joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a4d5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00405ad3
and dword [ebp - 4], 0
cmp dword [0x41d3d0], 0
mov ebx, eax
jne 0x40a586
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40a637
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x415c00
push edi
call esi
test eax, eax
je 0x40a637
push eax
call fcn.00405a61
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x41d3d0], eax
call esi
push eax
call fcn.00405a61
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x41d3d4], eax
call esi
push eax
call fcn.00405a61
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x41d3d8], eax
call esi
push eax
call fcn.00405a61
pop ecx
mov dword [0x41d3e0], eax
test eax, eax
je 0x40a586
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00405a61
pop ecx
mov dword [0x41d3dc], eax
mov eax, dword [0x41d3dc]
cmp eax, ebx
je 0x40a5de
cmp dword [0x41d3e0], ebx
je 0x40a5de
push eax
call fcn.00405adc
push dword [0x41d3e0]
mov esi, eax
call fcn.00405adc
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40a5de
test edi, edi
je 0x40a5de
call esi
test eax, eax
je 0x40a5d5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40a5d5
test byte [ebp - 0xc], 1
jne 0x40a5de
or dword [ebp + 0x10], 0x200000
jmp 0x40a617
mov eax, dword [0x41d3d4]
cmp eax, ebx
je 0x40a617
push eax
call fcn.00405adc
pop ecx
test eax, eax
je 0x40a617
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40a617
mov eax, dword [0x41d3d8]
cmp eax, ebx
je 0x40a617
push eax
call fcn.00405adc
pop ecx
test eax, eax
je 0x40a617
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41d3d0]
call fcn.00405adc
pop ecx
test eax, eax
je 0x40a637
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40a639
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40ced0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x41b2a0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x238], ax
push 0x22e
push 0
lea ecx, [ebp - 0x236]
push ecx
call fcn.00402490
add esp, 0xc
mov dword [ebp - 0x240], 0xffffffff
cmp dword [ebp + 0xc], 0
jle 0x40cf71
lea edx, [ebp - 0x238]
push edx
push 0x118
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x238]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x238]
push ecx
call fcn.004013e0
add esp, 0x10
test eax, eax
jne 0x40cf6d
mov dword [ebp - 0x240], 0
lea edx, [ebp - 0x238]
push edx
mov eax, dword [ebp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x40cf71
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp - 0x240]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402474
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40f660
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x41b2a0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x41c020], 0xffffffff
je 0x40f75a
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [ebp - 0x40c]
push ecx
movzx edx, word [ebp - 0x40e]
push edx
movzx eax, word [ebp - 0x410]
push eax
movzx ecx, word [ebp - 0x412]
push ecx
movzx edx, word [ebp - 0x416]
push edx
movzx eax, word [ebp - 0x418]
push eax
push str.__04d__02d__02d__02d:_02d:_02d__
lea ecx, [ebp - 0x408]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x20
lea edx, [ebp + 0xc]
mov dword [ebp - 0x420], edx
mov eax, dword [ebp - 0x420]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x3f2]
push edx
call dword [sym.imp.USER32.dll_wvsprintfA]
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
jle 0x40f749
mov dword [ebp - 0x424], 0
push 0x418fa0
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
lea ecx, [ebp - 0x424]
push ecx
lea edx, [ebp - 0x408]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x408]
push eax
mov ecx, dword [0x41c020]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x420], 0
jmp 0x40f75a
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402474
mov esp, ebp
pop ebp
ret

Function at 0x40f770
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc24
mov eax, dword [0x41b2a0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x41c020], 0xffffffff
je 0x40f8a3
lea eax, [ebp - 0xc18]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0x400
push 0
lea ecx, [ebp - 0xc08]
push ecx
call fcn.00402490
add esp, 0xc
movzx edx, word [ebp - 0xc0c]
push edx
movzx eax, word [ebp - 0xc0e]
push eax
movzx ecx, word [ebp - 0xc10]
push ecx
movzx edx, word [ebp - 0xc12]
push edx
movzx eax, word [ebp - 0xc16]
push eax
movzx ecx, word [ebp - 0xc18]
push ecx
push 0x418f38
lea edx, [ebp - 0x808]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x20
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc20], eax
mov ecx, dword [ebp - 0xc20]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x7dc]
push eax
call dword [sym.imp.USER32.dll_wvsprintfW]
