joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f9090
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x690
mov eax, dword [0x984164]
xor eax, esp
mov dword [esp + 0x68c], eax
push esi
push edi
push 0x40
xor esi, esi
lea eax, [esp + 0x38]
push esi
push eax
mov dword [esp + 0x3c], 0x44
call fcn.0051c1b0
lea ecx, [esp + 0x18]
add esp, 0xc
push ecx
lea edi, [esp + 0x7c]
mov dword [esp + 0x10], esi
call fcn.004f9000
add esp, 4
test eax, eax
jne 0x4f91a1
push esi
push esi
push 1
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x24], 0xc
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 1
call dword [sym.imp.KERNEL32.DLL_CreateEventW]
mov esi, eax
test esi, esi
je 0x4f91a1
push esi
push ebx
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
cmp dword [esp + 0x18], 0x7dc
push eax
lea edx, [esp + 0x290]
jb 0x4f913b
mov eax, edi
push eax
push str.__s___p_0x_x__c_0x_x_0x_p__e_0x_p__D__avg
jmp 0x4f9148
lea ecx, [esp + 0x88]
push ecx
push str.__s___x__x__p__p_a
call fcn.00401bb0
add esp, 0x18
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x34]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
lea ecx, [esp + 0x2a0]
push ecx
push 0
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
test eax, eax
je 0x4f919a
mov edx, dword [esp + 0x20]
push 0xea60
push 0
lea eax, [esp + 0x14]
push eax
push 2
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], esi
call dword [sym.imp.KERNEL32.DLL_WaitForMultipleObjects]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [esp + 0x694]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.005078c8
mov esp, ebp
pop ebp
ret

Function at 0x4f9400
Capabilities:
Get common file path

Disassembly:
sub esp, 0x21c
mov eax, dword [0x984164]
xor eax, esp
mov dword [esp + 0x214], eax
push esi
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x1a]
push ecx
xor esi, esi
mov word [esp + 0x1c], ax
call fcn.0051c1b0
mov edi, dword [sym.imp.KERNEL32.DLL_CreateFileW]
add esp, 0xc
push esi
push 0x80
push 3
push esi
push 3
push 3
push str..RemoverDriver
mov dword [esp + 0x28], esi
call edi
mov dword [0x98560c], eax
cmp eax, 0xffffffff
jne 0x4f9514
call fcn.004fec70
xor edx, edx
cmp eax, 0x20
setne dl
lea eax, [esp + 0xc]
push eax
add edx, 0x70
mov esi, edx
call fcn.004ff600
add esp, 4
cmp word [0x9873d8], 0
jne 0x4f9497
push 0x103
push 0x9873d8
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
push 0x9873d8
push str._sdrivers_rm.sys
lea edx, [esp + 0x18]
call fcn.00401bb0
lea ecx, [esp + 0x18]
push esi
push ecx
call fcn.004ff770
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x4f94cd
lea edx, [esp + 0x10]
push edx
call fcn.004f92e0
add esp, 4
mov esi, eax
mov eax, dword [esp + 0xc]
push eax
call fcn.004ff650
add esp, 4
test esi, esi
jne 0x4f950b
push esi
push 0x80
push 3
push esi
push 3
push 3
push str..RemoverDriver
call edi
mov dword [0x98560c], eax
cmp eax, 0xffffffff
jne 0x4f950b
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, eax
call fcn.0041c040
mov esi, eax
lea eax, [esp + 0x10]
call fcn.004fcab0
mov ecx, dword [esp + 0x21c]
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.005078c8
add esp, 0x21c
ret
Function at 0x4f9530
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
mov eax, dword [0x98560c]
sub esp, 0x24
push ebx
push ebp
push esi
push edi
xor edi, edi
cmp eax, 0xffffffff
je 0x4f954a
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0xf003f
push edi
push edi
mov dword [0x98560c], 0xffffffff
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
mov dword [esp + 0x14], ebx
cmp ebx, edi
je 0x4f95fa
push 0x10024
push 0x924cd8
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
cmp esi, edi
je 0x4f95f3
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea eax, [esp + 0x18]
push eax
push esi
mov dword [esp + 0x24], edi
call ebx
cmp dword [esp + 0x1c], 4
jne 0x4f95ad
lea ecx, [esp + 0x18]
push ecx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov ebp, dword [sym.imp.KERNEL32.DLL_Sleep]
cmp dword [esp + 0x1c], 3
jne 0x4f95d7
push 0x200
add edi, 0xc8
call ebp
lea edx, [esp + 0x18]
push edx
push esi
call ebx
cmp edi, 0x1388
jb 0x4f95b3
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, 0x924cd8
call fcn.00502440
mov ebx, dword [esp + 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret
Function at 0x4fa1e0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x75c
mov eax, dword [0x984164]
xor eax, esp
mov dword [esp + 0x754], eax
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x358]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call fcn.004f9a30
test eax, eax
jne 0x4fa385
test byte [esp + 0x378], 8
je 0x4fa230
mov eax, 0xe001004f
jmp 0x4fa385
mov esi, dword [esp + 0x374]
add esi, esi
push esi
lea eax, [esp + 0x380]
push eax
lea ecx, [esp + 0x560]
push ecx
call fcn.005186a0
xor edx, edx
add esp, 0xc
mov word [esp + esi + 0x558], dx
cmp word [0x9873d8], dx
jne 0x4fa275
push 0x103
push 0x9873d8
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
lea eax, [esp + 0x558]
push eax
push 0x9873d8
mov eax, str.drivers
call fcn.00418cd0
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x4fa29f
mov esi, 0xe0010001
jmp 0x4fa376
push 0
lea esi, [esp + 0x1c]
call fcn.004f6740
or dword [esp + 0x44], 0x40000
or dword [esp + 0x340], 0x800
mov ecx, esi
push ecx
mov edi, ebx
mov dword [esp + 0xf0], 0x4f9bb0
call fcn.004f9b40
add esp, 4
lea edx, [esp + 0x14]
push edx
mov edi, esi
call fcn.004f65e0
mov esi, eax
test esi, esi
jne 0x4fa362
mov ebp, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
mov ecx, ebp
call fcn.004fa0b0
mov esi, eax
add esp, 4
test esi, esi
jne 0x4fa35b
mov ecx, dword [esp + 0x358]
mov edi, dword [esp + 0x10]
mov dword [edi], ecx
mov edx, dword [esp + 0x35c]
mov dword [edi + 4], edx
mov eax, dword [esp + 0x360]
mov dword [edi + 8], eax
mov ecx, dword [esp + 0x364]
mov dword [edi + 0xc], ecx
mov edx, dword [esp + 0x368]
mov dword [edi + 0x10], edx
mov eax, dword [esp + 0x36c]
mov dword [edi + 0x14], eax
mov ecx, dword [esp + 0x370]
mov eax, edi
mov dword [edi + 0x20], ecx
call fcn.004f9a80
push edi
mov esi, eax
call fcn.00507bce
add esp, 4
mov eax, ebp
call fcn.0047e780
mov eax, dword [esp + 0xfc]
test eax, eax
je 0x4fa376
push eax
call fcn.00507bce
add esp, 4
test ebx, ebx
je 0x4fa383
push ebx
call fcn.00507bce
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x764]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005078c8
add esp, 0x75c
ret

Function at 0x4fa420
Capabilities:
Get common file path

Disassembly:
sub esp, 0x260
mov eax, dword [0x984164]
xor eax, esp
mov dword [esp + 0x258], eax
cmp word [0x9871d0], 0
push ebx
push esi
push edi
mov esi, ecx
mov edi, 0x12346578
mov ebx, 0xabcdef12
jne 0x4fa45d
push 0x103
push 0x9871d0
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
lea eax, [esp + 0x10]
push eax
push 0x9871d0
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
cmp eax, 0xffffffff
je 0x4fa48d
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
push eax
xor edi, 0x12346578
xor ebx, 0xabcdef12
call dword [sym.imp.KERNEL32.DLL_FindClose]
cmp word [esi], 0
je 0x4fa4c3
movzx eax, word [esi]
cmp ax, 0x2e
je 0x4fa4c3
movzx eax, ax
movzx ecx, bl
add eax, ecx
cdq
mov ecx, 0x19
idiv ecx
shrd ebx, edi, 5
add esi, 2
shr edi, 5
add edx, 0x61
mov word [esi - 2], dx
cmp word [esi], 0
jne 0x4fa493
mov ecx, dword [esp + 0x264]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005078c8
add esp, 0x260
ret
Function at 0x4fa4e0
Capabilities:
Accept command line arguments
Copy file
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x60
cmp word [0x986fc8], 0
push ebx
push ebp
push esi
push edi
jne 0x4fa509
push 0x103
push 0x986fc8
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
push 0
mov edi, 0x986fc8
call fcn.004187c0
mov esi, eax
xor al, al
add esp, 4
mov dword [esp + 0x14], esi
mov byte [esp + 0x13], al
test esi, esi
je 0x4fa6b8
mov edx, esi
call fcn.00418b90
mov ecx, eax
call fcn.004fa420
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
test eax, eax
je 0x4fa6ab
mov edx, edi
call fcn.00418b90
mov ebx, eax
lea edx, [eax + 2]
jmp 0x4fa560
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4fa560
sub eax, edx
sar eax, 1
add eax, 0xa
push eax
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
mov edi, eax
call fcn.004187c0
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x4fa6ab
push 0x986fc8
push ebp
call fcn.00508631
add esp, 8
test eax, eax
je 0x4fa5c4
mov ecx, esi
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x4fa5a4
mov edx, dword [esp + 0x14]
sub ecx, esi
sar ecx, 1
add ecx, ecx
push ecx
push edx
push eax
call fcn.005186a0
add esp, 0xc
mov eax, ebp
add eax, 0xfffffffe
lea esp, [esp]
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x4fa5d0
mov ecx, dword [str.__exename]
mov dword [eax], ecx
mov edx, dword [0x9789b4]
mov dword [eax + 4], edx
mov ecx, dword [0x9789b8]
mov dword [eax + 8], ecx
mov edx, dword [0x9789bc]
mov dword [eax + 0xc], edx
mov ecx, dword [0x9789c0]
mov dword [eax + 0x10], ecx
mov dx, word [0x9789c4]
mov word [eax + 0x14], dx
mov eax, ebx
mov edx, ebx
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4fa617
mov edi, ebp
sub eax, edx
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x4fa630
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x44
push eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x30]
push eax
call fcn.0051c1b0
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x2c]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push ebp
push 0
mov dword [esp + 0x50], 0x44
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
test eax, eax
je 0x4fa69e
mov byte [esp + 0x13], 1
push ebp
call fcn.0050b6ab
mov esi, dword [esp + 0x18]
add esp, 4
push esi
call fcn.0050b6ab
mov al, byte [esp + 0x17]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4fa830
Capabilities:
Query environment variable

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsW]
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
xor edi, edi
push edi
push edi
push ebp
call ebx
mov esi, eax
test esi, esi
je 0x4fa886
xor ecx, ecx
lea eax, [esi + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00507d92
mov edi, eax
add esp, 4
test edi, edi
je 0x4fa888
push esi
push edi
push ebp
call ebx
test eax, eax
jne 0x4fa886
push edi
call fcn.00507bce
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4fa890
Capabilities:
Get common file path

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 8
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.DLL_SearchPathW]
push esi
lea eax, [esp + 0xc]
push eax
xor esi, esi
push esi
push esi
push 0x928034
push edi
push ecx
call ebp
mov ebx, eax
test ebx, ebx
je 0x4fa8ff
xor ecx, ecx
lea eax, [ebx + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00507d92
mov esi, eax
add esp, 4
test esi, esi
je 0x4fa8ff
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0xc]
push eax
push esi
push ebx
push 0x928034
push edi
push ecx
call ebp
test eax, eax
jne 0x4faa02
push esi
call fcn.00507bce
add esp, 4
mov eax, dword [esp + 0x18]
lea edx, [esp + 0xc]
push edx
push 0
push 0
push str..dll
push edi
push eax
call ebp
mov ebx, eax
test ebx, ebx
je 0x4fa962
xor ecx, ecx
lea eax, [ebx + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00507d92
mov esi, eax
add esp, 4
test esi, esi
je 0x4fa962
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0xc]
push eax
push esi
push ebx
push str..dll
push edi
push ecx
call ebp
test eax, eax
jne 0x4faa02
push esi
call fcn.00507bce
add esp, 4
cmp word [0x9873d8], 0
jne 0x4fa97c
push 0x103
push 0x9873d8
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
push 0
push 0x9873d8
mov eax, str.drivers
call fcn.00418cd0
add esp, 8
mov dword [esp + 0x10], eax
test eax, eax
je 0x4faa02
lea edx, [esp + 0xc]
push edx
push 0
push 0
push str..sys
push edi
push eax
call ebp
mov ebx, eax
test ebx, ebx
je 0x4fa9f5
xor ecx, ecx
lea eax, [ebx + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00507d92
mov esi, eax
add esp, 4
test esi, esi
je 0x4fa9f5
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push esi
push ebx
push str..sys
push edi
push ecx
call ebp
test eax, eax
jne 0x4fa9f5
push esi
call fcn.00507bce
add esp, 4
xor esi, esi
mov edx, dword [esp + 0x10]
push edx
call fcn.00507bce
add esp, 4
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x4faa80
Capabilities:
Get common file path

Disassembly:
push edi
mov edi, eax
movzx eax, word [edi]
mov ecx, 0x41
cmp cx, ax
ja 0x4faa96
cmp ax, 0x5a
jbe 0x4faaa6
mov edx, 0x61
cmp dx, ax
ja 0x4faab8
cmp ax, 0x7a
ja 0x4faab8
cmp word [edi + 2], 0x3a
jne 0x4faab8
cmp word [edi + 4], 0x5c
je 0x4fab90
push 0xc
push str.SystemRoot_
push edi
call fcn.00507a59
add esp, 0xc
test eax, eax
jne 0x4faaf9
cmp word [0x9871d0], ax
jne 0x4faae5
push 0x103
push 0x9871d0
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
push 0
lea eax, [edi + 0x18]
push 0x9871d0
call fcn.00418cd0
add esp, 8
pop edi
ret
push 9
push str.Windows_
push edi
call fcn.00507a59
add esp, 0xc
test eax, eax
jne 0x4fab3a
cmp word [0x9871d0], ax
jne 0x4fab26
push 0x103
push 0x9871d0
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
push 0
lea eax, [edi + 0x12]
push 0x9871d0
call fcn.00418cd0
add esp, 8
pop edi
ret
push 9
push str.System32_
push edi
call fcn.00507a59
add esp, 0xc
test eax, eax
jne 0x4fab62
push 0
call fcn.004fefb0
push eax
mov eax, edi
call fcn.00418cd0
add esp, 8
pop edi
ret
push 9
push str.SysWOW64_
push edi
call fcn.00507a59
add esp, 0xc
test eax, eax
je 0x4fab4e
push 0x5c
push edi
call fcn.00507df7
add esp, 8
test eax, eax
jne 0x4fab90
push edi
call fcn.004faa10
add esp, 4
pop edi
ret
push 0
call fcn.004187c0
add esp, 4
pop edi
ret

Function at 0x4fb0e0
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x238
mov eax, dword [0x984164]
xor eax, esp
mov dword [esp + 0x230], eax
mov eax, dword [esp + 0x23c]
push ebp
mov ebp, dword [esp + 0x244]
push esi
push edi
push eax
push str._s.cab
lea edx, [esp + 0x38]
xor esi, esi
call fcn.00401bb0
add esp, 8
lea ecx, [esp + 0x30]
lea edx, [esp + 0x10]
call fcn.004fdba0
test al, al
je 0x4fb1d0
mov edi, edi
mov ecx, dword [esp + 0x10]
push ebx
call fcn.004faef0
mov esi, eax
add esp, 4
test esi, esi
je 0x4fb19b
test ebp, ebp
je 0x4fb197
mov ecx, dword [esi + 4]
mov edi, dword [esi]
test ecx, ecx
jl 0x4fb186
jg 0x4fb157
cmp edi, 0x40
jbe 0x4fb186
mov eax, 0x5a4d
cmp word [esi + 0x10], ax
jne 0x4fb186
mov eax, dword [esi + 0x4c]
cmp eax, 4
jb 0x4fb186
xor edx, edx
cmp edx, ecx
jg 0x4fb186
jl 0x4fb176
cmp eax, edi
jae 0x4fb186
cmp dword [eax + esi + 0x10], 0x4550
jne 0x4fb186
mov eax, dword [eax + esi + 0x18]
jmp 0x4fb188
xor eax, eax
cmp ebp, eax
je 0x4fb197
push esi
call fcn.00507bce
add esp, 4
xor esi, esi
test esi, esi
jne 0x4fb1a8
lea ecx, [esp + 0x10]
call fcn.004fdda0
test al, al
jne 0x4fb130
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4fb1b7
push eax
call dword [sym.imp.Ntdll.dll_NtClose]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x20], 0xffffffff
test eax, eax
je 0x4fb1d0
push eax
call fcn.00507bce
add esp, 4
mov ecx, dword [esp + 0x23c]
pop edi
mov eax, esi
pop esi
pop ebp
xor ecx, esp
call fcn.005078c8
add esp, 0x238
ret
Function at 0x4fb330
Capabilities:
Get common file path

Disassembly:
sub esp, 0x214
mov eax, dword [0x984164]
xor eax, esp
mov dword [esp + 0x210], eax
mov eax, dword [esp + 0x218]
push ebx
mov ecx, eax
mov ebx, eax
movzx eax, word [eax]
push esi
push edi
test ax, ax
je 0x4fb37b
movzx eax, ax
lea ecx, [ecx]
cmp ax, 0x5c
je 0x4fb36c
cmp ax, 0x2f
jne 0x4fb36f
lea ebx, [ecx + 2]
movzx eax, word [ecx + 2]
add ecx, 2
test ax, ax
jne 0x4fb360
cmp word [0x9873d8], 0
mov esi, dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
jne 0x4fb397
push 0x103
push 0x9873d8
call esi
push 0x9873d8
push str._sDriverStoreFileRepository
lea edx, [esp + 0x18]
call fcn.00401bb0
lea eax, [esp + 0x18]
push eax
xor ecx, ecx
call fcn.004fb280
add esp, 0xc
test eax, eax
jne 0x4fb4b1
cmp word [0x9871d0], ax
jne 0x4fb3da
push 0x103
push 0x9871d0
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
push 0x9871d0
push str._sWinSxS
lea edx, [esp + 0x18]
call fcn.00401bb0
lea ecx, [esp + 0x18]
push ecx
xor ecx, ecx
call fcn.004fb280
add esp, 0xc
test eax, eax
jne 0x4fb4b1
cmp word [0x9873d8], ax
jne 0x4fb419
push 0x103
push 0x9873d8
call esi
push 0x9873d8
push str._sDllCache
lea edx, [esp + 0x18]
call fcn.00401bb0
lea edx, [esp + 0x18]
push edx
xor edi, edi
mov ecx, ebx
call fcn.004fb1f0
add esp, 0xc
test eax, eax
jne 0x4fb4b1
call fcn.004fefb0
push eax
push str._sServicePackFilesi386
lea edx, [esp + 0x18]
call fcn.00401bb0
lea eax, [esp + 0x18]
push eax
mov ecx, ebx
call fcn.004fb1f0
add esp, 0xc
test eax, eax
jne 0x4fb4b1
call fcn.004fefb0
push eax
push str._sDriver_Cachei386
lea edx, [esp + 0x18]
call fcn.00401bb0
lea ecx, [esp + 0x18]
push ecx
mov ecx, ebx
call fcn.004fb1f0
add esp, 0xc
test eax, eax
jne 0x4fb4b1
call fcn.004fefb0
push eax
push str._sDriver_Cachei386
lea edx, [esp + 0x18]
call fcn.00401bb0
lea edx, [esp + 0x18]
push edi
push edx
call fcn.004fb0e0
add esp, 0x10
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005078c8
add esp, 0x214
ret

Function at 0x4fb540
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, 8
mov ecx, eax
mov word [esi], ax
mov eax, dword fs:[0x18]
mov word [esi + 2], cx
mov edx, dword [eax + 0x30]
mov eax, dword [edx + 0x18]
push ecx
push 0
push eax
call dword [sym.imp.Ntdll.dll_RtlAllocateHeap]
mov dword [esi + 4], eax
test eax, eax
jne 0x4fb571
mov eax, 0xc000009a
ret
mov ecx, dword [edi]
mov dword [eax], ecx
mov edx, dword [edi + 4]
mov dword [eax + 4], edx
xor eax, eax
ret

Function at 0x4fb580
Capabilities:
Check for peb beingdebugged flag

Disassembly:
test ebx, ebx
je 0x4fb5c9
cmp word [ebx], 0
je 0x4fb5c9
test esi, esi
je 0x4fb5c9
mov eax, dword fs:[0x18]
mov word [edi], si
mov word [edi + 2], si
mov edx, dword [eax + 0x30]
mov eax, dword [edx + 0x18]
lea ecx, [esi + 2]
push ecx
push 8
push eax
call dword [sym.imp.Ntdll.dll_RtlAllocateHeap]
mov dword [edi + 4], eax
test eax, eax
jne 0x4fb5bb
mov eax, 0xc000009a
ret
push esi
push ebx
push eax
call fcn.005186a0
add esp, 0xc
xor eax, eax
ret
mov eax, 0xc000003b
ret
Function at 0x4fb880
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
xor esi, esi
mov eax, ebp
xor ebx, ebx
mov dword [esp + 0xc], esi
call fcn.004fb5d0
dec eax
cmp eax, 4
ja case.default.0x4fb8a1
jmp dword [eax*4 + 0x4fba08]
mov ebx, 0x9788ec
mov esi, 8
add ebp, 8
jmp 0x4fb921
mov ebx, 0x9788ec
mov esi, 8
jmp case.default.0x4fb8a1
push 0
call fcn.004fb780
mov ebx, eax
add esp, 4
mov dword [esp + 0xc], ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4fb8d6
sub eax, edx
sar eax, 1
lea esi, [eax + eax]
jmp case.default.0x4fb8a1
push 1
call fcn.004fb780
mov ebx, eax
add esp, 4
mov dword [esp + 0xc], ebx
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4fb900
sub eax, edx
sar eax, 1
lea esi, [eax + eax]
jmp case.default.0x4fb8a1
mov ebx, str.__UNC_
mov esi, 0x10
add ebp, 4
mov dword [esp + 0x14], ebp
mov eax, ebp
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4fb930
sub eax, edx
sar eax, 1
lea ebp, [eax + eax]
lea eax, [esi + ebp]
cmp eax, 0xfffe
jae 0x4fb986
lea eax, [esi + ebp]
lea ecx, [eax + 2]
mov word [edi + 2], cx
mov word [edi], ax
mov eax, dword fs:[0x18]
mov edx, dword [eax + 0x30]
mov eax, dword [edx + 0x18]
movzx ecx, cx
push ecx
push 0
push eax
call dword [sym.imp.Ntdll.dll_RtlAllocateHeap]
mov dword [edi + 4], eax
test eax, eax
jne 0x4fb98d
mov ecx, dword [esp + 0xc]
push ecx
call fcn.00507bce
add esp, 4
xor al, al
pop esi
pop ebp
pop ebx
pop ecx
ret
test ebx, ebx
je 0x4fb9a0
test esi, esi
je 0x4fb9a0
push esi
push ebx
push eax
call fcn.005186a0
add esp, 0xc
mov edx, dword [esp + 0x14]
mov eax, dword [edi + 4]
push ebp
shr esi, 1
push edx
lea ecx, [eax + esi*2]
push ecx
call fcn.005186a0
movzx edx, word [edi]
mov eax, dword [edi + 4]
shr edx, 1
xor ecx, ecx
mov word [eax + edx*2], cx
movzx edx, word [edi]
mov eax, dword [edi + 4]
shr edx, 1
lea edx, [eax + edx*2]
add esp, 0xc
cmp eax, edx
jae 0x4fb9f1
movzx ecx, word [eax]
cmp cx, 0x2f
jne 0x4fb9e4
mov ecx, 0x5c
jmp 0x4fb9e7
movzx ecx, cx
mov word [eax], cx
add eax, 2
cmp eax, edx
jb 0x4fb9d4
mov eax, dword [esp + 0xc]
push eax
call fcn.00507bce
add esp, 4
pop esi
pop ebp
mov al, 1
pop ebx
pop ecx
ret
Function at 0x4fbf30
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
sub esp, 0x24
mov eax, dword [0x984164]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
push esi
xor ebx, ebx
mov ebp, dword [esp + 0x34]
lea eax, [esp + 0xc]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 1
lea ecx, [esp + 0x4c]
push ecx
mov byte [esp + 0x50], bl
mov byte [esp + 0x51], bl
mov byte [esp + 0x52], bl
mov byte [esp + 0x53], bl
mov byte [esp + 0x54], bl
mov byte [esp + 0x55], 1
mov dword [esp + 0x38], ebx
call dword [sym.imp.Ntdll.dll_RtlAllocateAndInitializeSid]
mov esi, eax
cmp esi, ebx
jl 0x4fc037
mov edx, dword [esp + 0xc]
push edi
push edx
call dword [sym.imp.Ntdll.dll_RtlLengthSid]
mov esi, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ecx, dword [eax + 0x18]
add esi, 0x10
push esi
push ebx
push ecx
call dword [sym.imp.Ntdll.dll_RtlAllocateHeap]
mov edi, eax
cmp edi, ebx
jne 0x4fbfbb
mov esi, 0xc000009a
jmp 0x4fc01c
push 2
push esi
push edi
call dword [sym.imp.Ntdll.dll_RtlCreateAcl]
mov esi, eax
cmp esi, ebx
jl 0x4fc01c
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x3c]
push edx
push eax
push 2
push edi
call dword [sym.imp.Ntdll.dll_RtlAddAccessAllowedAce]
mov esi, eax
cmp esi, ebx
jl 0x4fc01c
push 1
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.Ntdll.dll_RtlCreateSecurityDescriptor]
mov esi, eax
cmp esi, ebx
jl 0x4fc01c
push ebx
push edi
push 1
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.Ntdll.dll_RtlSetDaclSecurityDescriptor]
mov esi, eax
cmp esi, ebx
jl 0x4fc01c
lea eax, [esp + 0x14]
push eax
push 4
push ebp
call dword [sym.imp.Ntdll.dll_NtSetSecurityObject]
mov esi, eax
cmp edi, ebx
je 0x4fc036
mov ecx, dword fs:[0x18]
mov edx, dword [ecx + 0x30]
mov eax, dword [edx + 0x18]
push edi
push ebx
push eax
call dword [sym.imp.Ntdll.dll_RtlFreeHeap]
pop edi
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x4fc046
push eax
call dword [sym.imp.Ntdll.dll_RtlFreeSid]
mov ecx, dword [esp + 0x2c]
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005078c8
add esp, 0x24
ret