joyce8/EMBER2024-capa huggingface dataset:
Function at 0x57733f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x648340]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x57737f
cmp byte [ebx], 0xa
jne 0x57737f
or byte [edi + eax + 0x28], 4
jmp 0x577384
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x577483
mov dl, byte [eax]
cmp dl, 0x1a
je 0x577466
inc eax
cmp dl, 0xd
je 0x5773b0
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x5773d6
cmp eax, ecx
jae 0x5773e4
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x577398
jmp 0x577483
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x577461
cmp dword [ebp - 0x10], 0
je 0x577461
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x648340]
test byte [eax + edi + 0x28], 0x48
je 0x57743b
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x577426
mov byte [esi], dl
jmp 0x577437
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x648340]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x577483
cmp byte [ebp - 1], 0xa
jne 0x57744a
cmp esi, ebx
jne 0x57744a
mov byte [esi], 0xa
jmp 0x577482
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00576956
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x577483
mov byte [esi], 0xd
jmp 0x577482
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x648340]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x577480
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x577483
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x57748c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x648340]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x5774d2
cmp word [ebx], dx
jne 0x5774d2
or byte [eax + edi + 0x28], 4
jmp 0x5774d7
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x57763a
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x57761a
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x577518
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x57754e
cmp eax, edx
jae 0x57755c
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x5774f3
jmp 0x57763a
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x577615
cmp dword [ebp - 0x18], 0
je 0x577615
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x648340]
test byte [eax + edi + 0x28], 0x48
je 0x5775eb
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x5775af
mov word [esi], cx
jmp 0x5775e6
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x648340]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x648340]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x648340]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x57763a
pop eax
cmp word [ebp - 4], ax
jne 0x5775fb
cmp esi, ebx
jne 0x5775fb
mov word [esi], ax
jmp 0x577637
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00576956
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x57763a
push 0xd
pop eax
jmp 0x5775f6
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x648340]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x577634
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x57763a
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x57f730
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x57f75d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x57f75d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x5807f6
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push str.FlsAlloc
push 0x616c14
push str.FlsAlloc
push 0x1f
call fcn.00580ca9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x58082a
push dword [ebp + 8]
mov ecx, esi
call dword [0x63e19c]
call esi
jmp 0x580830
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x580874
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push str.FlsGetValue
push 0x616c38
push str.FlsGetValue
push 0x21
call fcn.00580ca9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x5808ab
push dword [ebp + 8]
mov ecx, esi
call dword [0x63e19c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x5808b3
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push str.FlsSetValue
push 0x616c4c
push str.FlsSetValue
push 0x22
call fcn.00580ca9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x5808ed
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x63e19c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x5846f7
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.0058002a
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0058002a
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x58476e
cmp word [ecx], dx
je 0x58476e
mov eax, dword [0x61760c]
push edi
dec eax
push eax
push 0x6174f8
call fcn.005848e7
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x5847e1
cmp word [eax], dx
je 0x5847e1
mov eax, dword [edi]
test eax, eax
je 0x584792
cmp word [eax], dx
je 0x584792
lea eax, [ebp - 0x10]
push eax
call fcn.00584948
jmp 0x58479b
lea eax, [ebp - 0x10]
push eax
call fcn.00584c43
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x58480b
mov eax, dword [0x6174f4]
push dword [ebp - 0x14]
dec eax
push eax
push 0x6171e8
call fcn.005848e7
add esp, 0xc
test al, al
je 0x58480b
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x5847d6
cmp word [eax], di
je 0x5847d6
lea eax, [ebp - 0x10]
push eax
call fcn.00584948
pop ecx
jmp 0x58480d
lea eax, [ebp - 0x10]
push eax
call fcn.00584c43
jmp 0x5847d3
mov eax, dword [edi]
test eax, eax
je 0x5847f8
cmp word [eax], dx
je 0x5847f8
lea eax, [ebp - 0x10]
push eax
call fcn.00584d85
pop ecx
jmp 0x58480b
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x5848d6
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.00584e77
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x5848d6
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x5848d6
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x5848d6
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x584863
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.00580aec
test ebx, ebx
je 0x5848d1
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.00580aec
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x5848d6
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x5848d6
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.005767b5
add esp, 0x10
xor eax, eax
inc eax
jmp 0x5848d8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00566245
leave
ret
Function at 0x584f7d
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0058002a
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x584fec
cmp esi, dword [ebp - 4]
je 0x584fe7
cmp dword [ebp + 0xc], 0
je 0x584fe7
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x584fc4
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.00585046
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x584fee
xor eax, eax
inc eax
jmp 0x584fee
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x585395
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x5853e0
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.0058550b
test al, al
jne 0x5853da
sub edx, 2
cmp edx, edi
jne 0x5853c0
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x585402
lea eax, [edi + 2]
cmp edx, eax
je 0x585402
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.005852e1
add esp, 0x10
jmp 0x5854fc
push esi
lea ecx, [ebp - 0x255]
call fcn.0058550b
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x585445
push dword [ebp - 0x25c]
jmp 0x5853f2
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x585482
cmp word [ebp - 0x226], 0
je 0x5854a3
cmp word [ebp - 0x226], ax
jne 0x585482
cmp word [ebp - 0x224], 0
je 0x5854a3
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.005852e1
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x5854ef
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x58545c
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x5854d7
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x5854fc
push 0x585530
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.0057c640
add esp, 0x10
jmp 0x5854cc
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00566245
leave
ret
Function at 0x586a31
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x586ace
push ebx
push esi
call fcn.00586b1f
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.005865e3
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x586a7b
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x586acd
push edi
push eax
call fcn.004f2b70
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x586a9b
call fcn.005551f0
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x586acc
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.005865e3
add esp, 0x20
test eax, eax
jne 0x586aba
push edi
call fcn.005551f0
jmp 0x586ac2
push ebx
call fcn.005551f0
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x586ad1
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x586ae2
pop esi
ret
push ebx
push edi
push esi
call fcn.00586b1f
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.004f2b70
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x586b0a
push ebx
push esi
push edi
call fcn.00567460
add esp, 0xc
push 0
call fcn.005551f0
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x586b61
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00586dcc
Function at 0x5b3230
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
je 0x5b323f
dec eax
mov dword [ecx + 4], eax
pop ebp
jmp fcn.005b3250
Function at 0x5b3b40
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xb0
mov ebx, edx
mov dword [esp + 8], ecx
mov eax, dword [0x644040]
xor eax, ebp
mov dword [esp + 0xa8], eax
mov dword [esp + 0x20], 0xa
mov al, byte [0x649456]
test al, al
jne 0x5b3d69
xor edi, edi
dec edi
mov dword [esp + 0x98], edi
mov dword [esp + 0x9c], edi
mov dword [esp + 0xa0], edi
lea esi, [esp + 0x50]
mov ecx, ebx
push esi
call fcn.00418050
cmp byte [esi + 0xb], 0
mov dword [esp + 0xc], ebx
js 0x5b3c2a
mov eax, dword [esp + 0x58]
mov dword [esp + 0xa0], eax
movq xmm0, qword [esp + 0x50]
movq qword [esp + 0x98], xmm0
lea ebx, [esp + 0x50]
mov ecx, ebx
call fcn.0055b010
lea esi, [esp + 0x8c]
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov ecx, dword [esp + 0xc]
push esi
call fcn.005bb0c0
pxor xmm0, xmm0
movq qword [ebx + 0x34], xmm0
pxor xmm0, xmm0
movdqu xmmword [ebx + 0x24], xmm0
mov dword [ebx], 0x3c
mov dword [ebx + 4], 0x40
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], str.runas
cmp byte [esp + 0xa3], 0
js 0x5b3c40
lea ecx, [esp + 0x98]
jmp 0x5b3c47
lea ecx, [esp + 0x98]
push dword [esp + 0x54]
push dword [esp + 0x54]
call fcn.00543180
jmp 0x5b3bc4
mov ecx, dword [esp + 0x98]
mov edi, dword [esp + 8]
mov al, byte [ebp + 8]
mov dword [esp + 0x60], ecx
cmp byte [esp + 0x97], 0
jns 0x5b3c63
mov esi, dword [esp + 0x8c]
mov dword [esp + 0x64], esi
xor esi, esi
mov dword [esp + 0x68], esi
xor al, 1
movzx eax, al
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], esi
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x5b3ce8
cmp byte [ebp + 0xc], 0
je 0x5b3ce1
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x20]
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea esi, [esp + 0x10]
push 0x9f
push str.launch_win.cc
push str.LaunchElevatedProcess
push esi
call fcn.0050b5e0
add esp, 0x10
mov ecx, ebx
push 0
push esi
call fcn.00522480
push 0xffffffffffffffff
push dword [esp + 0x8c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, ebx
lea ebx, [esp + 0x50]
call fcn.005403a0
mov esi, dword [esp + 0x88]
mov ecx, edi
push esi
call fcn.00410410
cmp byte [esp + 0x97], 0
jns 0x5b3d09
push dword [esp + 0x8c]
call fcn.00562f60
add esp, 4
cmp byte [esp + 0xa3], 0
jns 0x5b3d22
push dword [esp + 0x98]
call fcn.00562f60
add esp, 4
mov dword [esp + 0x20], 0xa
mov al, byte [0x649456]
test al, al
jne 0x5b3d4b
mov ecx, dword [esp + 0xa8]
xor ecx, ebp
call fcn.00566245
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
movzx eax, al
mov dword [esp + 0x50], 0
lea ecx, [esp + 0x20]
push 2
push ebx
push ecx
push eax
call fcn.0058ff60
add esp, 0x10
jmp 0x5b3d33
movzx eax, al
lea ecx, [esp + 0x50]
mov dword [ecx], str.LaunchElevatedProcess
lea edx, [esp + 0x20]
push 1
push ecx
push edx
push eax
call fcn.0058ff60
add esp, 0x10
jmp 0x5b3b78
Function at 0x5d28e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov eax, dword [0x644040]
xor eax, ebp
mov dword [esp + 0x78], eax
lea esi, [esp + 0x1c]
mov dword [esi], 0xffffffff
mov edx, esi
call fcn.0044c550
mov ebx, dword [esi]
mov edi, 3
mov esi, dword [ebp + 8]
test ebx, ebx
jne 0x5d294d
lea ecx, [esp + 0x1c]
call fcn.0044bd20
test esi, esi
je 0x5d2936
mov ecx, esi
call fcn.005e2e50
push esi
call fcn.00562f60
add esp, 4
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.00566245
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
lea edi, [ebp + 8]
mov al, byte [esi + 0x1c]
mov byte [esp + 0xc], al
xor eax, eax
push eax
call fcn.00578f4b
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], edx
mov esi, dword [edi]
lea eax, [esi + 0xc]
mov dword [esp + 0x10], eax
lea edi, [esp + 0x20]
mov ecx, edi
call fcn.005e2d60
movups xmm0, xmmword [esi + 0x38]
movaps xmmword [edi], xmm0
lea edi, [esp + 0x30]
mov ecx, edi
push dword [esp + 0x10]
call fcn.00545dd0
mov eax, dword [esp + 0x14]
mov dword [edi + 0x1c], eax
mov eax, dword [esp + 0x18]
mov dword [edi + 0x18], eax
xor eax, eax
mov dword [edi + 0x40], eax
mov al, byte [esp + 0xc]
mov byte [edi + 0x35], al
lea ecx, [ebx + 0x28]
lea edx, [esp + 0x20]
call fcn.005d4050
mov byte [ebx + 0x24], 1
cmp byte [edi + 0x17], 0
jns 0x5d29d0
push dword [esp + 0x3c]
call fcn.00562f60
add esp, 4
cmp byte [esp + 0x3b], 0
jns 0x5d29e3
push dword [esp + 0x30]
call fcn.00562f60
add esp, 4
lea ecx, [esi + 8]
lea eax, [esp + 0x20]
push eax
call fcn.005d2aa0
cmp byte [esp + 0x2b], 0
jns 0x5d2a03
push dword [esp + 0x20]
call fcn.00562f60
add esp, 4
mov edi, dword [esi + 0x20]
mov ebx, dword [esi + 0x24]
jmp 0x5d2a15
mov ecx, dword [edi]
call fcn.005e42e0
add edi, 4
cmp edi, ebx
jne 0x5d2a0b
lea eax, [esi + 0x38]
mov dword [esp + 0xc], eax
mov ebx, dword [esi + 0x2c]
mov edi, dword [esi + 0x30]
jmp 0x5d2a4a
mov ecx, ebx
lea eax, [esp + 0x20]
push eax
call fcn.005d2aa0
cmp byte [esp + 0x2b], 0
jns 0x5d2a47
push dword [esp + 0x20]
call fcn.00562f60
add esp, 4
add ebx, 0x14
cmp ebx, edi
jne 0x5d2a28
mov eax, dword [esp + 0xc]
movups xmm0, xmmword [eax]
mov eax, dword [ebp + 0xc]
movups xmmword [eax], xmm0
xor edi, edi
push edi
call fcn.005d7c00
add esp, 4
mov eax, dword [esi]
mov ecx, dword [eax + 4]
mov ecx, dword [ecx + 4]
lea ebx, [eax + ecx]
add ebx, 4
mov eax, dword [ebx]
mov ecx, dword [eax]
mov dword [esp + 0xc], ecx
call dword [0x63e19c]
mov ecx, ebx
push 2
push edi
push edi
call dword [esp + 0x18]
push edx
push eax
call fcn.005d7c60
add esp, 8
jmp 0x5d2919
Function at 0x5d2be0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0x10], eax
movups xmm0, xmmword [edx]
movups xmmword [ebp - 0x20], xmm0
mov esi, dword [ecx + 0x28]
mov ebx, dword [ecx + 0x2c]
cmp esi, ebx
je 0x5d2c23
mov dword [ebp - 0x24], ecx
lea edi, [ebp - 0x20]
mov ecx, esi
push edi
call fcn.005e5030
test al, al
jne 0x5d2c1d
add esi, 0x58
cmp esi, ebx
jne 0x5d2c0a
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax + 0x2c]
cmp esi, ebx
je 0x5d2c5a
cmp byte [esi + 0x1b], 0
js 0x5d2c32
lea eax, [esi + 0x10]
jmp 0x5d2c35
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
xor edi, edi
inc edi
cmp eax, 0xffffffff
cmovne edi, ecx
test edi, edi
jne 0x5d2c5d
mov eax, dword [ebp + 8]
mov dword [eax], esi
xor edi, edi
jmp 0x5d2c5d
xor edi, edi
inc edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00566245
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x5d2da0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0x10], eax
movups xmm0, xmmword [edx]
movups xmmword [ebp - 0x20], xmm0
mov edi, dword [ecx + 0x28]
mov esi, dword [ecx + 0x2c]
cmp edi, esi
je 0x5d2de3
mov dword [ebp - 0x24], ecx
lea ebx, [ebp - 0x20]
mov ecx, edi
push ebx
call fcn.005e5030
test al, al
jne 0x5d2ddd
add edi, 0x58
cmp edi, esi
jne 0x5d2dca
mov ecx, dword [ebp - 0x24]
mov esi, dword [ecx + 0x2c]
xor ebx, ebx
inc ebx
cmp edi, esi
je 0x5d2e33
mov eax, dword [edi + 0x50]
cmp eax, dword [ebp + 8]
jne 0x5d2e27
cmp byte [edi + 0x1b], 0
js 0x5d2dff
mov esi, ecx
lea eax, [edi + 0x10]
jmp 0x5d2e04
mov esi, ecx
mov eax, dword [edi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x5d2e33
shr eax, 3
and eax, 2
mov ebx, eax
jne 0x5d2e33
mov eax, dword [ebp + 0xc]
mov byte [esi + 0x24], 1
mov dword [eax], edi
xor ebx, ebx
jmp 0x5d2e33
xor ecx, ecx
cmp eax, 1
sete cl
lea ebx, [ecx + ecx*2]
inc ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00566245
mov eax, ebx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5e0be0
Capabilities:
Terminate process

Disassembly:
cmp dword [ecx + 8], 0
mov eax, dword [ecx]
je 0x5e0bf6
push ebp
mov ebp, esp
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop ebp
ret
test eax, eax
jne 0x5e0be8
cmp dword [ecx + 0xc], 0
jne 0x5e0be8
cmp dword [ecx + 4], 0
jne 0x5e0be8
jmp 0x5e0bf5