mov dword [ebp - 0xc1c], eax
cmp dword [ebp - 0xc1c], 0
jle 0x40f892
mov dword [ebp - 0xc24], 0
push 0
push 0
push 0x3ff
lea ecx, [ebp - 0xc08]
push ecx
push 0xffffffffffffffff
lea edx, [ebp - 0x808]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0x418f34
lea eax, [ebp - 0xc08]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
lea ecx, [ebp - 0xc24]
push ecx
lea edx, [ebp - 0xc08]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0xc08]
push eax
mov ecx, dword [0x41c020]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0xc20], 0
jmp 0x40f8a3
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402474
mov esp, ebp
pop ebp
ret
Function at 0x40fd60
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 1
jne 0x40fd86
mov dword [ebp - 4], str.RootCIMV2
jmp 0x40fd8d
mov dword [ebp - 4], str.RootWMI
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x210], 0
jne 0x40fde0
push 2
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x20c], eax
mov edx, dword [ebp - 0x18]
cmp dword [edx + 0x20c], 0
je 0x40fde0
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x20c], 1
je 0x40fde0
mov ecx, dword [ebp - 0x18]
mov dword [ecx], str._CoInitializeEx_Call_Error
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 1
jmp 0x40ff55
mov edx, dword [ebp - 0x18]
cmp dword [edx + 0x210], 0
jne 0x40fe57
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x20c], eax
mov edx, dword [ebp - 0x18]
cmp dword [edx + 0x20c], 0
je 0x40fe4a
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x20c], 0x80010119
je 0x40fe4a
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 0x18]
mov dword [ecx], str._CoInitializeSecurity_Call_Error
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 2
jmp 0x40ff55
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x210], 1
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x214], 0
jne 0x40febb
mov dword [ebp - 0x10], 7
mov ecx, dword [ebp - 0x18]
add ecx, 0x214
push ecx
push 0x415cb0
mov edx, dword [ebp - 0x10]
push edx
push 0
push 0x415d80
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x20c], eax
mov edx, dword [ebp - 0x18]
cmp dword [edx + 0x20c], 0
je 0x40febb
mov eax, dword [ebp - 0x18]
mov dword [eax], str._CoCreateInstance_Call_Error
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 3
jmp 0x40ff55
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 0x218], 0
jne 0x40ff4e
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
add eax, 0x218
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x214]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x214]
mov eax, dword [eax]
push edx
mov ecx, dword [eax + 0xc]
call ecx
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x20c], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x20c], 0
je 0x40ff44
mov ecx, dword [ebp - 0x18]
mov dword [ecx], str._ConnectServer_Call_Error
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x218], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 4
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x40ff55
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x410190
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 4], 0x3c
mov byte [ebp - 3], 0x49
mov byte [ebp - 2], 0x44
mov byte [ebp - 1], 0x3e
push 4
lea eax, [ebp - 4]
push eax
push 0x434974
call fcn.00403b90
add esp, 0xc
mov byte [ebp - 4], 0x37
mov byte [ebp - 3], 0x3c
mov byte [ebp - 2], 0x2f
mov byte [ebp - 1], 0x49
push 4
lea ecx, [ebp - 4]
push ecx
push 0x434978
call fcn.00403b90
add esp, 0xc
mov byte [ebp - 4], 0x44
mov byte [ebp - 3], 0x3e
mov byte [ebp - 2], 0
mov byte [ebp - 1], 0
push 4
lea edx, [ebp - 4]
push edx
push 0x43497c
call fcn.00403b90
add esp, 0xc
mov byte [ebp - 4], 0x3c
mov byte [ebp - 3], 0x49
mov byte [ebp - 2], 0x44
mov byte [ebp - 1], 0x3e
push 4
lea eax, [ebp - 4]
push eax
push 0x434984
call fcn.00403b90
add esp, 0xc
mov byte [ebp - 4], 0x34
mov byte [ebp - 3], 0x30
mov byte [ebp - 2], 0x3c
mov byte [ebp - 1], 0x2f
push 4
lea ecx, [ebp - 4]
push ecx
push 0x434988
call fcn.00403b90
add esp, 0xc
mov byte [ebp - 4], 0x49
mov byte [ebp - 3], 0x44
mov byte [ebp - 2], 0x3e
mov byte [ebp - 1], 0
push 4
lea edx, [ebp - 4]
push edx
push 0x43498c
call fcn.00403b90
add esp, 0xc
mov byte [ebp - 4], 0x3c
mov byte [ebp - 3], 0x49
mov byte [ebp - 2], 0x44
mov byte [ebp - 1], 0x3e
push 4
lea eax, [ebp - 4]
push eax
push 0x434994
call fcn.00403b90
add esp, 0xc
mov byte [ebp - 4], 0x31
mov byte [ebp - 3], 0x30
mov byte [ebp - 2], 0x31
mov byte [ebp - 1], 0x3c
push 4
lea ecx, [ebp - 4]
push ecx
push 0x434998
call fcn.00403b90
add esp, 0xc
mov byte [ebp - 4], 0x2f
mov byte [ebp - 3], 0x49
mov byte [ebp - 2], 0x44
mov byte [ebp - 1], 0x3e
push 4
lea edx, [ebp - 4]
push edx
push 0x43499c
call fcn.00403b90
add esp, 0xc
mov byte [ebp - 4], 0x3c
mov byte [ebp - 3], 0x49
mov byte [ebp - 2], 0x44
mov byte [ebp - 1], 0x3e
push 4
lea eax, [ebp - 4]
push eax
push 0x4349a4
call fcn.00403b90
add esp, 0xc
mov byte [ebp - 4], 0x35
mov byte [ebp - 3], 0x30
mov byte [ebp - 2], 0x33
mov byte [ebp - 1], 0x3c
push 4
lea ecx, [ebp - 4]
push ecx
push 0x4349a8
call fcn.00403b90
add esp, 0xc
mov byte [ebp - 4], 0x2f
mov byte [ebp - 3], 0x49
mov byte [ebp - 2], 0x44
mov byte [ebp - 1], 0x3e
push 4
lea edx, [ebp - 4]
push edx
push 0x4349ac
call fcn.00403b90
add esp, 0xc
mov byte [ebp - 4], 0x3c
mov byte [ebp - 3], 0x49
mov byte [ebp - 2], 0x44
mov byte [ebp - 1], 0x3e
push 4
lea eax, [ebp - 4]
push eax
push 0x4349b4
call fcn.00403b90
add esp, 0xc
mov byte [ebp - 4], 0x31
mov byte [ebp - 3], 0x34
mov byte [ebp - 2], 0x3c
mov byte [ebp - 1], 0x2f
push 4
lea ecx, [ebp - 4]
push ecx
push 0x4349b8
call fcn.00403b90
add esp, 0xc
mov byte [ebp - 4], 0x49
mov byte [ebp - 3], 0x44
mov byte [ebp - 2], 0x3e
mov byte [ebp - 1], 0
push 4
lea edx, [ebp - 4]
push edx
push 0x4349bc
call fcn.00403b90
add esp, 0xc
call fcn.00410100
mov esp, ebp
pop ebp
ret 4
Function at 0x4103b0
Capabilities:
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x18]
push ecx
push 1
push 0
push 0
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
test eax, eax
jne 0x410403
mov dword [ebp - 0x14], 0xffffffff
jmp 0x4104cd
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], 0
jmp 0x41041e
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0xc]
jae 0x4104c6
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x10]
push edx
push 5
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xc
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + eax]
push edx
push 0
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
jne 0x41045c
mov dword [ebp - 0x14], 0xfffffffe
jmp 0x4104c6
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xc
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + eax]
cmp edx, dword [ebp - 4]
jne 0x410484
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x10]
push ecx
push 0x433e20
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x4104ab
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [0x433e18]
shl eax, 8
add eax, 0x433f20
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [0x433e18]
add ecx, 1
mov dword [0x433e18], ecx
cmp dword [ebp - 0x10], 0
je 0x4104c1
mov edx, dword [ebp - 0x10]
push edx
call sub.WTSAPI32.dll_WTSFreeMemory
mov dword [ebp - 0x10], 0
jmp 0x410415
jmp 0x4104cd
cmp dword [ebp - 0x10], 0
je 0x4104dc
mov eax, dword [ebp - 0x10]
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
cmp dword [ebp - 0x18], 0
je 0x4104eb
mov ecx, dword [ebp - 0x18]
push ecx
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 4
Function at 0x4120a0
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x41b2a0]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x214], 0x100
mov dword [ebp - 0x218], 0
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x218]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov edx, dword [ebp - 0x218]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov edx, dword [ebp + 0x10]
cmp dword [edx], 0
jne 0x41211a
mov dword [ebp - 4], 0
jmp 0x412163
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x412163
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00402474
mov esp, ebp
pop ebp
ret 0xc
Function at 0x412430
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x41b2a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x114], 1
mov dword [ebp - 0x110], 0x7c
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [0x41c03c], eax
push 0x100
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.00402490
add esp, 0xc
push 0x100
push 0
lea ecx, [ebp - 0x218]
push ecx
call fcn.00402490
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x412586
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [ebp - 0x21c], 0
jmp 0x4124d9
mov eax, dword [ebp - 0x21c]
add eax, 1
mov dword [ebp - 0x21c], eax
mov ecx, dword [ebp - 0x21c]
movzx edx, word [ebp + ecx*2 - 0x218]
test edx, edx
je 0x412532
mov eax, dword [ebp - 0x21c]
movzx ecx, word [ebp + eax*2 - 0x218]
cmp ecx, 0x61
jl 0x412530
mov edx, dword [ebp - 0x21c]
movzx eax, word [ebp + edx*2 - 0x218]
cmp eax, 0x7a
jg 0x412530
mov ecx, dword [ebp - 0x21c]
movzx edx, word [ebp + ecx*2 - 0x218]
sub edx, 0x20
mov eax, dword [ebp - 0x21c]
mov word [ebp + eax*2 - 0x218], dx
jmp 0x4124ca
lea ecx, [ebp - 0x218]
push ecx
push str.ADMINISTRATOR
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x412553
xor edx, edx
mov word [0x433148], dx
jmp 0x412586
lea eax, [ebp - 0x218]
push eax
push 0x419488
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x412574
xor ecx, ecx
mov word [0x433148], cx
jmp 0x412586
lea edx, [ebp - 0x108]
push edx
push 0x433148
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [ebp + 8]
push eax
call fcn.00412180
push 0x419498
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jne 0x4125cf
push 0x4194b4
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jne 0x4125cf
mov dword [0x41c840], 2
jmp 0x412609
cmp dword [ebp - 0x10c], 0
je 0x412602
push str.AddAccessAllowedAceEx
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x41c840], eax
cmp dword [0x41c840], 0
jne 0x412602
mov dword [0x41c840], 3
jmp 0x412609
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402474
mov esp, ebp
pop ebp
ret 4
Function at 0x401260
Capabilities:
Encode data using xor
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x40b008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
push 0x104
mov dword [ebp - 0x11c], esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
dec eax
cmp eax, 0x102
ja 0x4012a2
lea eax, [ebp - 0x108]
jmp 0x401423
mov eax, dword [0x4083e8]
movq xmm0, qword [str.v_f_QWTKNjZ_1B]
mov dword [ebp - 0x110], eax
mov ax, word [0x4083ec]
movq qword [ebp - 0x118], xmm0
mov word [ebp - 0x10c], ax
test ah, ah
je 0x40141d
xor ecx, ecx
cmp dword [0x40b6cc], 2
jl 0x4013f0
movaps xmm2, xmmword [0x4084e0]
mov eax, 5
movaps xmm3, xmmword [0x408530]
movaps xmm1, xmm2
punpckldq xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
mov ecx, 8
pmuldq xmm1, xmm3
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
movd xmm4, eax
psrad xmm1, xmm4
mov eax, 0x1f
movaps xmm0, xmm1
movd xmm5, eax
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x408500]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movaps xmm2, xmmword [0x4084f0]
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
andps xmm1, xmmword [0x408510]
movd xmm0, dword [str.v_f_QWTKNjZ_1B]
packuswb xmm1, xmm1
paddb xmm1, xmmword [str.5555555555555555]
xorps xmm1, xmm0
movaps xmm0, xmm2
movd dword [ebp - 0x118], xmm1
movaps xmm1, xmm2
punpckldq xmm1, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm1, xmm3
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm4
movaps xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x408500]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
andps xmm1, xmmword [0x408510]
movd xmm0, dword [ebp - 0x114]
packuswb xmm1, xmm1
paddb xmm1, xmmword [str.5555555555555555]
xorps xmm1, xmm0
movd dword [ebp - 0x114], xmm1
nop
mov eax, 0x8fb823ef
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dl, cl
movsx eax, al
imul eax, eax, 0x39
sub dl, al
add dl, 0x35
xor byte [ebp + ecx - 0x118], dl
inc ecx
cmp ecx, 0xe
jl 0x4013f0
lea eax, [ebp - 0x118]
push eax
mov ecx, esi
call fcn.00404540
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00406209
mov esp, ebp
pop ebp
ret 4
Function at 0x403c40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x403c6c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x403c94
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x403c9a
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x403d02
jg 0x403cb1
test esi, esi
je 0x403d02
test ecx, ecx
jl 0x403cfd
jg 0x403cbb
test eax, eax
je 0x403cfd
cmp edi, ecx
jg 0x403ccf
jl 0x403cc5
cmp esi, eax
jae 0x403ccf
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x403d05
mov ecx, dword [ebp + 8]
jmp 0x403d0f
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x403d29
jg 0x403d0f
test esi, esi
je 0x403d29
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x403d29
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x403d40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [esp + 8], esi
push edi
test eax, eax
jg 0x403d72
jl 0x403d65
test ecx, ecx
jne 0x403d72
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x403d8c
push eax
push ecx
push esi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
mov edi, ecx
mov eax, dword [eax]
mov dword [esp + 0x10], eax
test eax, eax
je 0x403ddf
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [esp + 0x14], edx
mov eax, dword [eax]
test eax, eax
je 0x403de6
mov edi, dword [esp + 0xc]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [esp + 0x14]
push edi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x18], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [esp + 0xc]
jmp 0x403de6
lea eax, [ebx + 0x2c]
mov dword [esp + 0x14], eax
cmp dword [ebx + 0x4c], 0
je 0x403e56
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x403e10
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x403e44
nop dword [eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x403e56
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x403e20
test edi, edi
je 0x403e56
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc