joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10025360
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002868b
mov eax, dword fs:[0]
push eax
sub esp, 0x168
push esi
mov eax, dword [0x10040cf8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1004118c], 1
jne 0x1002540f
push 1
push 0x40
push 8
push 0x10038f74
lea ecx, [ebp - 0x174]
call fcn.100049c0
lea eax, [ebp - 0x174]
mov dword [ebp - 4], 0
push str._nHT_Scan:
push eax
call fcn.10004550
lea eax, [ebp - 0x174]
push 0x10038f98
push eax
call fcn.10004550
add esp, 0x10
lea ecx, [ebp - 0x170]
call fcn.100054a0
test eax, eax
jne 0x100253fd
push eax
mov eax, dword [ebp - 0x174]
lea ecx, [ebp - 0x174]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
lea ecx, [ebp - 0x174]
mov dword [ebp - 4], 0xffffffff
call fcn.10004fb0
cmp dword [0x1004119c], 1
jne 0x100254ee
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ucrtbased.dll__time64]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ucrtbased.dll__localtime64]
add esp, 8
lea ecx, [ebp - 0xc4]
mov esi, eax
push 1
push 0x40
push 8
push 0x10038fb0
call fcn.100049c0
lea eax, [ebp - 0xc4]
mov dword [ebp - 4], 1
push 0x10038fb4
push eax
call fcn.10004550
push esi
call dword [sym.imp.ucrtbased.dll_asctime]
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.10004550
lea eax, [ebp - 0xc4]
push str.HT_Scan:
push eax
call fcn.10004550
lea eax, [ebp - 0xc4]
push str.Hide_windows_detected_
push eax
call fcn.10004550
lea eax, [ebp - 0xc4]
push 0x10038fec
push eax
call fcn.10004550
add esp, 0x2c
lea ecx, [ebp - 0xc0]
call fcn.100054a0
test eax, eax
jne 0x100254d6
push eax
mov eax, dword [ebp - 0xc4]
lea ecx, [ebp - 0xc4]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
push 2
push 0x10039014
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xc4]
call fcn.10004fb0
mov eax, dword [0x10041190]
push 0
cmp eax, 1
jne 0x10025520
push 0
push 0
push 0x10025770
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x10025530
push 0
push 0
push 0x100256f0
jmp 0x10025503
cmp eax, 3
jne 0x10025540
push 0
push 0
push 0x100257f0
jmp 0x10025503
cmp eax, 4
jne 0x1002551a
push 0
push 0
push 0x10026220
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x200010
push str.H_Scan
push str.Generic_Hide_Window
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x10025518

Function at 0x10025580
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x100256b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x100255a0
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x209fc
call fcn.100274f0
mov eax, dword [0x10040cf8]
xor eax, esp
mov dword [esp + 0x209f8], eax
push ebp
push esi
push edi
xor esi, esi
xor ebp, ebp
push esi
push esi
call dword [sym.imp.USER32.dll_FindWindowA]
mov edi, eax
test edi, edi
je 0x10025681
push ebx
lea ebx, [esp + 0x414]
nop dword [eax]
push edi
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
jne 0x10025664
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [esp + 0x10]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
jne 0x10025664
mov eax, dword [esp + 0x10]
mov dword [ebx], eax
lea eax, [ebx + 4]
push 0xff
push eax
push edi
mov dword [ebx - 4], edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xff
lea eax, [ebx + 0x103]
push eax
push edi
call dword [sym.imp.USER32.dll_GetClassNameA]
mov ecx, dword [esp + 0x10]
inc ebp
add ebx, 0x208
xor eax, eax
test esi, esi
jle 0x1002565b
nop dword [eax]
cmp ecx, dword [esp + eax*4 + 0x14]
je 0x1002565b
inc eax
cmp eax, esi
jl 0x10025650
cmp eax, esi
jne 0x10025664
mov dword [esp + esi*4 + 0x14], ecx
inc esi
push 2
push edi
call dword [sym.imp.USER32.dll_GetWindow]
mov edi, eax
test edi, edi
jne 0x100255e0
pop ebx
test ebp, ebp
je 0x10025681
cmp esi, 1
jg 0x100256a1
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esp + 0x20a04]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.10026c20
add esp, 0x209fc
ret
call fcn.10025360
int3

Function at 0x10025820
