joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c8360
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x6ece84]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0x53000000
movaps xmm0, xmmword [0x68d710]
movups xmmword [ebp - 0x20], xmm0
push ebx
movaps xmm0, xmmword [str.42E6214F_10D0_48C6_B217_6C6FCBEDeviceNamedPip200]
mov ebx, dword [ebp + 0xc]
movups xmmword [ebp - 0x48], xmm0
push esi
movaps xmm0, xmmword [0x68d700]
mov esi, dword [ebp + 8]
mov edx, esi
mov dword [ebp - 0x10], 0x68635c65
mov dword [ebp - 0xc], 0x656d6f72
mov word [ebp - 8], 0x2e
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x28], 0x34363135
mov word [ebp - 0x24], 0x7d36
mov byte [ebp - 0x22], 0
jae 0x5c83ec
lea ecx, [ebp - 0x20]
mov eax, ecx
sub edx, eax
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x5c83d0
lea ecx, [ebp - 0x20]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5c83e3
jmp 0x5c840d
lea ecx, [ebp - 0x48]
mov eax, ecx
sub edx, eax
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x5c83f3
lea ecx, [ebp - 0x48]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5c8406
push dword [ebp + 0x10]
sub ecx, edx
lea eax, [esi + ecx]
push eax
call fcn.005c8160
add esp, 8
test eax, eax
jne 0x5c8432
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005e9f40
mov esp, ebp
pop ebp
ret
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x5c8435
sub esi, ecx
mov eax, 1
mov ecx, dword [ebp - 4]
mov dword [ebx], esi
xor ecx, ebp
pop esi
pop ebx
call fcn.005e9f40
mov esp, ebp
pop ebp
ret

Function at 0x5c8460
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
nop dword [eax + eax]
mov byte [eax + esi], al
inc eax
cmp eax, 0x100
jl 0x5c8470
xor eax, eax
xor edi, edi
mov word [esi + 0x100], ax
xor bh, bh
mov eax, edi
mov bl, byte [edi + esi]
cdq
idiv dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
movzx eax, byte [edx + eax]
add al, bl
add bh, al
movzx ecx, bh
movzx eax, byte [ecx + esi]
mov byte [edi + esi], al
inc edi
mov byte [ecx + esi], bl
cmp edi, 0x100
jl 0x5c8488
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x5c84c0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0x14]
test edi, edi
jle 0x5c8540
mov ecx, dword [ebp + 0x10]
sub dword [ebp + 0xc], ecx
mov eax, dword [ebp + 8]
push ebx
lea edx, [ecx - 1]
push esi
nop dword [eax]
inc byte [eax + 0x100]
inc edx
movzx esi, byte [eax + 0x100]
mov dword [ebp + 0x14], edx
movzx ecx, byte [esi + eax]
add byte [eax + 0x101], cl
movzx edx, byte [eax + 0x101]
mov bl, byte [esi + eax]
movzx ecx, byte [edx + eax]
mov byte [esi + eax], cl
mov byte [edx + eax], bl
movzx ecx, byte [eax + 0x100]
movzx edx, byte [eax + 0x101]
mov ebx, dword [ebp + 0xc]
movzx ecx, byte [ecx + eax]
add cl, byte [edx + eax]
mov edx, dword [ebp + 0x14]
movzx ecx, cl
movzx ecx, byte [ecx + eax]
xor cl, byte [edx + ebx]
mov byte [edx], cl
mov ecx, edi
dec edi
cmp ecx, 1
jne 0x5c84e0
pop esi
pop ebx
pop edi
pop ebp
ret
Function at 0x5c9880
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
mov eax, dword [0x6ece84]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x18]
lea eax, [ebp - 0x48]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
push 0x41
push 0
push eax
call fcn.00607da0
push dword [ebp + 0x14]
lea eax, [ebp - 0x48]
push esi
push eax
call fcn.006072a0
movaps xmm2, xmmword [str._r_n]
lea eax, [ebp - 0xb8]
movups xmm0, xmmword [ebp - 0x48]
mov dword [ebp - 0xb8], 0x67452301
push dword [ebp + 0xc]
movaps xmm1, xmm2
mov dword [ebp - 0xb4], 0xefcdab89
pxor xmm1, xmm0
mov dword [ebp - 0xb0], 0x98badcfe
movups xmm0, xmmword [ebp - 0x38]
push edi
movups xmmword [ebp - 0x48], xmm1
mov dword [ebp - 0xac], 0x10325476
movaps xmm1, xmm2
mov dword [ebp - 0xa8], 0xc3d2e1f0
pxor xmm1, xmm0
mov dword [ebp - 0xa0], 0
movups xmm0, xmmword [ebp - 0x28]
push eax
movups xmmword [ebp - 0x38], xmm1
mov dword [ebp - 0xa4], 0
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmm0, xmmword [ebp - 0x18]
movups xmmword [ebp - 0x28], xmm1
pxor xmm2, xmm0
movups xmmword [ebp - 0x18], xmm2
call fcn.005c97d0
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.005c8550
push 0x40
lea eax, [ebp - 0x48]
mov dword [ebp - 0xb8], 0x67452301
push eax
lea eax, [ebp - 0xb8]
mov dword [ebp - 0xb4], 0xefcdab89
push eax
mov dword [ebp - 0xb0], 0x98badcfe
mov dword [ebp - 0xac], 0x10325476
mov dword [ebp - 0xa8], 0xc3d2e1f0
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0xa4], 0
call fcn.005c97d0
push 0x14
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0xb8]
push eax
call fcn.005c97d0
add esp, 0x44
lea eax, [ebp - 0xb8]
push eax
push ebx
call fcn.005c8550
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.005e9f40
mov esp, ebp
pop ebp
ret
Function at 0x5de5b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, ecx
test ebx, ebx
jne 0x5de5d0
push ebx
push ebx
push ebx
push 2
call fcn.005e0a30
pop edi
xor al, al
pop ebx
pop ebp
ret 8
push esi
mov esi, dword [edi + 0x18]
test esi, esi
je 0x5de5e7
mov ecx, esi
mov esi, dword [esi + 0x28]
push 1
mov eax, dword [ecx]
call dword [eax]
test esi, esi
jne 0x5de5d8
push 2
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
push 0
push ebx
mov dword [edi + 8], 0xffffffff
mov dword [edi + 4], 0xffffffff
call fcn.0060bae6
push ebx
call fcn.00611e88
push 0
mov esi, eax
push 0
push ebx
mov dword [ebp + 8], esi
call fcn.0060bae6
add esp, 0x1c
test esi, esi
jg 0x5de641
push 0
push 0
push 0
push 0xc
mov ecx, edi
call fcn.005e0a30
pop esi
pop edi
xor al, al
pop ebx
pop ebp
ret 8
lea eax, [esi + 1]
push eax
call fcn.005ea3bc
push ebx
mov ebx, dword [ebp + 8]
mov esi, eax
push 1
push ebx
push esi
mov byte [esi], 0
call fcn.0060b6a5
add esp, 0x14
cmp eax, 1
je 0x5de685
push esi
call fcn.005e9ca1
add esp, 4
mov ecx, edi
push 0
push 0
push 0
push 2
call fcn.005e0a30
pop esi
pop edi
xor al, al
pop ebx
pop ebp
ret 8
mov byte [esi + ebx], 0
mov eax, esi
mov cl, byte [esi]
mov edx, esi
test cl, cl
je 0x5de6b6
mov dword [ebp + 8], eax
lea ebx, [edx + 1]
inc eax
cmp cl, 0xd
jne 0x5de6ac
mov byte [edx], 0xa
cmp byte [eax], 0xa
cmovne eax, dword [ebp + 8]
inc eax
jmp 0x5de6ae
mov byte [edx], cl
mov cl, byte [eax]
mov edx, ebx
test cl, cl
jne 0x5de693
push dword [ebp + 0xc]
mov byte [edx], 0
mov ecx, edi
mov eax, dword [edi]
push 0
push esi
call dword [eax + 8]
push esi
call fcn.005e9ca1
add esp, 4
cmp byte [edi + 0x2c], 0
sete al
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x5e2a80
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x5e2a8c
pop ebp
ret
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.005e2aa0
Function at 0x5eb8a0
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6715fc
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x6ece84]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
call fcn.005fbd90
mov dword [ebp - 4], 0
lea esi, [ebx + 0x40]
xor eax, eax
mov dword [ebx], vtable.CChrmBaseInst.0
mov dword [ebx + 0x3c], 0xffffffff
mov ecx, esi
mov dword [ebp - 0x14], esi
push eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
push 0x67ed6c
mov word [esi], ax
call fcn.0040cbc0
mov byte [ebp - 4], 1
xor eax, eax
lea ecx, [esi + 0x18]
mov dword [ecx + 0x10], 0
push eax
mov dword [ecx + 0x14], 7
push 0x67ed6c
mov word [ecx], ax
call fcn.0040cbc0
mov byte [ebp - 4], 2
xor eax, eax
lea ecx, [esi + 0x30]
mov dword [ecx + 0x10], 0
push eax
