [edi + 0x410]
push eax
mov ecx, esi
call fcn.0040f783
push edi
push ebx
push dword [esi]
mov dword [esi + 8], edi
mov dword [esi + 4], edi
call fcn.004143a0
add esp, 0xc
cmp word [ebp - 4], 0
je 0x415464
movzx eax, word [ebp - 4]
inc edi
shr edi, 1
push edi
push eax
push dword [esi]
call fcn.00412aa4
add esp, 0xc
mov eax, dword [esi + 4]
mov edi, dword [esi]
lea ecx, [eax + 0x10]
push 0x10
add eax, edi
push 0
push eax
mov dword [esi + 8], ecx
call fcn.004acf60
movzx eax, word [ebp - 4]
push 0xc
push eax
mov eax, dword [esi + 4]
add eax, edi
push eax
call fcn.004acf60
mov esi, dword [ebp - 8]
mov cl, byte [ebp + 0x1b]
add esp, 0x18
jmp 0x41549a
xor edi, edi
and ecx, 2
or dword [esi], ecx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4154a6
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 3
push 0x80000000
push dword [ebp + 8]
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.00405a2a
cmp dword [ebp - 8], ebx
jne 0x4154d7
push 0xfffffffffffffffe
pop esi
jmp 0x415597
push edi
push dword [ebp - 8]
call fcn.0049a57e
push ebx
push ebx
push ebx
push dword [ebp - 8]
mov esi, eax
mov dword [ebp - 0x10], esi
call fcn.0043f790
add esp, 0x14
add esi, 0xc
push esi
mov esi, dword [ebp + 0xc]
mov ecx, esi
call fcn.004448de
mov edi, dword [esi]
push ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0xc], ebx
push edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov eax, dword [ebp - 0xc]
push 6
add eax, edi
push ebx
push eax
call fcn.004acf60
mov eax, dword [ebp - 0xc]
push dword [ebp + 0x10]
mov dword [esi + 8], eax
push eax
push edi
mov dword [esi + 4], eax
call fcn.00441870
add esp, 0x18
cmp al, 1
mov byte [ebp - 1], al
pop edi
jne 0x415580
push dword [0x4db08c]
lea ecx, [ebp - 0x1c]
push esi
call fcn.0040f7b6
mov eax, dword [ebp - 0xc]
push ebx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push esi
push eax
call fcn.00448bd0
mov eax, dword [esi + 4]
add esp, 0xc
add eax, 0xc
push eax
mov ecx, esi
call fcn.004448de
lea ecx, [ebp - 0x1c]
call fcn.0043e48d
push 1
push esi
call fcn.0049cbe2
cmp byte [ebp - 1], bl
pop ecx
pop ecx
jge 0x415594
or esi, 0xffffffff
jmp 0x415597
mov esi, dword [esi + 4]
lea ecx, [ebp - 8]
call fcn.00402cb5
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x416d00
Capabilities:
Create thread

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov esi, 0x4dbd30
push esi
mov ebp, ecx
call edi
mov ebx, dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
add dword [0x4db494], 1
push esi
call ebx
push 0x4dac18
mov eax, 0x10000
push eax
push ebp
push 0x416c9d
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x416d4b
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x416d58
push esi
call edi
sub dword [0x4db494], 1
push esi
call ebx
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x41744d
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
and dword [ebp + 0xc], 0xfffffffe
and edi, 1
cmp word [ebx], 0
mov dword [ebp - 0x14], edi
je 0x417624
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_lstrlenW]
jmp 0x417482
mov edi, dword [ebp - 0x14]
push ebx
mov dword [ebp - 0x10], ebx
call esi
add eax, edi
mov edi, dword [ebp - 0x10]
push edi
lea ebx, [ebx + eax*2]
call esi
and dword [ebp - 8], 0
lea eax, [edi + eax*2 - 2]
cmp word [eax], 0x5c
jne 0x4174ae
and word [eax], 0
mov dword [ebp - 8], 2
jmp 0x4174c0
push edi
call fcn.004ac5b9
test eax, eax
pop ecx
je 0x4174c0
mov dword [ebp - 8], 1
push edi
lea ecx, [ebp + 8]
call fcn.0044df7a
cmp dword [ebp - 8], 0
je 0x4174dc
push 0x4c313c
lea ecx, [ebp + 8]
call fcn.00444a7c
and dword [ebp - 0xc], 0
lea eax, [ebp - 0x264]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.004ac6b1
push dword [ebp + 8]
call fcn.00410077
add esp, 0x10
push dword [ebp + 8]
call esi
inc eax
lea edi, [eax + eax]
mov eax, dword [ebp + 8]
mov word [edi + eax - 2], 0x5c
mov eax, dword [ebp + 8]
and word [edi + eax], 0
cmp dword [ebp - 0xc], 0
je 0x4175c7
mov eax, dword [ebp + 8]
and word [edi + eax], 0
lea eax, [ebp - 0x238]
push eax
lea ecx, [ebp + 8]
call fcn.00444a7c
test byte [ebp - 0x264], 0x10
jne 0x417572
cmp dword [ebp + 0xc], 0
push dword [ebp + 8]
je 0x417566
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
test eax, eax
jne 0x4175ae
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
jne 0x417561
inc eax
mov dword [ebp - 4], eax
jmp 0x4175ae
call fcn.00411bbc
test eax, eax
pop ecx
je 0x4175ae
jmp 0x417561
cmp word [ebp - 0x238], 0x2e
jne 0x41759a
cmp word [ebp - 0x236], 0
je 0x4175ae
cmp word [ebp - 0x236], 0x2e
jne 0x41759a
cmp word [ebp - 0x234], 0
je 0x4175ae
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041744d
test eax, eax
pop ecx
pop ecx
jne 0x4175ae
and dword [ebp - 4], eax
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0xc]
call fcn.00405aa0
test eax, eax
jne 0x417523
jmp 0x4175d5
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
jne 0x4175d2
inc eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0xc]
call fcn.00402cea
xor edi, edi
cmp dword [ebp - 8], edi
je 0x417612
cmp dword [ebp + 0xc], edi
push dword [ebp - 0x10]
je 0x417605
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
test eax, eax
jne 0x417612
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, edi
jne 0x41760f
xor eax, eax
inc eax
jmp 0x41760f
call fcn.00411bbc
cmp eax, edi
pop ecx
je 0x417612
mov dword [ebp - 4], eax
lea ecx, [ebp + 8]
call fcn.0043e48d
cmp word [ebx], di
jne 0x41747f
pop esi
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret
Function at 0x418a4d
Capabilities:
Check mutex on windows

Disassembly:
test byte [0x4de003], 1
je 0x418a65
push str.UCallBackhWnd
call fcn.0041238d
test eax, eax
pop ecx
jne 0x418a68
xor eax, eax
ret
push edi
push str.GlobalPECMD:main_u
push 1
push 0
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
mov edi, eax
test edi, edi
je 0x418aa3
push esi
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
sub esi, 0xb7
neg esi
sbb esi, esi
push edi
inc esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
test esi, esi
pop esi
jne 0x418aa3
xor eax, eax
inc eax
pop edi
ret
xor eax, eax
pop edi
ret

Function at 0x4195b7
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp word [edi], 0x2d
jne 0x4195e4
inc edi
inc edi
lea ecx, [ebp + 8]
mov dword [ebp - 4], 1
mov dword [ebp + 8], edi
call fcn.0040f813
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov esi, eax
add esi, 0x84
lea eax, [esi + 0x325]
push eax
lea ecx, [ebp - 0x10]
call fcn.00444a2e
cmp word [edi], 0x5c
mov ebx, dword [ebp - 0x10]
push 2
pop eax
mov dword [ebp - 8], ebx
lea ebx, [ebx + esi*2]
mov dword [ebp - 0xc], eax
jne 0x4196b4
and dword [ebp + 8], 0
push 0x2c
add edi, eax
push 0
push edi
call dword [sym.imp.shlwapi.dll_StrRChrW]
mov esi, eax
test esi, esi
je 0x419647
and word [esi], 0
inc esi
inc esi
push esi
call dword [sym.imp.user32.dll_CharUpperW]
movzx esi, word [esi]
test si, si
jne 0x41964a
mov esi, dword [ebp + 8]
push edi
call fcn.004130a1
pop ecx
push ebx
push 0x324
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.DLL_GetLogicalDriveStringsW]
jmp 0x4196ac
cmp word [ebx], si
jb 0x4196a1
push dword [ebp + 8]
mov edi, dword [ebp - 8]
push ebx
push str._s_sFonts
push edi
call dword [sym.imp.user32.dll_wsprintfW]
push edi
call fcn.004ac5b9
add esp, 0x14
test eax, eax
je 0x4196a1
push 0x4c313c
push edi
call dword [sym.imp.KERNEL32.DLL_lstrcatW]
push dword [ebp - 4]
push edi
call fcn.004194f2
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
push ebx
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
lea ebx, [ebx + eax*2 + 2]
cmp word [ebx], 0
jne 0x419662
jmp 0x41971f
push edi
call fcn.004130a1
and dword [ebp + 8], 0
mov esi, eax
push esi
call fcn.004ac5b9
test eax, eax
pop ecx
pop ecx
je 0x4196e5
push esi
lea ecx, [ebp + 8]
call fcn.0044e03e
push 0x4c313c
lea ecx, [ebp + 8]
call fcn.00444a7c
mov esi, dword [ebp + 8]
push esi
push 0x4c33a0
push dword [ebp - 8]
call dword [sym.imp.user32.dll_wsprintfW]
push esi
call fcn.00410077
push esi
call fcn.004ac5b9
add esp, 0x14
test eax, eax
je 0x419717
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.004194f2
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
lea ecx, [ebp + 8]
call fcn.0043e48d
lea ecx, [ebp - 0x10]
call fcn.0043e48d
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41acc3
Capabilities:
Check for time delay via gettickcount
Log keystrokes via application hook

Disassembly:
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, 0x4dbd30
push edi
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
xor ebx, ebx
test byte [esp + 0x32], 1
jne 0x41acec
cmp dword [0x4db03c], ebx
jne 0x41acec
mov dword [0x4db038], ebx
movzx eax, byte [esp + 0x30]
add dword [0x4db03c], 1
cmp dword [0x4db034], ebx
mov dword [esp + 0x30], eax
jne 0x41ad31
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
push eax
push 0x41abc4
push 0xd
call dword [sym.imp.user32.dll_SetWindowsHookExW]
cmp eax, ebx
mov dword [0x4db034], eax
jne 0x41ad31
sub dword [0x4db03c], 1
xor esi, esi
jmp 0x41ae22
push ebp
push edi
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov ebp, dword [sym.imp.KERNEL32.DLL_GetTickCount]
call ebp
mov esi, dword [esp + 0x30]
mov edi, eax
add edi, esi
cmp esi, 0x4e20
jb 0x41ad59
push 1
call fcn.0044029a
pop ecx
cmp dword [esp + 0x34], 2
jne 0x41adef
cmp esi, ebx
jne 0x41adef
push 0xa
pop esi
jmp 0x41adef
cmp dword [esp + 0x34], 2
je 0x41ad82
call ebp
mov esi, edi
sub esi, eax
cmp esi, ebx
jle 0x41adfb
cmp byte [0x4d92d4], bl
jle 0x41adfb
push 0xa
pop eax
cmp esi, eax
ja 0x41ad93
mov eax, esi
push 0x4ff
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.user32.dll_MsgWaitForMultipleObjects]
jmp 0x41ade7
cmp dword [0x4db038], ebx
jne 0x41adfb
cmp dword [esp + 0x34], 2
je 0x41adbd
call ebp
mov esi, edi
sub esi, eax
cmp esi, ebx
jle 0x41adef
push 1
push ebx
push ebx
push ebx
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.user32.dll_PeekMessageW]
test eax, eax
je 0x41adef
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.user32.dll_TranslateMessage]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.user32.dll_DispatchMessageW]
cmp byte [0x4d92d4], bl
jg 0x41ada4
cmp dword [0x4db038], ebx
je 0x41ad71
push 0x4dbd30
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov eax, dword [0x4db038]
sub dword [0x4db03c], 1
pop ebp
jne 0x41ae1b
mov dword [0x4db038], ebx
mov esi, eax
mov edi, 0x4dbd30
push edi
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x41cc5e
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0xc], 0
jne 0x41cc85
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.0041086c
test eax, eax
je 0x41cc85
call fcn.004108fd
test eax, eax
mov dword [esp + 0xc], eax
jne 0x41cc8c
xor eax, eax
jmp 0x41cd9b
mov ecx, dword [esi + 0x14]
mov ecx, dword [ecx + 0x34]
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
push ebp
push edi
push 0x40
mov ebp, 0x3000
push ebp
push eax
push ecx
call ebx
mov edi, eax
test edi, edi
jne 0x41ccc4
push 0x40
push ebp
push dword [esp + 0x20]
push eax
call ebx
mov edi, eax
test edi, edi
jne 0x41ccc4
xor eax, eax
jmp 0x41cd98
push dword [esp + 0x14]
mov ecx, esi
push edi
call fcn.00414e38
mov eax, dword [esi + 0x14]
xor ebx, ebx
cmp dword [eax + 0xa0], ebx
jbe 0x41ccf1
cmp dword [eax + 0xa4], ebx
jbe 0x41ccf1
push edi
mov ecx, esi
call fcn.004105c4
test eax, eax
je 0x41ccbd
push edi
mov ecx, esi
call fcn.004106e6
test eax, eax
jne 0x41cd0c
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_VirtualFree]
jmp 0x41ccbd
mov eax, dword [esi + 0x14]
mov dword [eax + 0x34], edi
mov eax, dword [esi + 0x14]
test byte [eax + 0x17], 0x20
je 0x41cd25
mov eax, dword [eax + 0x28]
add eax, edi
mov dword [esi + 4], eax
jmp 0x41cd5c
mov ebx, dword [esi]
mov ebp, dword [esi + 0xc]
push str.DllMain
mov ecx, esi
mov dword [esi], 0x200
mov dword [esi + 0xc], edi
call fcn.004104fa
test eax, eax
mov dword [esi + 4], eax
jne 0x41cd55
push str._dllMain_12
mov ecx, esi
call fcn.004104fa
mov dword [esi + 4], eax
mov dword [esi], ebx
mov dword [esi + 0xc], ebp
xor ebx, ebx
mov eax, dword [esi + 4]
xor ebp, ebp
inc ebp
cmp eax, ebx
je 0x41cd8a
push ebx
push ebp
push edi
call eax
test eax, eax
jne 0x41cd8a
push ebx
push ebx
push edi
call dword [esi + 4]
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_VirtualFree]
mov dword [esi + 4], ebx
jmp 0x41ccbd
mov dword [esi + 0xc], edi
mov dword [esi], ebp
mov dword [0x4daf80], esi
mov eax, dword [esi + 0xc]
pop edi
pop ebp
pop ebx
pop esi
ret 8
Function at 0x421d61
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0xa4
push ebx
push esi
mov esi, dword [ebp + 0x7c]
push edi
push 0x4c351c
lea ecx, [ebp + 0x64]
sar esi, 0x10
call fcn.0044df7a
mov ebx, dword [ebp + 0x74]
push esi
push dword [ebx]
call fcn.00412a30
pop ecx
pop ecx
push 0x20a
lea ecx, [ebp + 0x68]
mov dword [ebp + 0x74], eax
call fcn.00444a2e
push dword [ebp + 0x68]
push 0x208
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
mov edi, dword [ebp + 0x78]
push edi
lea ecx, [ebp - 0x38]
call fcn.0041027f
push edi
lea ecx, [ebp - 0x38]
call fcn.00410a9b
push dword [ebp + 0x68]
mov eax, dword [edi + 0x14]
push 0x4c33f4
mov dword [ebp - 0x24], eax
call fcn.0044414b
movzx eax, si
push eax
lea ecx, [ebp - 0x38]
mov word [ebp - 0xc], si
call fcn.00443243
mov ecx, dword [ebp + 0x7c]
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp + 0x64]
push eax
push dword [ebp + 0x74]
push 0
push ebx
call fcn.0042161e
movzx esi, ax
or esi, dword [ebp + 0x7c]
add esp, 0x14
mov edi, 0x4dbd30
push edi
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
and dword [ebp + 0xc], 0
push edi
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
push 0
lea ecx, [ebp - 0x38]
call fcn.00435d0b
lea ecx, [ebp + 8]
call fcn.0043e48d
lea ecx, [ebp + 0x68]
call fcn.0043e48d
lea ecx, [ebp + 0x64]
call fcn.0043e48d
pop edi
mov eax, esi
pop esi
pop ebx
add ebp, 0x6c
leave
ret
Function at 0x42a229
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 0x20a
lea ecx, [ebp - 4]
call fcn.00444a2e
mov eax, dword [ebp - 4]
mov word [eax], 0x20
mov eax, dword [ebp - 4]
and word [eax + 2], 0
mov eax, dword [ebp - 4]
push 0x208
add eax, 2
push eax
push str.SystemRoot
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
push str.System32OnShutdown.wcs
lea ecx, [ebp - 4]
call fcn.00444a7c
mov bl, byte [ebp + 0xc]
test bl, 0x20
mov esi, str.unknown
je 0x42a284
mov esi, 0x4c08bc
test bl, 0x10
je 0x42a28e
mov esi, str.reboot
test bl, 2
je 0x42a298
mov esi, str.logout
test bl, 4
je 0x42a2a2
mov esi, str.suspend
test bl, 8
je 0x42a2ac
mov esi, str.hiber
test bl, 0x40
je 0x42a2b6
mov esi, str.poweroff
test bl, bl
jns 0x42a2bf
mov esi, str.lock
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
push esi
lea ecx, [ebp - 4]
mov edi, eax
call fcn.00444a7c
push 0x4c04e4
lea ecx, [ebp - 4]
call fcn.00444a7c
cmp dword [ebp + 8], 0
je 0x42a2f1
push dword [ebp + 8]
lea ecx, [ebp - 4]
call fcn.00444a7c
push dword [ebp - 4]
mov esi, 0x4db0e0
mov ecx, esi
call fcn.00422182
push str._25INDATA
lea ecx, [ebp - 8]
call fcn.0044df7a
mov eax, dword [ebp - 4]
lea eax, [eax + edi*2]
push eax
lea ecx, [ebp - 8]
call fcn.00444a7c
test bl, 0x70
je 0x42a32b
push dword [ebp - 8]
mov ecx, esi
call fcn.00422182
lea ecx, [ebp - 8]
call fcn.0043e48d
lea ecx, [ebp - 4]
call fcn.0043e48d
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4300be
Capabilities:
Check for time delay via gettickcount
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
push edi
mov byte [ebp - 1], bl
jmp 0x4300d9
inc byte [ebp - 1]
inc eax
inc eax
mov dword [ebp + 8], eax
cmp word [eax], 0x2a
je 0x4300d1
lea eax, [ebp + 8]
push eax
call fcn.00409168
mov al, byte [ebp - 1]
mov byte [0x4dafda], al
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 2]
push eax
lea eax, [ebp - 6]
push eax
lea eax, [ebp - 5]
push eax
lea edi, [ebp - 3]
lea esi, [ebp - 4]
lea eax, [ebp + 8]
mov byte [ebp - 3], 0x2a
mov byte [ebp - 5], bl
mov byte [ebp - 4], 1
mov byte [ebp - 2], bl
call fcn.0041ae32
mov eax, dword [ebp + 8]
add esp, 0x10
cmp word [eax], bx
je 0x430202
mov esi, 0x4dbd30
push esi
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
cmp byte [ebp - 1], bl
je 0x430152
cmp dword [0x4daf90], ebx
je 0x430152
push esi
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
jmp 0x43025e
mov eax, dword [ebp + 8]
movsx ecx, byte [ebp - 3]
mov byte [0x4d92c1], 0xff
movzx edx, word [eax]
cmp ecx, edx
mov byte [0x4dafcd], 1
jne 0x43017c
movzx eax, word [eax + 2]
cmp ecx, eax
jne 0x43017c
mov byte [0x4d92c1], bl
mov edi, dword [ebp - 0x10]
push 0x4dac18
push 0x10000
push edi
push 0x42c725
push 0x100000
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
call esi
mov dword [ebp - 0x10], eax
cmp word [edi], bx
jne 0x4301c1
cmp byte [0x4dafcd], bl
je 0x4301dd
call esi
sub eax, dword [ebp - 0x10]
cmp eax, 0x30d40
jae 0x4301dd
push ebx
push 1
push ebx
mov ecx, 0x4db0e0
call fcn.00415f6a
jmp 0x4301b4
cmp byte [ebp - 2], bl
je 0x43025e
test byte [ebp - 4], 0x40
je 0x43025e
jmp 0x4301f8
push ebx
push ebx
push 1
mov ecx, 0x4db0e0
call fcn.00415f6a
cmp dword [0x4daf90], ebx
jne 0x4301ea
jmp 0x43025e
movsx eax, byte [ebp - 2]
push eax
movsx eax, byte [ebp - 5]
push eax
lea esi, [ebp - 0xc]
mov eax, esi
push eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], 0xbb8
call fcn.00412f6a
mov edi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
add esp, 0xc
call edi
cmp byte [ebp - 2], bl
mov dword [ebp - 0x14], eax
je 0x43025a
mov esi, 0x4daf90
mov dword [ebp - 0x10], 0xfa0
jmp 0x43025a
call edi
sub eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
jae 0x43025e
push ebx
push ebx
push 0xa
mov ecx, 0x4db0e0
call fcn.00415f6a
cmp dword [esi], ebx
jne 0x430242
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret