joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43b6c0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4cdf50
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4fcb54]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [esp + 0x20]
push eax
lea ecx, [esp + 0x24]
mov dword [edi + 0x28], 0
call fcn.00402520
mov dword [esp + 0x18], 0
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx - 0xc]
test eax, eax
jne 0x43b74a
lea esi, [esp + 0xc]
call fcn.0043a8d0
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], 1
call fcn.004028f0
mov byte [esp + 0x18], 0
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43b74a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x20]
push 0x4df3c8
push ecx
call fcn.004a4495
add esp, 8
test eax, eax
jne 0x43b769
lea ecx, [esp + 0x20]
call fcn.004024c0
cmp dword [edi + 0x24], 0
jne 0x43b790
push 0xf003f
push 1
mov ecx, edi
call fcn.0043ab50
test eax, eax
jne 0x43b790
push 2
push 1
mov ecx, edi
call fcn.0043ab50
test eax, eax
je 0x43b7c5
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
push edx
mov edx, dword [esp + 0x24]
push eax
mov eax, dword [edi + 0x24]
push ecx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x43b7c0
and eax, 0xffff
or eax, 0x80070000
jmp 0x43b7c2
xor eax, eax
mov dword [edi + 0x28], eax
xor ecx, ecx
cmp dword [edi + 0x28], ecx
mov dword [esp + 0x18], 0xffffffff
mov eax, dword [esp + 0x20]
setge cl
add eax, 0xfffffff0
lea edx, [eax + 0xc]
mov esi, ecx
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43b7f7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 0x10
Function at 0x43b810
Capabilities:
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x4c7b58
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4fcb54]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x2c]
xor edi, edi
push edi
push edi
mov dword [esp + 0x1c], edi
mov ebx, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push ebp
call ebx
mov esi, eax
cmp esi, edi
jbe 0x43b91a
call fcn.00484590
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x43b86e
push 0x80004005
call fcn.004021e0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
push esi
mov dword [esp + 0x24], edi
call fcn.004841f2
add esp, 4
push esi
mov edi, eax
push edi
push ebp
call ebx
cmp esi, eax
jb 0x43b8b4
test edi, edi
jne 0x43b8a0
xor eax, eax
push eax
push edi
jmp 0x43b8bb
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x43b8a5
sub eax, edx
push eax
push edi
jmp 0x43b8bb
push 0
push 0x4dfd54
lea ecx, [esp + 0x1c]
call fcn.00402430
push edi
call fcn.004841f7
mov esi, dword [esp + 0x18]
add esi, 0xfffffff0
push esi
call fcn.00402860
mov edi, dword [esp + 0x30]
add eax, 0x10
add esp, 8
mov dword [edi], eax
mov dword [esp + 0x20], 0xffffffff
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43b904
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov eax, edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov esi, dword [esp + 0x28]
push ebp
mov ecx, esi
call fcn.00402520
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x43b940
Capabilities:
Query or enumerate registry key

Disassembly:
cmp dword [esi + 0x24], 0
jne 0x43b966
push 0xf003f
push 0
mov ecx, esi
call fcn.0043ab50
test eax, eax
jne 0x43b966
push 1
push eax
mov ecx, esi
call fcn.0043ab50
test eax, eax
je 0x43b9b3
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push 0
push 0
push 0
push eax
mov eax, dword [esp + 0x14]
push ecx
mov ecx, dword [esi + 0x24]
push 0
push edx
push eax
push 0
push 0
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x43b9ae
and eax, 0xffff
or eax, 0x80070000
mov dword [esi + 0x28], eax
xor eax, eax
cmp dword [esi + 0x28], eax
setge al
ret 0x10
xor eax, eax
mov dword [esi + 0x28], eax
xor eax, eax
cmp dword [esi + 0x28], eax
setge al
ret 0x10
Function at 0x43d280
Capabilities:
Create service

Disassembly:
mov eax, dword [edi + 4]
test eax, eax
push ebp
mov ebp, dword [esp + 0xc]
push esi
je 0x43d2b6
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
je 0x43d29e
xor eax, eax
jmp 0x43d2a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
mov dword [edi + 8], eax
je 0x43d38c
mov dword [edi + 4], 0
test ebp, ebp
lea esi, [edi + 0xc]
je 0x43d2d1
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x43d2c2
sub eax, edx
push eax
push ebp
jmp 0x43d2ed
test ebx, ebx
jne 0x43d2d9
xor eax, eax
jmp 0x43d2eb
mov eax, ebx
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x43d2e0
sub eax, edx
push eax
push ebx
mov ecx, esi
call fcn.00402430
mov eax, dword [0x502e74]
test eax, eax
jne 0x43d324
push 0xf003f
push eax
push eax
mov dword [0x502e7c], 0xf003f
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
xor ecx, ecx
test eax, eax
setne cl
mov dword [0x502e74], eax
test ecx, ecx
je 0x43d38c
mov edx, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x30]
mov ecx, dword [esi]
push edx
mov edx, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x20]
push edx
mov edx, dword [esp + 0x34]
push edx
mov edx, dword [esp + 0x34]
push edx
mov edx, dword [esp + 0x34]
push edx
push 0xf01ff
push ebx
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edi + 4], eax
mov esi, ecx
test esi, esi
je 0x43d375
xor eax, eax
jmp 0x43d37b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
mov dword [edi + 8], eax
je 0x43d38c
pop esi
mov eax, 1
pop ebp
ret 0x28
pop esi
xor eax, eax
pop ebp
ret 0x28

Function at 0x43d400
Capabilities:
Start service

Disassembly:
push esi
mov esi, eax
cmp dword [esi + 4], 0
jne 0x43d422
push 0xf01ff
call fcn.0043d1e0
test eax, eax
jne 0x43d422
push 0x10
call fcn.0043d1e0
test eax, eax
je 0x43d458
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esi + 4]
push edi
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov edi, eax
test edi, edi
je 0x43d441
xor eax, eax
jmp 0x43d447
call dword [sym.imp.KERNEL32.dll_GetLastError]
test edi, edi
mov dword [esi + 8], eax
pop edi
je 0x43d458
mov eax, 1
pop esi
ret 8
xor eax, eax
pop esi
ret 8

Function at 0x43d460
Capabilities:
Pause service

Disassembly:
sub esp, 0x1c
push esi
mov esi, eax
cmp dword [esi + 4], 0
jne 0x43d485
push 0xf01ff
call fcn.0043d1e0
test eax, eax
jne 0x43d485
push 0x40
call fcn.0043d1e0
test eax, eax
je 0x43d4b9
mov ecx, dword [esi + 4]
push edi
lea eax, [esp + 8]
push eax
push 2
push ecx
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov edi, eax
test edi, edi
je 0x43d4a1
xor eax, eax
jmp 0x43d4a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
test edi, edi
mov dword [esi + 8], eax
pop edi
je 0x43d4b9
mov eax, 1
pop esi
add esp, 0x1c
ret
xor eax, eax
pop esi
add esp, 0x1c
ret
Function at 0x43d4c0
Capabilities:
Continue service

Disassembly:
sub esp, 0x1c
push esi
mov esi, eax
cmp dword [esi + 4], 0
jne 0x43d4e5
push 0xf01ff
call fcn.0043d1e0
test eax, eax
jne 0x43d4e5
push 0x40
call fcn.0043d1e0
test eax, eax
je 0x43d519
mov ecx, dword [esi + 4]
push edi
lea eax, [esp + 8]
push eax
push 3
push ecx
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov edi, eax
test edi, edi
je 0x43d501
xor eax, eax
jmp 0x43d507
call dword [sym.imp.KERNEL32.dll_GetLastError]
test edi, edi
mov dword [esi + 8], eax
pop edi
je 0x43d519
mov eax, 1
pop esi
add esp, 0x1c
ret
xor eax, eax
pop esi
add esp, 0x1c
ret

Function at 0x43d520
Capabilities:
Stop service

Disassembly:
sub esp, 0x1c
push esi
mov esi, eax
cmp dword [esi + 4], 0
jne 0x43d545
push 0xf01ff
call fcn.0043d1e0
test eax, eax
jne 0x43d545
push 0x20
call fcn.0043d1e0
test eax, eax
je 0x43d579
mov ecx, dword [esi + 4]
push edi
lea eax, [esp + 8]
push eax
push 1
push ecx
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov edi, eax
test edi, edi
je 0x43d561
xor eax, eax
jmp 0x43d567
call dword [sym.imp.KERNEL32.dll_GetLastError]
test edi, edi
mov dword [esi + 8], eax
pop edi
je 0x43d579
mov eax, 1
pop esi
add esp, 0x1c
ret
xor eax, eax
pop esi
add esp, 0x1c
ret

Function at 0x43d860
Capabilities:
Get hostname

Disassembly:
sub esp, 0x18
mov eax, dword [0x4fcb54]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0xc], 0x10
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov esi, eax
test esi, esi
je 0x43d8ae
lea eax, [esp + 8]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x43d894
sub eax, edx
push eax
lea edx, [esp + 0xc]
push edx
mov ecx, edi
call fcn.00402430
mov eax, esi
mov ecx, dword [esp + 0x18]
pop esi
xor ecx, esp
call fcn.004a3135
add esp, 0x18
ret

Function at 0x43d8c0
Capabilities:
Get session user name

Disassembly:
sub esp, 0x10c
mov eax, dword [0x4fcb54]
xor eax, esp
mov dword [esp + 0x108], eax
push esi
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0xc], 0x101
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov esi, eax
test esi, esi
je 0x43d91a
lea eax, [esp + 8]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x43d900
sub eax, edx
push eax
lea edx, [esp + 0xc]
push edx
mov ecx, edi
call fcn.00402430
mov eax, esi
mov ecx, dword [esp + 0x10c]
pop esi
xor ecx, esp
call fcn.004a3135
add esp, 0x10c
ret
Function at 0x43db70
Capabilities:
Link many functions at runtime

Disassembly:
push 0xffffffffffffffff
push 0x4c797b
mov eax, dword fs:[0]
push eax
sub esp, 0x2a8
mov eax, dword [0x4fcb54]
xor eax, esp
mov dword [esp + 0x2a0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4fcb54]
xor eax, esp
push eax
lea eax, [esp + 0x2bc]
mov dword fs:[0], eax
mov eax, dword [esp + 0x2cc]
push str.WS2_32.DLL
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x43dcf4
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WSAStartup
push esi
call edi
push str.gethostname
push esi
mov ebx, eax
call edi
push str.gethostbyname
push esi
mov dword [esp + 0x20], eax
call edi
push str.WSACleanup
push esi
mov ebp, eax
call edi
push str.inet_ntoa
push esi
mov dword [esp + 0x24], eax
call edi
test ebx, ebx
mov edi, eax
je 0x43dced
cmp dword [esp + 0x18], 0
je 0x43dced
test ebp, ebp
je 0x43dced
cmp dword [esp + 0x1c], 0
je 0x43dced
test edi, edi
je 0x43dced
lea ecx, [esp + 0x24]
push ecx
push 0x101
call ebx
test eax, eax
jne 0x43dced
push 0xff
lea edx, [esp + 0x1b8]
push edx
call dword [esp + 0x20]
neg eax
sbb eax, eax
inc eax
je 0x43dce9
lea eax, [esp + 0x1b4]
push eax
call ebp
test eax, eax
je 0x43dce9
mov eax, dword [eax + 0xc]
cmp dword [eax], 0
je 0x43dcd7
mov ecx, dword [eax]
movzx eax, byte [ecx + 3]
movzx edx, byte [ecx + 2]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 1]
movzx ecx, byte [ecx]
shl eax, 8
add eax, edx
shl eax, 8
add eax, ecx
push eax
call edi
push eax
lea ecx, [esp + 0x1c]
call fcn.00402520
mov edx, dword [esp + 0x20]
mov dword [esp + 0x2c4], 0
mov ecx, dword [edx + 8]
push eax
push ecx
mov ecx, edx
call fcn.00492c00
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c4], 0xffffffff
call fcn.004012b0
call dword [esp + 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
jmp 0x43dcf6
call dword [esp + 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov ecx, dword [esp + 0x2bc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2a0]
xor ecx, esp
call fcn.004a3135
add esp, 0x2b4
ret 4
Function at 0x43de30
Capabilities:
Get disk information
Get disk size

Disassembly:
sub esp, 0x264
mov eax, dword [0x4fcb54]
xor eax, esp
mov dword [esp + 0x25c], eax
mov eax, dword [esp + 0x268]
push ebp
mov ebp, dword [esp + 0x270]
push esi
mov esi, ecx
test esi, esi
je 0x43e03d
test ebp, ebp
je 0x43e03d
test edi, edi
je 0x43e03d
test ebx, ebx
je 0x43e03d
cmp eax, 0x19
ja 0x43e03d
add eax, 0x41
push eax
push str._c:_
lea edx, [esp + 0x50]
call fcn.0043e060
add esp, 8
push 0x105
lea eax, [esp + 0x15c]
push eax
lea ecx, [esp + 0x44]
push ecx
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x34]
push eax
push 0x105
lea ecx, [esp + 0x68]
push ecx
lea edx, [esp + 0x64]
push edx
mov dword [esp + 0x40], 0x104
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x43e03d
lea eax, [esp + 0x50]
push eax
mov ecx, esi
call fcn.004023b0
mov ecx, dword [esp + 0x24]
lea esi, [esp + 0xc]
mov dword [ebp], ecx
call fcn.0043dda0
test eax, eax
je 0x43dfe1
cmp dword [esp + 0xc], 0
je 0x43dfe1
push str.KERNEL32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
mov dword [esp + 0xc], esi
je 0x43e036
push str.GetDiskFreeSpaceExA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43df76
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x48]
push edx
lea ecx, [esp + 0x54]
push ecx
call eax
test eax, eax
jle 0x43dfd3
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x28]
mov dword [edi], edx
mov edx, dword [esp + 0x2c]
mov dword [edi + 4], eax
push esi
mov dword [ebx], ecx
mov dword [ebx + 4], edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
jmp 0x43e03f
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x58]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x43e03d
mov eax, dword [esp + 0x1c]
mul dword [esp + 0x18]
mov ebp, edx
mov edx, dword [esp + 0x10]
push ebp
mov esi, eax
push esi
push 0
push edx
call fcn.004ae180
push ebp
push esi
mov dword [edi], eax
mov eax, dword [esp + 0x1c]
push 0
push eax
mov dword [edi + 4], edx
call fcn.004ae180
mov esi, dword [esp + 0xc]
mov dword [ebx], eax
mov dword [ebx + 4], edx
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
jmp 0x43e03f
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x58]
push edx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x43e03d
mov eax, dword [esp + 0x1c]
mul dword [esp + 0x18]
mov ebp, edx
push ebp
mov esi, eax
mov eax, dword [esp + 0x14]
push esi
push 0
push eax
call fcn.004ae180
mov ecx, dword [esp + 0x14]
push ebp
push esi
push 0
push ecx
mov dword [edi], eax
mov dword [edi + 4], edx
call fcn.004ae180
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov eax, 1
jmp 0x43e03f
xor eax, eax
mov ecx, dword [esp + 0x264]
pop esi
pop ebp
xor ecx, esp
call fcn.004a3135
add esp, 0x264
ret 8
Function at 0x43de53
Capabilities:
Get disk information
Get disk size

Disassembly:
sub esp, 0x264
mov eax, dword [0x4fcb54]
xor eax, esp
mov dword [esp + 0x25c], eax
mov eax, dword [esp + 0x268]
push ebp
mov ebp, dword [esp + 0x270]
push esi
mov esi, ecx
test esi, esi
je 0x43e03d
test ebp, ebp
je 0x43e03d
test edi, edi
je 0x43e03d
test ebx, ebx
je 0x43e03d
cmp eax, 0x19
ja 0x43e03d
add eax, 0x41
push eax
push str._c:_
lea edx, [esp + 0x50]
call fcn.0043e060
add esp, 8
push 0x105
lea eax, [esp + 0x15c]
push eax
lea ecx, [esp + 0x44]
push ecx
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x34]
push eax
push 0x105
lea ecx, [esp + 0x68]
push ecx
lea edx, [esp + 0x64]
push edx
mov dword [esp + 0x40], 0x104
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x43e03d
lea eax, [esp + 0x50]
push eax
mov ecx, esi
call fcn.004023b0
mov ecx, dword [esp + 0x24]
lea esi, [esp + 0xc]
mov dword [ebp], ecx
call fcn.0043dda0
test eax, eax
je 0x43dfe1
cmp dword [esp + 0xc], 0
je 0x43dfe1
push str.KERNEL32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
mov dword [esp + 0xc], esi
je 0x43e036
push str.GetDiskFreeSpaceExA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43df76
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x48]
push edx
lea ecx, [esp + 0x54]
push ecx
call eax
test eax, eax
jle 0x43dfd3
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x28]
mov dword [edi], edx
mov edx, dword [esp + 0x2c]
mov dword [edi + 4], eax
push esi
mov dword [ebx], ecx
mov dword [ebx + 4], edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
jmp 0x43e03f
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x58]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x43e03d
mov eax, dword [esp + 0x1c]
mul dword [esp + 0x18]
mov ebp, edx
mov edx, dword [esp + 0x10]
push ebp
mov esi, eax
push esi
push 0
push edx
call fcn.004ae180
push ebp
push esi
mov dword [edi], eax
mov eax, dword [esp + 0x1c]
push 0
push eax
mov dword [edi + 4], edx
call fcn.004ae180
mov esi, dword [esp + 0xc]
mov dword [ebx], eax
mov dword [ebx + 4], edx
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
jmp 0x43e03f
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x58]
push edx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x43e03d
mov eax, dword [esp + 0x1c]
mul dword [esp + 0x18]
mov ebp, edx
push ebp
mov esi, eax
mov eax, dword [esp + 0x14]
push esi
push 0
push eax
call fcn.004ae180
mov ecx, dword [esp + 0x14]
push ebp
push esi
push 0
push ecx
mov dword [edi], eax
mov dword [edi + 4], edx
call fcn.004ae180
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov eax, 1
jmp 0x43e03f
xor eax, eax
mov ecx, dword [esp + 0x264]
pop esi
pop ebp
xor ecx, esp
call fcn.004a3135
add esp, 0x264
ret 8
Function at 0x43e080
Capabilities:
Check os version
Compare security identifiers

Disassembly:
sub esp, 0xb4
mov eax, dword [0x4fcb54]
xor eax, esp
mov dword [esp + 0xb0], eax
push edi
lea eax, [esp + 0x20]
xor edi, edi
push eax
mov dword [esp + 0x18], edi
mov dword [esp + 0x24], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x43e0cd
mov eax, 1
pop edi
mov ecx, dword [esp + 0xb0]
xor ecx, esp
call fcn.004a3135
add esp, 0xb4
ret
cmp dword [esp + 0x30], 2
jne 0x43e0b2
cmp dword [esp + 0x24], 6
jb 0x43e0e3
mov dword [esp + 0x14], 1
push ebx
lea ecx, [esp + 0xc]
push ecx
push 1
push 8
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov byte [esp + 0x28], 0
mov byte [esp + 0x29], 0
mov byte [esp + 0x2a], 0
mov byte [esp + 0x2b], 0
mov byte [esp + 0x2c], 0
mov byte [esp + 0x2d], 5
mov dword [esp + 0x14], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x43e16c
call ebx
cmp eax, 0x3f0
jne 0x43e153
lea edx, [esp + 0xc]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x43e16c
pop ebx
xor eax, eax
pop edi
mov ecx, dword [esp + 0xb0]
xor ecx, esp
call fcn.004a3135
add esp, 0xb4
ret
push ebp
push esi
push 0x1000
call fcn.004a4697
mov esi, eax
add esp, 4
cmp esi, edi
je 0x43e286
mov ecx, dword [esp + 0x14]
mov ebp, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [esp + 0x18]
push eax
push 0x1000
push esi
push 2
push ecx
call ebp
mov edi, eax
call ebx
test edi, edi
jne 0x43e1d8
cmp eax, 0x7a
jne 0x43e1d8
mov edx, dword [esp + 0x18]
push edx
push esi
call fcn.004a5c6c
add esp, 8
test eax, eax
je 0x43e219
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
mov esi, eax
mov eax, dword [esp + 0x20]
push 2
push eax
call ebp
mov edi, eax
call ebx
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x43e210
lea edx, [esp + 0x1c]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x43e21d
push esi
call fcn.004a475a
add esp, 4
xor eax, eax
jmp 0x43e28a
test esi, esi
mov dword [esp + 0x10], 0
je 0x43e25b
xor edi, edi
cmp dword [esi], edi
jbe 0x43e25b
mov ebx, dword [sym.imp.ADVAPI32.dll_EqualSid]
lea ebp, [esi + 4]
mov ecx, dword [ebp]
mov edx, dword [esp + 0x1c]
push ecx
push edx
call ebx
test eax, eax
jne 0x43e253
add edi, 1
add ebp, 8
cmp edi, dword [esi]
jb 0x43e238
jmp 0x43e25b
mov dword [esp + 0x10], 1
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push esi
call fcn.004a475a
add esp, 4
cmp dword [esp + 0x20], 0
je 0x43e286
cmp dword [esp + 0x10], 0
je 0x43e286
call fcn.0043e2b0
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc0]
pop esi
pop ebp
pop ebx
pop edi
xor ecx, esp
call fcn.004a3135
add esp, 0xb4
ret