Capabilities:
Create thread
Terminate process

Disassembly:
mov eax, dword [0x10041190]
cmp eax, 1
je 0x1002586c
cmp eax, 4
je 0x1002586c
push 0
cmp eax, 2
jne 0x1002585c
push 0
push 0
push 0x10025c30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 3
jne 0x10025856
push 0
push 0
push 0x10025c90
jmp 0x1002583f
push 0
push 0
push 0
push 0x10025c60
jmp 0x1002583f
Function at 0x10025c10
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x10025880
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x10025fa0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x10025cc0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x10025fc0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x10025f30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x10026010
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10029310
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
mov eax, dword [0x10040cf8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1004118c], 1
jne 0x100260b7
push 1
push 0x40
push 8
push 0x10039638
lea ecx, [ebp - 0xbc]
call fcn.100049c0
lea eax, [ebp - 0xbc]
mov dword [ebp - 4], 0
push str._nAKS_Scan:
push eax
call fcn.10004550
lea eax, [ebp - 0xbc]
push str.Thread_attack_
push eax
call fcn.10004550
add esp, 0x10
lea ecx, [ebp - 0xb8]
call fcn.100054a0
test eax, eax
jne 0x100260ac
push eax
mov eax, dword [ebp - 0xbc]
lea ecx, [ebp - 0xbc]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
lea ecx, [ebp - 0xbc]
call fcn.10004fb0
mov eax, dword [0x10041190]
cmp eax, 1
je 0x10026103
cmp eax, 4
je 0x10026103
push 0
cmp eax, 2
jne 0x100260f3
push 0
push 0
push 0x100262a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 3
jne 0x100260ed
push 0
push 0
push 0x10026340
jmp 0x100260d6
push 0
push 0
push 0
push 0x100262f0
jmp 0x100260d6
Function at 0x100266e0
Capabilities:
Encode data using xor
Terminate process

Disassembly:
sub esp, 0x14
mov eax, dword [0x10040cf8]
xor eax, esp
mov dword [esp + 0x10], eax
cmp dword [0x100411a0], 1
jne 0x10026788
movzx eax, word [0x449081]
push ebx
push esi
push eax
lea eax, [esp + 0x10]
push 0x1003999c
push eax
call fcn.10017810
mov dword [esp + 0x14], 0x100399a0
add esp, 0xc
mov ebx, dword [esp + 8]
mov esi, dword [esp + 8]
add esi, 0x14
cmp byte [ebx + 0x13], 0
je 0x1002676e
mov eax, dword [ebx + 0xf]
push ebp
inc eax
push edi
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ebp, dword [ebx + 0xf]
add esp, 4
xor edx, edx
mov edi, eax
test ebp, ebp
je 0x10026766
sub esi, edi
nop dword [eax]
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
cmp edx, ebp
jb 0x10026750
mov byte [edi + ebp], 0
mov esi, edi
pop edi
pop ebp
push 0x30
push esi
lea eax, [esp + 0x14]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, 0x7361
cmp word [0x449081], ax
jne 0x100267a7
mov ecx, dword [esp + 0x10]
xor al, al
xor ecx, esp
call fcn.10026c20
add esp, 0x14
ret
call fcn.10026380
int3

Function at 0x100268c0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x100267b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x100268e0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x10026900
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x401f60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401f79
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401fb4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x401fb0
lea ebx, [ebx]
cmp esi, edx
jae 0x401fb4
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x401fa0
cmp esi, edx
jb 0x401fbb
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4029f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
xor eax, eax
push ebx
push esi
push edi
jmp 0x402a00
mov edx, eax
and edx, 1
dec edx
not edx
and edx, 0xedb88320
mov ecx, eax
shr ecx, 1
xor edx, ecx
mov ecx, edx
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr edx, 1
xor ecx, edx
mov edx, ecx
and edx, 1
dec edx
shr ecx, 1
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr edx, 1
xor ecx, edx
mov edx, ecx
and edx, 1
dec edx
shr ecx, 1
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr edx, 1
xor ecx, edx
mov edx, ecx
and edx, 1
dec edx
shr ecx, 1
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr edx, 1
xor ecx, edx
mov dword [eax*4 + 0x466080], ecx
inc eax
cmp eax, 0x100
jb 0x402a00
cmp eax, 0x800
jae 0x402ad3
lea esp, [esp]
mov edx, dword [eax*4 + 0x465c80]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x466080]
inc eax
mov dword [eax*4 + 0x46607c], edx
cmp eax, 0x800
jb 0x402ab0
lea ecx, [ebp - 0x20]
mov dword [0x464ea8], 0x402b90
call fcn.00406680
test eax, eax
je 0x402b88
mov edi, dword [ebp - 0x10]
mov esi, edi
shr esi, 8
shr edi, 4
and esi, 0xff00f
and edi, 0xf00f
xor ecx, ecx
mov eax, 0x462310
xor edx, edx
lea ecx, [ecx]
mov ebx, dword [ebp - 0x1c]
cmp dword [eax - 8], ebx
jne 0x402b27
mov ebx, dword [ebp - 0x18]
cmp dword [eax - 4], ebx
mov ebx, dword [ebp - 0x14]
jne 0x402b27
cmp dword [eax], ebx
je 0x402b36
add edx, 0xc
inc ecx
add eax, 0xc
cmp edx, 0x24
jb 0x402b10
or ecx, 0xffffffff
sub ecx, 0
je 0x402b6f
dec ecx
je 0x402b5e
dec ecx
jne 0x402b88
cmp esi, 6
jb 0x402b88
jne 0x402b7e
cmp edi, 0xf
jb 0x402b88
mov dword [0x464ea8], 0x402c30
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 5
jb 0x402b88
jne 0x402b7e
cmp edi, 6
jb 0x402b88
cmp edi, 0xa
jmp 0x402b7c
cmp esi, 6
jb 0x402b88
jne 0x402b7e
cmp edi, 0x100c
je 0x402b88
mov dword [0x464ea8], 0x402c30
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403740
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, edx
mov esi, dword [edi]
mov dword [ebp - 4], ecx
test esi, esi
je 0x40379f
mov dword [edi], 0
mov edx, 0x400000
push 0
lea eax, [ebp + 8]
push eax
mov eax, esi
cmp esi, 0x400000
cmova eax, edx
push eax
push ebx
push dword [ecx]
mov dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 8]
add dword [edi], ecx
add ebx, ecx
sub esi, ecx
test eax, eax
je 0x4037a8
test ecx, ecx
je 0x40379f
mov ecx, dword [ebp - 4]
mov edx, 0x400000
test esi, esi
jne 0x403760
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4037c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, edx
mov esi, dword [edi]
mov dword [ebp - 4], ecx
test esi, esi
je 0x40381f
mov dword [edi], 0
mov edx, 0x400000
push 0
lea eax, [ebp + 8]
push eax
mov eax, esi
cmp esi, 0x400000
cmova eax, edx
push eax
push ebx
push dword [ecx]
mov dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 8]
add dword [edi], ecx
add ebx, ecx
sub esi, ecx
test eax, eax
je 0x403828
test ecx, ecx
je 0x40381f
mov ecx, dword [ebp - 4]
mov edx, 0x400000
test esi, esi
jne 0x4037e0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4064e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
push ebx
mov eax, dword [eax]
push esi
mov esi, ecx
xor ebx, ebx
and eax, 7
mov dword [ebp - 4], esi
cmp edx, 5
jae 0x406504
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
add dword [ebp + 8], 5
push edi
add edx, 0xfffffffc
or edi, 0xffffffff
add edx, esi
mov dword [ebp - 8], edx
add esi, ebx
mov dword [ebp - 0xc], esi
cmp esi, edx
jae 0x406532
lea ecx, [ecx]
mov cl, byte [esi]
and cl, 0xfe
cmp cl, 0xe8
je 0x40652f
inc esi
cmp esi, edx
jb 0x406520
mov dword [ebp - 0xc], esi
mov ebx, esi
sub ebx, dword [ebp - 4]
mov ecx, ebx
sub ecx, edi
cmp esi, edx
jae 0x406657
cmp ecx, 3
jbe 0x40654c
xor eax, eax
jmp 0x40658a
dec ecx
shl eax, cl
and eax, 7
je 0x40658a
movzx ecx, byte [eax + 0x451c98]
mov edx, esi
sub edx, ecx
cmp byte [eax + 0x451c90], 0
mov cl, byte [edx + 4]
je 0x406574
test cl, cl
je 0x406574
cmp cl, 0xff
jne 0x406587
mov edx, dword [ebp - 8]
mov esi, dword [ebp - 4]
and eax, 3
add eax, eax
mov edi, ebx
or eax, 1
inc ebx
jmp 0x406514
mov edx, dword [ebp - 8]
mov cl, byte [esi + 4]
mov edi, ebx
mov dword [ebp - 0x18], edi
test cl, cl
je 0x4065ac
cmp cl, 0xff
je 0x4065ac
mov esi, dword [ebp - 4]
and eax, 3
add eax, eax
or eax, 1
inc ebx
jmp 0x406514
movzx edi, cl
movzx ecx, byte [esi + 3]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 2]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 1]
mov esi, dword [ebp + 8]
shl edi, 8
or edi, ecx
lea ecx, [ecx]
cmp dword [ebp + 0x10], 0
je 0x4065dd
lea edx, [edi + ebx]
add edx, esi
jmp 0x4065e3
mov edx, edi
sub edx, ebx
sub edx, esi
test eax, eax
je 0x406621
movzx edi, byte [eax + 0x451c98]
shl edi, 3
mov ecx, 0x18
sub ecx, edi
mov dword [ebp - 0x14], edi
mov edi, edx
shr edi, cl
mov ecx, edi
mov dword [ebp - 0x10], edi
test cl, cl
je 0x40660d
cmp cl, 0xff
jne 0x406621
mov ecx, 0x20
sub ecx, dword [ebp - 0x14]
mov edi, 1
shl edi, cl
dec edi
xor edi, edx
jmp 0x4065d0
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x18]
mov ecx, edx
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [esi + 4], cl
mov ecx, edx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, edx
shr ecx, 8
mov byte [esi + 1], dl
mov edx, dword [ebp - 8]
mov byte [esi + 2], cl
mov esi, dword [ebp - 4]
add ebx, 5
jmp 0x406514
pop edi
cmp ecx, 3
jbe 0x40666c
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov dword [ecx], eax
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
dec ecx
shl eax, cl
mov ecx, dword [ebp + 0xc]
pop esi
and eax, 7
mov dword [ecx], eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408480
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x4611f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x103
lea eax, [ebp - 0x10f]
push 0
push eax
mov ebx, edx
mov esi, ecx
mov byte [ebp - 0x110], 0
call fcn.00434de0
lea ecx, [ebp - 0x110]
add esp, 0xc
sub ecx, esi
nop
mov al, byte [esi]
mov byte [ecx + esi], al
lea esi, [esi + 1]
test al, al
jne 0x4084c0
lea edi, [ebp - 0x110]
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x4084d3
mov ax, word [0x4548a0]
push ecx
mov edx, ebx
lea ecx, [ebp - 0x118]
mov word [edi], ax
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x114], 0
call fcn.004083c0
mov ebx, dword [ebp - 0x118]
mov edx, ebx
add esp, 4
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x408515
lea edi, [ebp - 0x110]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x408525
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
push ebx
push 0x462334
rep movsb byte es:[edi], byte [esi]
call dword [0x462338]
add esp, 8
lea eax, [ebp - 0x110]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x408570
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00431c68
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00431c68
mov esp, ebp
pop ebp
ret
Function at 0x40a3a0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4611f4]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x40a3d5
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00431c68
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x10]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 0x18]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
xor ecx, ebp
inc eax
call fcn.00431c68
mov esp, ebp
pop ebp
ret
Function at 0x40a790
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push str.BFVCenterSetupMutex
xor edi, edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
test esi, esi
jne 0x40a7b0
pop edi
pop esi
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40a7ca
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
call fcn.0040a7e0
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebp
ret 0x10

Function at 0x40a7e0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x194
push ebx
push esi
push edi
mov ebx, edx
mov edi, ecx
call fcn.0040a430
test eax, eax
je 0x40a8ce
push 0x462378
mov dword [0x4649d8], edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor eax, eax
push 0x18e
push eax
mov word [esp + 0x18], ax
lea eax, [esp + 0x1a]
push eax
call fcn.00434de0
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [0x4649a4], edi
call fcn.0040a3a0
mov ecx, ebx
call fcn.0040a2f0
push 0x24
call fcn.00431c77
mov esi, eax
add esp, 4
test esi, esi
je 0x40a896
mov dword [esi + 0xc], 1
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi], vtable.CMyUIThread.0
mov dword [esi + 0x20], 1
jmp 0x40a898
xor esi, esi
push ecx
push ebx
push edi
mov ecx, esi
call fcn.00428a80
test esi, esi
je 0x40a8ae
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [0x4649e4]
test eax, eax
je 0x40a8ce
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x4649e4], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40aff0
Capabilities:
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ecx, dword [ebp + 8]
push 0
push 0x451c88
call fcn.00402300
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 5
push 0xffffffffffffffff
push 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
call dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
test eax, eax
je 0x40b06e
mov edx, dword [ebp - 4]
test edx, edx
jne 0x40b036
xor ecx, ecx
jmp 0x40b050
mov ecx, edx
push edi
lea edi, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40b040
sub ecx, edi
sar ecx, 1
pop edi
push ecx
mov ecx, dword [ebp + 8]
push edx
call fcn.00402300
push dword [ebp - 4]
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov eax, 1
mov esp, ebp
pop ebp
ret 4
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x40bef0
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create two anonymous pipes
Execute shell command and capture output
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
mov eax, dword [0x4611f4]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreatePipe]
push 0
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x118]
push eax
xorps xmm0, xmm0
lea eax, [ebp - 0x128]
movq qword [ebp - 0x130], xmm0
push eax
mov esi, ecx
mov dword [ebp - 0x134], 0xc
mov dword [ebp - 0x12c], 1
call edi
test eax, eax
je 0x40c0a2
push 0
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x11c]
push eax
call edi
test eax, eax
je 0x40c0a2
push 0x44
lea eax, [ebp - 0x18c]
push 0
push eax
call fcn.00434de0
xor eax, eax
mov word [ebp - 0x15c], ax
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x118]
push 0x103
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x150], eax
lea eax, [ebp - 0x113]
push 0
push eax
mov dword [ebp - 0x160], 0x101
mov byte [ebp - 0x114], 0
call fcn.00434de0
add esp, 0x18
lea eax, [ebp - 0x114]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.cmd.exe
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0
call fcn.0040c140
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x18c]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
lea eax, [ebp - 0x114]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edi, dword [ebp - 0x120]
test eax, eax
setne bl
test edi, edi
je 0x40c05d
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.Wow64RevertWow64FsRedirection
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40c05d
push edi
call eax
push dword [ebp - 0x118]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x11c]
call edi
test bl, bl
je 0x40c0a2
push dword [ebp - 0x140]
call edi
mov eax, dword [ebp - 0x13c]
mov dword [esi], eax
mov eax, dword [ebp - 0x144]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x128]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x124]
mov dword [esi + 0xc], eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00431c68
mov esp, ebp
pop ebp
ret 4
Function at 0x40c0c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], ecx
test edi, edi
je 0x40c12c
mov esi, edi
lea edx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x40c0d5
sub esi, edx
je 0x40c12c
push 0
lea eax, [ebp + 8]
push eax
push esi
push edi
push dword [ecx + 0xc]
mov dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp byte [esi + edi - 1], 0xa
je 0x40c11f
push 0
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp - 4]
push 1
push 0x4548a8
push dword [eax + 0xc]
mov dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 4
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4