joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46bcf5
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x611172
call fcn.0060c3a8
push ecx
push ebx
push esi
mov esi, ecx
xor eax, eax
push edi
mov dword [ebp - 0x10], esi
push 0x11
or dword [esi + 0x18], 0xffffffff
pop ebx
push 0xa
pop edi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], ebx
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0xc], 0x3f400000
mov dword [esi + 0x10], 0x3e800000
mov dword [esi + 0x14], 0x40100000
call fcn.0044ffaa
lea ecx, [esi + 0x30]
xor eax, eax
mov dword [ebp - 4], eax
or dword [ecx + 0x18], 0xffffffff
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], ebx
mov dword [ecx + 0x1c], eax
mov dword [ecx + 0x20], eax
mov dword [ecx + 0x24], edi
mov dword [ecx + 0x28], eax
mov dword [ecx + 0x2c], eax
mov dword [ecx + 0xc], 0x3f400000
mov dword [ecx + 0x10], 0x3e800000
mov dword [ecx + 0x14], 0x40100000
call fcn.0044ffaa
mov byte [ebp - 4], 1
and dword [esi + 0x60], 0
push 0x6c8b04
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x46c03f
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
xor esi, esi
mov edi, ecx
push esi
push esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jns 0x46c061
xor eax, eax
inc eax
jmp 0x46c0cd
cmp dword [edi], esi
je 0x46c06a
xor esi, esi
inc esi
jmp 0x46c0b1
lea eax, [ebp - 8]
push eax
push 0x69c248
push 1
push esi
push 0x69c228
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x46c08a
push 2
pop esi
jmp 0x46c0b1
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
jns 0x46c09f
push 3
jmp 0x46c087
mov eax, dword [ebp - 4]
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
push 4
test eax, eax
pop ecx
cmovs esi, ecx
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x46c0be
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [ebp - 8]
test eax, eax
je 0x46c0cb
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x46c9d0
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x37c0
call fcn.0060ba10
push ebx
push esi
xor ebx, ebx
xor esi, esi
push edi
push esi
lea eax, [ebp - 0x110]
push str..PhysicalDrive_d
push eax
call fcn.0040b647
add esp, 0xc
lea eax, [ebp - 0x110]
push 0
push 0
push 3
push 0
push 3
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x46cb7d
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push 0xc
push 0
push eax
call fcn.005e1e60
xor eax, eax
push 0x2710
push eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x37c0]
push eax
call fcn.005e1e60
add esp, 0x18
lea eax, [ebp - 4]
push 0
push eax
push 0x2710
lea eax, [ebp - 0x37c0]
push eax
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0x2d1400
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x46cb70
mov edx, dword [ebp - 0x37b4]
lea eax, [ebp - 0xcc8]
push eax
push 0
lea ecx, [ebp - 0x37c0]
call fcn.0046c86e
mov edx, dword [ebp - 0x37b0]
lea eax, [ebp - 0x8e0]
push eax
push 0
lea ecx, [ebp - 0x37c0]
call fcn.0046c86e
mov edx, dword [ebp - 0x37ac]
lea eax, [ebp - 0x10b0]
push eax
push 0
lea ecx, [ebp - 0x37c0]
call fcn.0046c86e
mov edx, dword [ebp - 0x37a8]
lea eax, [ebp - 0x4f8]
push eax
push 1
lea ecx, [ebp - 0x37c0]
call fcn.0046c86e
add esp, 0x20
cmp byte [0x6c7dd8], 0
jne 0x46cb37
movsx eax, byte [ebp - 0x4f8]
push eax
call fcn.005f0529
pop ecx
test eax, eax
jne 0x46cb0f
movsx eax, byte [ebp - 0x4e5]
push eax
call fcn.005f0529
pop ecx
test eax, eax
je 0x46cb37
lea eax, [ebp - 0x4f8]
push eax
push 0x6c7dd8
call fcn.005f3c20
lea eax, [ebp - 0x8e0]
push eax
push 0x6c81d8
call fcn.005f3c20
xor ebx, ebx
add esp, 0x10
inc ebx
push 0x2710
lea eax, [ebp - 0x37c0]
push 0
push eax
call fcn.005e1e60
add esp, 0xc
lea eax, [ebp - 4]
xor ecx, ecx
push ecx
push eax
push 0x2710
lea eax, [ebp - 0x37c0]
push eax
push ecx
push ecx
push 0x700a0
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
jmp 0x46cb76
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, 0x10
jl 0x46c9e4
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46daf8
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
push 0x69c6c4
mov ebx, 0x6c88e0
push ebx
call fcn.0048e513
mov esi, dword [ebp + 8]
pop ecx
pop ecx
mov ecx, esi
call fcn.0046d87e
test eax, eax
jne 0x46db3b
push str.DownloadControl_curlExecuter_Invalid
push ebx
call fcn.0048e513
pop ecx
pop ecx
mov eax, 0x100
jmp 0x46dd10
push dword [ebp + 0xc]
push esi
call fcn.0046d9a4
mov edi, eax
test edi, edi
je 0x46db5c
push str.DownloadControl_GetDownloadFileLength_Failure
push ebx
call fcn.0048e513
pop ecx
pop ecx
jmp 0x46dd0e
push dword [esi + 4]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x46db73
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ebx, [esi + 0x18]
cmp dword [ebx], 0
je 0x46db86
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebx], 0
mov ecx, dword [esi + 4]
call fcn.0046f9fd
test eax, eax
je 0x46dba1
sub esp, 0x18
mov ecx, ebx
push dword [esi + 4]
call fcn.0046d72f
jmp 0x46dba6
mov eax, 0x80004005
test eax, eax
jns 0x46dbc5
push str.DownloadControl_CreateFile_Failure
push 0x6c88e0
call fcn.0048e513
pop ecx
pop ecx
mov eax, 0x102
jmp 0x46dd10
xor eax, eax
xor ebx, ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
jmp 0x46dc70
lea eax, [esp + 0x14]
mov edi, 0x103
push eax
push ecx
push esi
call fcn.0046dd19
mov ebx, eax
mov eax, dword [esp + 0x14]
push eax
push dword [esi + 0xc]
mov dword [esp + 0x18], eax
push ebx
push str.DownloadControl____ExE_CurlCode___d__Step___d__ResCode___d
push 0x6c88e0
call fcn.0048e513
add esp, 0x14
test ebx, ebx
je 0x46dc2f
cmp ebx, 0x1c
jne 0x46dc88
push 0x69c7f4
push 0x6c88e0
call fcn.0048e513
pop ecx
pop ecx
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x46dc70
mov edi, dword [esp + 0x10]
push edi
push 0x69c7a8
push 0x6c88e0
call fcn.0048e513
add esp, 0xc
cmp edi, 0xce
je 0x46dc56
cmp edi, 0xc8
jne 0x46dcbd
push dword [esi + 0xc]
push 0x69c7c0
push 0x6c88e0
call fcn.0048e513
add esp, 0xc
inc dword [esi + 0xc]
xor edi, edi
mov eax, dword [esi + 0x10]
xor edx, edx
mov ecx, dword [esi + 8]
dec eax
add eax, ecx
div ecx
cmp eax, dword [esi + 0xc]
jne 0x46dbd6
jmp 0x46dcd3
cmp ebx, 0x21
je 0x46dca7
cmp ebx, 0x2a
je 0x46dcbd
push ebx
push 0x69c828
push 0x6c88e0
call fcn.0048e513
add esp, 0xc
jmp 0x46dcd3
push 0x69c808
push 0x6c88e0
call fcn.0048e513
mov edi, 0x10a
jmp 0x46dcd1
push 0x69c7dc
push 0x6c88e0
call fcn.0048e513
mov edi, 0x109
pop ecx
pop ecx
mov ecx, esi
call fcn.0046d82f
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x46dcec
mov eax, dword [esp + 0x10]
test ebx, ebx
cmovne eax, ebx
mov dword [ecx], eax
mov ecx, 0x69c848
test edi, edi
mov eax, 0x69c840
cmovne eax, ecx
push eax
push 0x69c850
push 0x6c88e0
call fcn.0048e513
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x46f152
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
xor eax, eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
mov ebx, eax
test ecx, ecx
je 0x46f1d5
push edi
push eax
push 0x80
push 3
push eax
push 1
push SysReAllocString
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x46f1d4
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 4], eax
inc eax
push eax
call fcn.00499fd3
mov esi, eax
pop ecx
test esi, esi
je 0x46f1cc
push ebx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, eax
test ebx, ebx
je 0x46f1c5
mov ecx, dword [ebp - 4]
push esi
mov byte [esi + ecx], 0
mov ecx, dword [ebp - 8]
call fcn.00405d0b
push esi
call fcn.00499fce
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46f1dc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor edi, edi
xor eax, eax
push edi
push edi
push 2
push edi
inc eax
mov ebx, edx
push eax
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0xc], esi
cmp esi, 0xffffffff
je 0x46f257
mov eax, dword [ebx]
mov dword [ebp - 8], edi
cmp dword [eax - 4], 1
mov ecx, dword [eax - 0xc]
mov dword [ebp - 4], ecx
jle 0x46f224
push ecx
mov ecx, ebx
call fcn.00406c12
mov ecx, dword [ebp - 4]
push edi
lea eax, [ebp - 8]
push eax
push ecx
push dword [ebx]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0xffffffffffffffff
mov ecx, ebx
mov esi, eax
call fcn.00413e9a
test esi, esi
je 0x46f24e
mov eax, dword [ebp - 4]
cmp dword [ebp - 8], eax
push 1
pop eax
cmove edi, eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46f3e0
Capabilities:
Get disk information

Disassembly:
mov eax, 0x60d0c5
call fcn.0060c3a8
sub esp, 0x10
push esi
push edi
xor esi, esi
mov dword [ebp - 0x18], ecx
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov edi, eax
test edi, edi
je 0x46f4a7
push ebx
xor ecx, ecx
lea eax, [edi + 1]
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00499fd3
mov ebx, eax
mov dword [ebp - 0x1c], ebx
pop ecx
test ebx, ebx
je 0x46f4a4
lea ecx, [edi*2 + 2]
push ecx
push esi
push ebx
call fcn.005e1e60
add esp, 0xc
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov edi, eax
call fcn.00404f47
push eax
lea ecx, [ebp - 0x10]
call fcn.004065d8
shr edi, 2
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], ebx
test edi, edi
je 0x46f48f
push ebx
lea ecx, [ebp - 0x10]
call fcn.004060f8
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], esi
je 0x46f487
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x10]
push eax
call fcn.0042ba12
lea ecx, [ebp - 0x10]
add ebx, 8
call fcn.00406271
sub edi, 1
jne 0x46f45f
mov ebx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
xor esi, esi
add ecx, 0xfffffff0
inc esi
call fcn.00404ea9
push ebx
call fcn.00499fce
pop ecx
mov eax, esi
pop ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x46f4b7
Capabilities:
Get disk information
Get storage device properties

Disassembly:
mov eax, 0x60dc66
call fcn.0060c3a8
sub esp, 0x40
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
jne 0x46f4d8
xor eax, eax
jmp 0x46f580
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x46f4d1
xor ebx, ebx
call fcn.00404f47
push eax
lea ecx, [ebp - 0x14]
call fcn.004065d8
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x14]
push dword [esi]
push 0x69c900
push eax
call fcn.00406cc8
mov esi, dword [ebp - 0x14]
add esp, 0xc
push ebx
push ebx
push 3
push ebx
push 3
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edx, eax
mov dword [ebp - 0x14], edx
cmp edx, 0xffffffff
je 0x46f576
push 0xa
pop ecx
push 0x28
xor eax, eax
mov dword [ebp - 0x18], ebx
lea edi, [ebp - 0x4c]
mov dword [ebp - 0x24], ebx
rep stosd dword es:[edi], eax
pop ecx
push ebx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], ebx
push eax
push ecx
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x48], ecx
push eax
push 0xc
lea eax, [ebp - 0x24]
push eax
push 0x2d1400
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x46f56d
xor eax, eax
inc eax
cmp dword [ebp - 0x30], 7
cmovne ebx, eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esi - 0x10]
call fcn.00404ea9
mov eax, ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46f591
Capabilities:
Set registry value

Disassembly:
mov eax, 0x6113a2
call fcn.0060c3a8
sub esp, 0xc
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], edi
call fcn.00404f47
push eax
lea ecx, [ebp - 0x14]
call fcn.004065d8
push str.semauthority
push str.SOFTWAREKingsoft
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push str._s_s
push eax
call fcn.00406cc8
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
add esp, 0x10
push edi
push esi
push SysReAllocString
call fcn.0040af84
test eax, eax
je 0x46f614
push edi
call fcn.005f1a4f
pop ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x10], edi
je 0x46f614
push 8
lea eax, [ebp - 0x18]
push eax
push 0xb
push edi
push 0x6926e4
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [esi - 0x10]
call fcn.00404ea9
cmp dword [ebp - 0x10], 0
je 0x46f62b
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x46f6da
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov eax, 0x60d0c5
call fcn.0060c3a8
push ecx
push esi
push edi
mov edi, ecx
lea ecx, [ebp - 0x10]
push edi
call fcn.00406173
xor esi, esi
push edi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x46f750
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x46f750
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x46f750
lea ecx, [ebp - 0x10]
call fcn.0046f674
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], esi
je 0x46f753
mov ecx, eax
call fcn.0046f6da
test eax, eax
je 0x46f753
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x46f750
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x46f753
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00404ea9
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x46f770
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x60d0c5
call fcn.0060c3a8
sub esp, 0x5c
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
lea eax, [ebp - 0x64]
push ebx
push eax
mov esi, edx
mov edi, ecx
call fcn.005e1e60
add esp, 0xc
mov dword [ebp - 0x68], 0x44
xorps xmm0, xmm0
mov dword [ebp - 0x3c], 1
movups xmmword [ebp - 0x20], xmm0
call fcn.00404f47
push eax
lea ecx, [ebp - 0x10]
call fcn.004065d8
and dword [ebp - 4], ebx
lea eax, [ebp - 0x10]
push esi
push edi
push str.__s___s
push eax
call fcn.00406cc8
add esp, 0x10
cmp dword [ebp + 0xc], ebx
je 0x46f7d8
push 0xa
pop eax
jmp 0x46f7da
xor eax, eax
mov esi, dword [ebp - 0x10]
mov word [ebp - 0x38], ax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x68]
push eax
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x46f812
cmp dword [ebp + 8], 0
je 0x46f80f
push dword [ebp + 8]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x20], 0
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x46f827
push dword [ebp - 0x20]
call edi
and dword [ebp - 0x20], 0
cmp dword [ebp - 0x1c], 0
je 0x46f836
push dword [ebp - 0x1c]
call edi
and dword [ebp - 0x1c], 0
lea ecx, [esi - 0x10]
call fcn.00404ea9
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46f9fd
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov eax, 0x61080a
call fcn.0060c3a8
sub esp, 0xc
push ebx
push esi
push edi
mov esi, ecx
call fcn.00404f47
push eax
lea ecx, [ebp - 0x14]
call fcn.004065d8
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
push esi
call fcn.00406173
push 3
push 0x5c
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00405fec
mov edi, eax
add edi, 1
je 0x46fa9c
push edi
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
call fcn.00405d36
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.00406123
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
mov esi, dword [ebp - 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x46fa88
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, eax
test ebx, ebx
je 0x46faa2
push edi
push 0x5c
lea ecx, [ebp - 0x10]
call fcn.00405fec
mov edi, eax
add edi, 1
jne 0x46fa41
jmp 0x46fa9f
mov esi, dword [ebp - 0x14]
xor ebx, ebx
inc ebx
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
lea ecx, [esi - 0x10]
call fcn.00404ea9
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x470083
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x60df80
call fcn.0060c3a8
sub esp, 0x74
push ebx
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
jne 0x4700a2
xor eax, eax
jmp 0x4701df
call fcn.00404f47
push eax
lea ecx, [ebp - 0x1c]
call fcn.004065d8
push edi
push esi
lea eax, [ebp - 0x1c]
xor ebx, ebx
push str.__s___s
push eax
mov dword [ebp - 4], ebx
call fcn.00406cc8
add esp, 0x10
mov dword [ebp - 0x10], ebx
lea ecx, [ebp - 0x10]
call fcn.00419c61
mov esi, dword [ebp - 0x1c]
test eax, eax
jne 0x4701c6
push 0x40
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x80], 0x44
push ebx
push eax
call fcn.005e1e60
add esp, 0xc
xorps xmm0, xmm0
movups xmmword [ebp - 0x34], xmm0
cmp dword [ebp + 8], ebx
je 0x470105
push 5
pop eax
jmp 0x470107
xor eax, eax
push str.userenv.dll
mov word [ebp - 0x50], ax
mov dword [ebp - 0x78], str.Winsta0Default
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x20], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
mov dword [ebp - 0x14], edi
test edi, edi
je 0x470171
push str.CreateEnvironmentBlock
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call edi
push str.DestroyEnvironmentBlock
push dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
call edi
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x47016e
push ebx
push dword [ebp - 0x10]
lea ecx, [ebp - 0x18]
push ecx
call eax
mov edi, dword [ebp - 0x14]
test eax, eax
je 0x470169
mov eax, 0x430
jmp 0x470174
mov dword [ebp - 0x18], ebx
jmp 0x470171
mov edi, dword [ebp - 0x14]
push 0x30
pop eax
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x80]
push ecx
push ebx
push dword [ebp - 0x18]
push eax
push ebx
push ebx
push ebx
push esi
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
cmp dword [ebp - 0x34], 0
mov ebx, eax
je 0x4701a0
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x30], 0
je 0x4701af
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x4701bb
push dword [ebp - 0x18]
call eax
test edi, edi
je 0x4701c6
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x10], 0
je 0x4701d5
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esi - 0x10]
call fcn.00404ea9
mov eax, ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4701f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x870
and dword [ebp - 8], 0
lea eax, [ebp - 0x68]
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
mov dword [ebp - 0x20], ecx
push ebx
push eax
mov edi, edx
mov dword [ebp - 0x6c], 0x44
call fcn.005e1e60
and dword [ebp - 0xc], ebx
lea edx, [ebp - 0xc]
add esp, 0xc
xorps xmm0, xmm0
movups xmmword [ebp - 0x1c], xmm0
xor esi, esi
call fcn.00471198
test eax, eax
je 0x4702cd
mov ecx, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.00471255
push 0x800
lea eax, [ebp - 0x86c]
push ebx
push eax
call fcn.005e1e60
push edi
push dword [ebp - 0x20]
lea eax, [ebp - 0x86c]
push str.__s___s
push 0x400
push eax
call fcn.0043ca79
add esp, 0x20
push 0x695f10
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x4702af
push str.CreateProcessWithTokenW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4702af
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x6c]
push ecx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x86c]
push ecx
push ebx
push ebx
push dword [ebp - 8]
call eax
jmp 0x4702cb
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x6c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x86c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebx, eax
cmp dword [ebp - 8], 0
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x4702e2
push dword [ebp - 8]
call edi
and dword [ebp - 8], 0
cmp dword [ebp - 0x1c], 0
je 0x4702f1
push dword [ebp - 0x1c]
call edi
and dword [ebp - 0x1c], 0
cmp dword [ebp - 0x18], 0
je 0x470300
push dword [ebp - 0x18]
call edi
and dword [ebp - 0x18], 0
test esi, esi
je 0x47030b
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret