joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433dfa
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 1
pop esi
push esi
push ecx
mov ecx, esp
mov dword [ebp - 4], esp
push 0x472204
call fcn.004026c2
call fcn.00431de6
xor edi, edi
pop ecx
cmp eax, edi
pop ecx
jne 0x433e29
xor eax, eax
jmp 0x433fa7
cmp dword [ebp + 0x10], edi
je 0x433e3c
push edi
push dword [ebp + 8]
push 4
call fcn.0040d2e2
add esp, 0xc
cmp dword [ebp + 8], edi
mov dword [ebp + 0x10], esi
push 0x43
je 0x433f01
call dword [0x464578]
cmp eax, esi
je 0x433fa4
cmp eax, 2
je 0x433fa4
call fcn.0041ba71
cmp eax, esi
je 0x433e77
call fcn.0040c647
test eax, eax
je 0x433fa4
lea eax, [ebp + 8]
push 4
push eax
mov ebx, 0x474d9c
mov dword [ebp + 8], esi
push 4
mov edi, str.SOFTWARE360Safe_safemon
push ebx
mov esi, 0x80000002
push edi
push esi
call dword [0x464444]
call fcn.0040c647
test eax, eax
jne 0x433fa4
push eax
push str.Q360SafeMonClass
call dword [0x46458c]
test eax, eax
je 0x433ee3
push dword [ebp + 0xc]
push 0x7d0
push 1
push 0x168
push 0x89
push 0x416
push eax
call dword [0x4645b8]
mov eax, dword [ebp + 0xc]
cmp dword [eax], 1
je 0x433fa4
and dword [ebp + 8], 0
lea eax, [ebp + 8]
push 4
push eax
push 4
push ebx
push edi
push esi
call dword [0x464444]
and dword [ebp + 0x10], 0
jmp 0x433fa4
call dword [0x464578]
cmp eax, esi
je 0x433fa4
cmp eax, 2
je 0x433fa4
call fcn.0041ba71
cmp eax, esi
je 0x433f2a
call fcn.0040c647
test eax, eax
je 0x433fa4
lea eax, [ebp + 8]
push 4
mov dword [ebp + 8], edi
push eax
mov ebx, 0x474d9c
push 4
mov edi, str.SOFTWARE360Safe_safemon
push ebx
mov esi, 0x80000002
push edi
push esi
call dword [0x464444]
call fcn.0040c647
test eax, eax
jne 0x433fa4
push eax
push str.Q360SafeMonClass
call dword [0x46458c]
test eax, eax
je 0x433f88
push dword [ebp + 0xc]
push 0x7d0
push 1
push 0x168
push 0x8a
push 0x416
push eax
call dword [0x4645b8]
jmp 0x433fa4
and dword [ebp + 0x10], 0
lea eax, [ebp + 0xc]
push 4
push eax
push 4
push ebx
push edi
push esi
mov dword [ebp + 0xc], 1
call dword [0x464444]
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x43407b
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
push esi
mov esi, dword [ebp + 8]
je 0x434095
push 0
push esi
push 3
call fcn.0040d2e2
add esp, 0xc
and dword [ebp + 0xc], 0
test esi, esi
je 0x4340a4
mov dword [ebp + 0xc], 1
lea eax, [ebp + 0xc]
push 4
push eax
push 4
push str.UDiskAccess
push str.SOFTWARE360Safe_safemon
push 0x80000002
call dword [0x464444]
mov eax, esi
push 0
neg eax
sbb eax, eax
and al, 0xfe
add eax, 0x84
push eax
call fcn.0040718d
pop ecx
test eax, eax
pop ecx
je 0x4340ed
xor eax, eax
test esi, esi
sete al
push eax
call fcn.004340f0
pop ecx
push 1
pop eax
pop esi
pop ebp
ret
Function at 0x4340f0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 4
pop esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
and dword [ebp - 4], 0
push eax
lea eax, [ebp - 0xc]
mov ebx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push eax
push str.NoDriveTypeAutoRun
mov edi, 0x80000001
push ebx
push edi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
call dword [0x464438]
cmp dword [ebp + 8], 0
je 0x434135
and dword [ebp - 4], 0xffffff9b
jmp 0x434139
or dword [ebp - 4], 0x64
lea eax, [ebp - 4]
push esi
push eax
push esi
push str.NoDriveTypeAutoRun
push ebx
push edi
call dword [0x464444]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x436d61
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
xor esi, esi
push edi
cmp dword [ebp + 8], esi
je 0x436da6
mov edi, dword [ebp + 0xc]
push str.user32.dll
mov dword [edi], esi
call dword [0x464238]
cmp eax, esi
mov dword [ebp - 8], eax
je 0x436da6
push str.PrivateExtractIconsW
push eax
call dword [0x46423c]
mov ebx, eax
cmp ebx, esi
jne 0x436dad
push dword [ebp - 8]
call dword [0x464240]
xor eax, eax
jmp 0x436e73
push esi
push esi
push esi
push esi
push esi
push esi
push esi
mov dword [ebp - 4], esi
push dword [ebp + 8]
call ebx
cmp eax, esi
je 0x436df8
push esi
push 1
lea eax, [ebp - 4]
push esi
push eax
push 0x20
push 0x20
push esi
push dword [ebp + 8]
call ebx
cmp eax, 1
jne 0x436de1
mov eax, dword [ebp - 4]
mov dword [edi], eax
jmp 0x436e63
push 1
lea eax, [ebp - 4]
push esi
push eax
push esi
push dword [ebp + 8]
call dword [0x464404]
test eax, eax
je 0x436e63
jmp 0x436dd7
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20e]
mov word [ebp - 0x210], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x210]
push eax
push esi
push esi
push 0x29
push esi
call dword [0x464408]
test eax, eax
jl 0x436e60
lea eax, [ebp - 0x210]
push str.shell32.dll
push eax
call dword [0x46444c]
test eax, eax
je 0x436e60
push esi
push 1
lea eax, [ebp - 4]
push esi
push eax
push 0x20
push 0x20
lea eax, [ebp - 0x210]
push 2
push eax
call ebx
cmp eax, 1
jne 0x436e60
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
push dword [ebp - 8]
call dword [0x464240]
xor eax, eax
cmp dword [edi], esi
setne al
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x43a1fe
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
mov byte [ebp - 1], 1
mov eax, dword [esi + 0x50]
mov ecx, eax
and ecx, 0xc
cmp cl, 0xc
jne 0x43a253
mov eax, dword [esi + 4]
mov edi, dword [0x4644f8]
push eax
mov dword [ebp - 0x10], eax
call edi
push dword [esi + 4]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0xfffffffe
call edi
push dword [esi + 4]
mov edi, eax
call dword [0x4645e4]
lea ecx, [ebp - 0x10]
push ecx
push edi
push 0x4e
push eax
call dword [0x464580]
jmp 0x43a2ad
shr eax, 2
test al, 1
je 0x43a27c
push dword [esi + 4]
call dword [0x4644f8]
push dword [esi + 4]
mov edi, eax
call dword [0x4645e4]
push dword [esi + 4]
movzx ecx, di
push ecx
push 0x111
jmp 0x43a24a
xor ebx, ebx
push 1
push ebx
push ebx
push dword [esi + 0x24]
push str.open
push ebx
call dword [0x464414]
cmp eax, 0x20
seta byte [ebp - 1]
cmp byte [ebp - 1], bl
je 0x43a2ad
or byte [esi + 0x54], 2
push 1
push ebx
push dword [esi + 4]
call dword [0x464520]
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43c10d
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x288
mov ax, word [0x47be6c]
push ebx
push esi
push edi
mov word [ebp - 0x288], ax
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x286]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x1c], 1
push eax
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x1c]
push eax
push str.installpath
push str.SOFTWAREJiangmin
push 0x80000002
mov dword [ebp - 0x14], 0x208
call dword [0x464438]
test eax, eax
jne 0x43c26f
lea eax, [ebp - 0x288]
push str.AntiViruskvxp.kxp
push eax
call dword [0x46444c]
test eax, eax
je 0x43c26f
lea eax, [ebp - 0x288]
push eax
call dword [0x464440]
test eax, eax
je 0x43c26f
mov al, byte [0x47c4d0]
push 0x18
mov byte [ebp - 0x80], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x7f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x80]
push 0x64
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.0040c08d
add esp, 0xc
test eax, eax
je 0x43c26f
lea eax, [ebp - 0x10]
xor esi, esi
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push str._u._u._u._u
push str.1.0.7.423
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], esi
call dword [0x46432c]
movzx edi, word [ebp - 0xc]
movzx eax, word [ebp - 4]
movzx ebx, word [ebp - 8]
shl edi, 0x10
or edi, eax
add esp, 0x18
movzx eax, word [ebp - 0x10]
shl ebx, 0x10
or ebx, eax
lea eax, [ebp - 0x80]
test eax, eax
je 0x43c25b
lea eax, [ebp - 0x80]
push eax
call dword [0x464250]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call fcn.00452e80
mov eax, esp
xor ecx, ecx
push esi
mov dword [ebp - 0x18], eax
mov word [eax], cx
push eax
lea eax, [ebp - 0x80]
push 0xffffffffffffffff
push eax
push ecx
push ecx
call dword [0x4641ac]
mov esi, dword [ebp - 0x18]
push esi
push edi
push ebx
call fcn.0040be80
add esp, 0xc
test eax, eax
jg 0x43c26f
push 1
pop eax
jmp 0x43c271
xor eax, eax
lea esp, [ebp - 0x294]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43c27c
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x628
push esi
push edi
mov edi, 0x475bac
mov esi, 0x104
push dword [edi]
lea eax, [ebp - 0x420]
push str.SYSTEMCurrentControlSetServices_s
push esi
push eax
call fcn.0040de40
add esp, 0x10
lea eax, [ebp - 8]
mov dword [ebp - 4], 2
mov dword [ebp - 8], 0x208
push eax
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x420]
push str.ImagePath
push eax
push 0x80000002
call dword [0x464438]
test eax, eax
jne 0x43c333
lea eax, [ebp - 0x218]
push esi
push eax
lea eax, [ebp - 0x628]
push eax
call fcn.0040c506
add esp, 0xc
test eax, eax
je 0x43c333
lea eax, [ebp - 0x218]
push eax
call dword [0x464440]
test eax, eax
je 0x43c333
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0040c14c
add esp, 0xc
test eax, eax
je 0x43c333
mov eax, dword [ebp - 0xc]
shr eax, 0x10
cmp ax, 0xc
je 0x43c348
add edi, 4
cmp edi, 0x475bb4
jb 0x43c291
xor eax, eax
pop edi
pop esi
leave
ret
push 1
pop eax
jmp 0x43c344

Function at 0x43c475
Capabilities:
Check if file exists

Disassembly:
call fcn.0043c4ad
test eax, eax
je 0x43c4a8
push dword [esp + 8]
push 0x47f4d0
push dword [esp + 0xc]
call dword [0x464434]
test eax, eax
je 0x43c4a8
push dword [esp + 4]
call dword [0x464440]
test eax, eax
je 0x43c4a8
push 1
pop eax
jmp 0x43c4aa
xor eax, eax
ret 8

Function at 0x43c591
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov esi, str.packet
lea edi, [ebp - 0x10]
push 0xf003f
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0
push 0
movsw word es:[edi], word [esi]
call dword [0x46402c]
mov ebx, eax
test ebx, ebx
je 0x43c5eb
lea eax, [ebp - 0x10]
push 0xf01ff
push eax
push ebx
call dword [0x464030]
mov esi, dword [0x464034]
mov edi, eax
test edi, edi
je 0x43c5e8
lea eax, [ebp - 0x2c]
push eax
push 1
push edi
call dword [0x464028]
push edi
call esi
push ebx
call esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43eb58
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x462b24
call fcn.00452e40
sub esp, 0x428
push ebx
push esi
push edi
lea eax, [ebp - 0x434]
push 0x208
push eax
push dword [ebp + 8]
mov esi, ecx
call dword [0x4644f4]
mov edi, dword [ebp + 0xc]
lea ecx, [ebp - 0x24]
push edi
push dword [ebp + 8]
call fcn.0041f0a5
and dword [ebp - 4], 0
push 1
push edi
call dword [0x464098]
push dword [esi + 4]
mov ebx, dword [esi + 0x2c]
call dword [0x464480]
test eax, eax
jne 0x43ebb1
mov ebx, dword [esi + 0x30]
push ebx
mov ebx, dword [0x46409c]
push edi
call ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], edi
push 0xfffffffffffffff0
mov byte [ebp - 4], 1
push dword [esi + 4]
call dword [0x4645c4]
test al, 1
mov esi, 0xa074
je 0x43ebdc
inc esi
jmp 0x43ebe5
test al, 2
je 0x43ebe5
mov esi, 0xa076
mov ecx, eax
and ecx, 0xc
cmp cl, 0xc
jne 0x43ebf2
or esi, 0x28
test al, 0x80
je 0x43ebf9
and esi, 0xffffffdf
push esi
mov esi, dword [ebp + 0x10]
sub esp, 0x10
lea eax, [ebp - 0x434]
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
push dword [ebp + 0xc]
movsd dword es:[edi], dword [esi]
call fcn.0043d33a
add esp, 0x1c
push dword [ebp - 0x10]
push dword [ebp + 0xc]
call ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.0041f170
mov ecx, dword [ebp - 0xc]
push 1
pop eax
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0x10
Function at 0x43f869
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
push 0x1850
push esi
push edi
call fcn.00452e6c
add esp, 0xc
cmp dword [ebp + 8], esi
mov dword [ebp + 0xc], esi
mov dword [ebp - 8], 3
je 0x43f9ba
push dword [ebp + 8]
mov esi, dword [0x464324]
lea eax, [ebp + 0xc]
push 1
push 4
pop ebx
push ebx
push eax
call esi
add esp, 0x10
test eax, eax
je 0x43f9ba
cmp dword [ebp + 0xc], 0x1850
jbe 0x43f8ca
push 1
pop eax
jmp 0x43f9bd
push dword [ebp + 0xc]
call fcn.00452e60
push ebx
push 0
push edi
mov dword [ebp - 0xc], eax
call fcn.00452e6c
push dword [ebp + 8]
push 1
push dword [ebp + 0xc]
push dword [ebp - 0xc]
call esi
mov esi, dword [ebp - 0xc]
and dword [ebp - 4], 0
add esp, 0x20
cmp byte [esi], 0x62
jne 0x43f996
mov eax, dword [ebp + 0xc]
cmp byte [esi + eax - 1], 0x65
jne 0x43f996
inc esi
push ebx
push esi
push edi
call fcn.00452e66
mov eax, dword [esi + ebx]
add esi, ebx
add esi, ebx
mov dword [edi + 4], eax
add esp, 0xc
mov eax, dword [esi]
add esi, ebx
mov dword [edi + 8], eax
mov eax, dword [esi]
add esi, ebx
cmp eax, 0x40
mov dword [ebp + 8], eax
ja 0x43f99f
push eax
lea eax, [edi + 0xc]
push esi
push eax
call fcn.00452e66
add esi, dword [ebp + 8]
add esp, 0xc
mov eax, dword [esi]
add esi, ebx
cmp eax, 0x800
mov dword [ebp + 8], eax
ja 0x43f99f
push eax
lea eax, [edi + 0x4c]
push esi
push eax
call fcn.00452e66
add esi, dword [ebp + 8]
add esp, 0xc
mov eax, dword [esi]
add esi, ebx
cmp eax, 0x1000
mov dword [ebp + 8], eax
ja 0x43f99f
push eax
lea eax, [edi + 0x84c]
push esi
push eax
call fcn.00452e66
mov eax, dword [ebp + 8]
add esp, 0xc
and dword [ebp - 8], 0
mov eax, dword [esi + eax]
mov dword [edi + 0x184c], eax
jmp 0x43f9a6
mov dword [ebp - 8], 1
jmp 0x43f9a6
mov dword [ebp - 4], 1
push dword [ebp - 0xc]
call fcn.00444c28
pop ecx
push 1
pop eax
cmp dword [ebp - 4], eax
jne 0x43f9ba
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x442db9
Capabilities:
Set registry value

Disassembly:
lea eax, [esp + 0xc]
push 4
push eax
push 4
push dword [esp + 0x14]
push dword [esp + 0x14]
push 0x80000002
call dword [0x464444]
neg eax
sbb eax, eax
inc eax
ret
Function at 0x450900
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x45090b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x450a0e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x467794]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x467794]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x467794]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x467794]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x467794]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x467794]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x467794]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x467794]
xor eax, edx
inc ecx
dec edi
jne 0x450926
pop edi
test esi, esi
je 0x450a30
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x467794]
xor eax, edx
inc ecx
dec esi
jne 0x450a12
pop esi
pop ebx
not eax
ret
Function at 0x45bdd0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret 4
Function at 0x45dda0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x401000
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push str.BINRES
push str.RCVMMAP64
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x401021
xor al, al
jmp 0x401079
push ebx
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0x43582c
push dword [ebp + 8]
mov ebx, eax
lea eax, [ebp - 4]
push eax
call fcn.00417a8b
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x40105f
xor al, al
jmp 0x401078
push dword [ebp - 4]
push esi
push 1
push ebx
call fcn.00417d22
push dword [ebp - 4]
call fcn.00417f07
add esp, 0x14
mov al, 1
pop ebx
pop esi
leave
ret
Function at 0x40275a
Capabilities:
Query environment variable
Set current directory

Disassembly:
cmp byte [esi + 0x214], 0
je 0x4027a3
xor eax, eax
cmp dword [esi + 0x208], eax
je 0x402894
cmp dword [esi + 0x20c], eax
je 0x402894
cmp dword [esi + 0x210], eax
je 0x402894
cmp dword [esi + 0x218], eax
je 0x402894
cmp dword [esi + 0x21c], eax
je 0x402894
inc eax
ret
push ebx
push ebp
xor ebx, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov byte [esi + 0x214], 1
mov dword [esi + 0x20c], ebx
mov dword [esi + 0x208], ebx
mov ebp, 0x104
push ebp
push esi
push dword [ebx + 0x436028]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push esi
call edi
mov dword [esi + 0x208], eax
test eax, eax
jne 0x4027eb
add ebx, 4
cmp ebx, 0x10
jb 0x4027c6
jmp 0x402819
push 0x5c
push esi
call fcn.00417b94
pop ecx
pop ecx
xor ecx, ecx
push esi
mov word [eax], cx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0x436038
push ebp
push esi
call fcn.00417da4
add esp, 0xc
push esi
call edi
mov dword [esi + 0x20c], eax
mov ecx, dword [esi + 0x208]
test ecx, ecx
je 0x40287e
mov eax, dword [esi + 0x20c]
test eax, eax
je 0x40287e
push 0x436050
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x210], eax
test eax, eax
je 0x402863
lea ecx, [esi + 0x218]
push ecx
push 0x436140
call eax
lea eax, [esi + 0x21c]
push eax
push 0x436150
call dword [esi + 0x210]
cmp dword [esi + 0x218], 0
je 0x40287a
cmp dword [esi + 0x21c], 0
je 0x40287a
xor eax, eax
inc eax
jmp 0x402891
xor eax, eax
jmp 0x402891
mov edi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ecx
call edi
push dword [esi + 0x20c]
call edi
xor al, al
pop edi
pop ebp
pop ebx
ret
Function at 0x40538a
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3d0]
sub esp, 0x450
mov eax, dword [0x43e054]
xor eax, ebp
mov dword [ebp + 0x3cc], eax
push ebx
push esi
mov esi, dword [0x44017c]
push 0x207
lea eax, [ebp - 0x44]
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40541d
push 0x3c
lea eax, [ebp - 0x80]
push ebx
push eax
call fcn.0041aab0
lea eax, [ebp - 0x44]
mov dword [ebp - 0x70], eax
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x3c
mov dword [ebp - 0x7c], 0x40
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], 0x438790
mov dword [ebp - 0x64], 5
mov dword [ebp - 0x6c], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x405412
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x40541b
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [ebp + 0x3cc]
pop esi
xor ecx, ebp
pop ebx
call fcn.004179b6
add ebp, 0x3d0
leave
ret

Function at 0x405434
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x43e054]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
push 8
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push 2
push dword [ebp - 0x14]
call esi
push dword [ebp - 0x18]
call fcn.0041a812
pop ecx
mov edi, eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
push edi
push 2
push dword [ebp - 0x14]
call esi
test eax, eax
je 0x4054f3
xor esi, esi
cmp dword [edi], ebx
jbe 0x4054ee
lea ebx, [edi + 8]
push dword [ebx - 4]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x4054e6
mov eax, dword [ebx]
test al, 4
je 0x4054e6
test eax, 0xffffffef
jne 0x4054ee
inc esi
add ebx, 8
cmp esi, dword [edi]
jb 0x4054c9
cmp esi, dword [edi]
setne bl
push edi
call fcn.0041a735
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.004179b6
leave
ret