mov dword [ecx + 0x14], 7
push 0x67ed6c
mov word [ecx], ax
call fcn.0040cbc0
mov byte [ebp - 4], 3
xor eax, eax
lea ecx, [esi + 0x48]
mov dword [ecx + 0x10], 0
push eax
mov dword [ecx + 0x14], 7
push 0x67ed6c
mov word [ecx], ax
call fcn.0040cbc0
mov byte [ebp - 4], 5
lea ecx, [ebx + 0xa0]
call fcn.005ebc40
mov byte [ebp - 4], 6
lea esi, [ebx + 0x160]
xor eax, eax
mov dword [ebp - 0x14], esi
push eax
mov dword [esi + 0x10], 0
mov ecx, esi
mov dword [esi + 0x14], 7
push 0x67ed6c
mov word [esi], ax
call fcn.0040cbc0
mov byte [ebp - 4], 7
xor eax, eax
lea ecx, [esi + 0x18]
mov dword [ecx + 0x10], 0
push eax
mov dword [ecx + 0x14], 7
push 0x67ed6c
mov word [ecx], ax
call fcn.0040cbc0
mov byte [ebp - 4], 9
lea edi, [ebx + 0x190]
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov byte [ebp - 4], 0xa
lea esi, [ebx + 0x19c]
xor eax, eax
mov dword [ebp - 0x14], esi
mov ecx, esi
push eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
push 0x67ed6c
mov dword [ebp - 0x18], esi
mov word [esi], ax
call fcn.0040cbc0
mov byte [ebp - 4], 0xb
xor eax, eax
lea ecx, [esi + 0x18]
mov dword [ecx + 0x10], 0
push eax
mov dword [ecx + 0x14], 7
push 0x67ed6c
mov word [ecx], ax
call fcn.0040cbc0
mov byte [ebp - 4], 0xe
lea ecx, [ebx + 0x1d0]
mov dword [ebx + 0x1cc], 0x10101
call fcn.005ebc40
mov byte [ebp - 4], 0xf
xor eax, eax
mov dword [ebx + 0x2a0], 0
mov dword [ebx + 0x2a4], 7
mov word [ebx + 0x290], ax
mov byte [ebp - 4], 0x10
lea ecx, [ebx + 0x2a8]
call fcn.00546a40
mov byte [ebp - 4], 0x11
push edi
push dword [edi + 4]
push dword [edi]
call fcn.0040f430
mov eax, dword [edi]
add esp, 0xc
mov dword [edi + 4], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5ebdb0
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x67183c
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x6ece84]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebx], vtable.CChrmBaseInst.0
mov dword [ebp - 4], 8
lea edi, [ebx + 0x190]
push edi
push dword [edi + 4]
push dword [edi]
call fcn.0040f430
mov eax, dword [edi]
add esp, 0xc
mov dword [edi + 4], eax
mov byte [ebp - 4], 7
lea ecx, [ebx + 0x2a8]
call fcn.004ee170
mov byte [ebp - 4], 6
lea ecx, [ebx + 0x290]
call fcn.00407b80
mov byte [ebp - 4], 5
lea ecx, [ebx + 0x1d0]
call fcn.004113a0
mov byte [ebp - 4], 4
lea esi, [ebx + 0x19c]
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 4
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 0xa
lea ecx, [esi + 0x18]
call fcn.00407b80
mov byte [ebp - 4], 4
mov ecx, esi
call fcn.00407b80
mov byte [ebp - 4], 3
mov ecx, edi
call fcn.004110d0
mov byte [ebp - 4], 2
lea esi, [ebx + 0x160]
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 0xc
lea ecx, [esi + 0x18]
call fcn.00407b80
mov byte [ebp - 4], 2
mov ecx, esi
call fcn.00407b80
mov byte [ebp - 4], 1
lea ecx, [ebx + 0xa0]
call fcn.004113a0
mov byte [ebp - 4], 0
lea esi, [ebx + 0x40]
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 0x10
lea ecx, [esi + 0x48]
call fcn.00407b80
mov byte [ebp - 4], 0xf
lea ecx, [esi + 0x30]
call fcn.00407b80
mov byte [ebp - 4], 0xe
lea ecx, [esi + 0x18]
call fcn.00407b80
mov byte [ebp - 4], 0
mov ecx, esi
call fcn.00407b80
mov dword [ebp - 4], 0xffffffff
mov ecx, ebx
call fcn.005fbe30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5ff8b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x674648
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x6ece84]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push dword [0x6ee988]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
call fcn.00491110
add esp, 4
mov dword [0x6ee988], eax
test eax, eax
jne 0x5ff98b
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov word [ebp - 0x14], ax
mov dword [ebp - 0x34], eax
mov word [ebp - 0x44], ax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x65006b
lea edx, [eax + 2]
mov dword [ebp - 0x28], 0x6e0072
mov dword [ebp - 0x24], 0x6c0065
mov dword [ebp - 0x20], 0x320033
mov dword [ebp - 0x1c], 0x64002e
mov dword [ebp - 0x18], 0x6c006c
mov dword [ebp - 0x30], 7
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x5ff943
sub eax, edx
lea ecx, [ebp - 0x44]
sar eax, 1
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0040cbc0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x44]
push eax
call fcn.0048d690
add esp, 4
mov dword [0x6ee988], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.00407b80
mov eax, dword [0x6ee988]
push str.MoveFileA
push eax
call fcn.0048a530
add esp, 8
test eax, eax
je 0x5ff9a1
push edi
push esi
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005e9f40
mov esp, ebp
pop ebp
ret 8
Function at 0x6058c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x67542d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6ece84]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
mov dword [esi], eax
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov byte [ebp - 4], 5
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov byte [ebp - 4], 6
mov dword [esi + 0x58], 0xffffffff
mov dword [esi + 0x5c], 0xffffffff
mov dword [esi + 0x60], 0xffffffff
mov dword [esi + 0x64], 0xffffffff
mov dword [esi + 0x68], 0xffffffff
mov dword [esi + 0x6c], 0xffffffff
call fcn.00605b40
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x605c30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6754f8
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x6ece84]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
nop
mov byte [esi + eax], al
inc eax
cmp eax, 0x80
jl 0x605c60
push dword [esi + 0x100]
call fcn.0060ced9
mov edi, 1
add esp, 4
lea ebx, [edi + 0x7e]
call fcn.0060ceb8
cdq
idiv ebx
mov cl, byte [esi + edi]
mov al, byte [edx + esi + 1]
mov byte [esi + edi], al
inc edi
mov byte [edx + esi + 1], cl
cmp edi, 0x80
jl 0x605c81
push dword [0x6ee988]
call fcn.00491110
add esp, 4
mov dword [0x6ee988], eax
test eax, eax
jne 0x605d4b
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
lea edx, [ecx + 2]
mov dword [ebp - 0x3c], 0x65006b
mov dword [ebp - 0x38], 0x6e0072
mov dword [ebp - 0x34], 0x6c0065
mov dword [ebp - 0x30], 0x320033
mov dword [ebp - 0x2c], 0x64002e
mov dword [ebp - 0x28], 0x6c006c
mov word [ebp - 0x24], ax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], 7
mov word [ebp - 0x54], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x605d03
sub ecx, edx
lea eax, [ebp - 0x3c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x54]
call fcn.0040cbc0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x54]
push eax
call fcn.0048d690
add esp, 4
mov dword [0x6ee988], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.00407b80
mov eax, dword [0x6ee988]
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0x54746547
push ecx
push eax
mov dword [ebp - 0x1c], 0x436b6369
mov dword [ebp - 0x18], 0x746e756f
mov byte [ebp - 0x14], 0
call fcn.0048a530
add esp, 8
test eax, eax
je 0x605d77
call eax
push eax
call fcn.0060ced9
add esp, 4
xor eax, eax
movzx ecx, byte [esi + eax]
mov byte [ecx + esi + 0x80], al
inc eax
cmp eax, 0x80
jl 0x605d82
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005e9f40
mov esp, ebp
pop ebp
ret

Function at 0x61c953
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0061c7d2

Function at 0x623504
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.006231c4
Function at 0x40135f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
mov esi, ecx
test esi, esi
je 0x401386
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x401381
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401386
test al, 0x10
jne 0x401386
xor eax, eax
inc eax
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x40138a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
test ecx, ecx
je 0x4013a2
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4013a2
test al, 0x10
je 0x4013a2
xor eax, eax
inc eax
ret
xor eax, eax
ret

Function at 0x401483
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x489870]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov word [ebp - 8], 0x500
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x4014e3
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0x14]
xor eax, eax
inc eax
cmp dword [ebp - 0x10], ebx
cmovne ebx, eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.00455de6
leave
ret

Function at 0x4014f2
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
xor edi, edi
push edi
push str.Shell_TrayWnd
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x401573
lea ecx, [ebp - 4]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [ebp - 4], edi
je 0x401573
push dword [ebp - 4]
push edi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x401573
lea eax, [ebp - 8]
push eax
push 2
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0xc]
push eax
push 1
push 2
push edi
push 0xf01ff
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xc]
jmp 0x401575
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x401579
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
push ebx
mov eax, edx
push esi
push edi
mov ecx, eax
mov dword [ebp - 0x18], eax
call fcn.00401480
mov ecx, dword [ebp + 8]
mov edi, eax
call fcn.00401480
mov ecx, dword [ebp + 0xc]
mov esi, eax
call fcn.00401480
and dword [ebp - 0x10], 0
xor ebx, ebx
mov dword [ebp - 0xc], eax
call fcn.00401483
test eax, eax
jne 0x4015d8
push dword [ebp + 0x10]
push dword [ebp - 0xc]
push esi
push edi
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp eax, 0x20
setg cl
mov dword [ebp - 0x10], ecx
jmp 0x4016cf
test esi, esi
je 0x4015ed
push esi
call fcn.00439699
mov ebx, eax
pop ecx
test ebx, ebx
je 0x4016cf
test edi, edi
jne 0x4015f9
test ebx, ebx
je 0x4016e8
call fcn.004014f2
mov dword [ebp - 8], eax
test eax, eax
je 0x4016c4
mov eax, dword [0x48c424]
test eax, eax
jne 0x401640
push 0x800
push eax
push 0x4745f4
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [0x48c424], eax
test eax, eax
jne 0x401640
push 0x4745f4
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x48c424], eax
test eax, eax
je 0x4016bb
push str.CreateProcessWithTokenW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, eax
mov dword [ebp - 0x14], edx
test edx, edx
je 0x4016bb
push 0x44
lea ecx, [ebp - 0x74]
call fcn.00401459
mov ax, word [ebp + 0x10]
lea ecx, [ebp - 0x28]
push 0x10
mov dword [ebp - 0x74], 0x44
mov dword [ebp - 0x48], 1
mov word [ebp - 0x44], ax
call fcn.00401459
add esp, 8
mov eax, ecx
mov ecx, edx
push eax
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0xc]
push 0
push 0x20
push ebx
push edi
push 1
push dword [ebp - 8]
call dword [0x467454]
call dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4016bb
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x4016cf
push ebx
call fcn.004396f8
pop ecx
test edi, edi
je 0x4016e8
cmp edi, dword [ebp - 0x18]
je 0x4016e8
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
je 0x401701
cmp esi, dword [ebp + 8]
je 0x401701
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x40171d
cmp eax, dword [ebp + 0xc]
je 0x40171d
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret