joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45b3dd
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x34
mov eax, 0x51b05b
call fcn.004d8abf
mov ebx, ecx
mov dword [ebp - 0x1c], ebx
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x50], 0
je 0x45b552
mov eax, dword [ecx + 0x4c]
mov esi, dword [eax]
cmp esi, eax
je 0x45b552
mov ebx, ecx
mov ecx, dword [esi + 8]
sub ecx, 0x10
call fcn.004070e7
add eax, 0x10
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.0040687a
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
push ecx
mov ecx, dword [ebp - 0x10]
mov edi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x28], edi
lea ecx, [ecx - 0x10]
call fcn.004070e7
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 2
lea eax, [ebx + 0x80]
mov ecx, dword [ebx + 0x110]
add ecx, 4
push eax
push ecx
mov edi, esp
mov ecx, dword [ecx]
sub ecx, 0x10
mov dword [ebp - 0x28], edi
call fcn.004070e7
add eax, 0x10
lea ecx, [ebp - 0x34]
mov dword [edi], eax
mov edx, ebx
mov byte [ebp - 4], 1
call fcn.0043eb58
add esp, 0x10
cmp dword [ebp - 0x34], 0
jge 0x45b49e
mov ecx, dword [ebp - 0x2c]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
jmp 0x45b530
mov edi, dword [ebp - 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x45b522
lea ecx, [ebp - 0x18]
call fcn.0040687a
push 0
push ecx
mov ebx, esp
mov byte [ebp - 4], 4
lea ecx, [edi - 0x10]
mov dword [ebp - 0x28], ebx
call fcn.004070e7
add eax, 0x10
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x40]
mov dword [ebx], eax
call fcn.0042e281
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 5
call fcn.004032ed
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x38]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebx + 0x110]
add ecx, 0x34
call fcn.00409159
mov ecx, eax
call fcn.00405d6e
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x2c]
lea ecx, [ecx - 0x10]
call fcn.00407189
lea ecx, [edi - 0x10]
call fcn.00407189
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00407189
mov esi, dword [esi]
cmp esi, dword [ebx + 0x4c]
jne 0x45b40a
mov ebx, dword [ebp - 0x1c]
and dword [ebx], 0
lea ecx, [ebx + 8]
and dword [ebx + 4], 0
call fcn.0040687a
mov eax, ebx
call fcn.004d8a8d
ret
Function at 0x45ce2a
Capabilities:
Check mutex on windows

Disassembly:
push 0x18
mov eax, 0x51b3c2
call fcn.004d8abf
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x20], edi
push str.Global_MSIExecute
xor ebx, ebx
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], ebx
test eax, eax
jne 0x45ce71
call fcn.00406710
lea ecx, [edi + 8]
mov dword [edi], ebx
mov dword [edi + 4], ebx
call fcn.0040687a
jmp 0x45cffc
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
imul eax, esi, 0xa8
mov byte [ebp - 0xd], 1
mov dword [ebp - 0x18], eax
mov eax, dword [0x57d3ec]
add eax, 0x54
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 1
call fcn.0044f24f
push str.Waiting_for_another_installation_to_finish...__MSI_
mov esi, eax
call fcn.004ddaa2
pop ecx
push eax
push str.Waiting_for_another_installation_to_finish...__MSI_
lea ecx, [esi + 0x48]
call fcn.00406efb
call fcn.0044f24f
push ecx
mov ecx, esp
push str.Waiting
mov esi, dword [eax + 0x1ac]
add esi, dword [ebp - 0x18]
call fcn.00406fea
mov ecx, esi
call fcn.0044eeac
lea ecx, [ebp - 0xd]
mov byte [ebp - 4], 0
call fcn.0044f694
mov eax, dword [0x57d3ec]
cmp byte [eax + 1], 0
jne 0x45cfd5
mov esi, dword [ebp - 0x14]
push 0x3e8
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x45cfbd
inc ebx
cmp byte [ebp + 8], 0
mov dword [ebp - 0x1c], ebx
je 0x45ce86
mov eax, dword [0x57d3ec]
add eax, 0x54
mov byte [ebp - 0xe], 1
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 2
call fcn.0044f24f
lea ecx, [ebp - 0xe]
mov bl, byte [eax + 0x24]
mov byte [ebp - 4], 0
call fcn.0044f694
test bl, bl
jne 0x45cfa9
mov ebx, dword [ebp - 0x1c]
cmp ebx, 0x708
jbe 0x45ce86
mov eax, dword [0x57d3ec]
add eax, 0x54
mov byte [ebp - 0xe], 1
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 3
call fcn.0044f24f
lea ecx, [ebp - 0xe]
mov byte [ebp - 4], 0
mov byte [eax + 0x24], 1
call fcn.0044f694
push 0xff0
push 0x80004005
push ecx
mov ecx, esp
push str.Timeout__waiting_for_MSI_installer_
call fcn.00406fea
mov ecx, edi
call fcn.00406620
push esi
jmp 0x45cff6
push 0xfeb
push 0x80004005
push ecx
mov ecx, esp
push str.Timeout__waiting_for_MSI_installer__2_
jmp 0x45cf9a
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
and dword [edi], 0
lea ecx, [edi + 8]
and dword [edi + 4], 0
call fcn.0040687a
jmp 0x45cfa6
push 0xfdc
push 0x80004004
push ecx
mov ecx, esp
push str.User_abort
call fcn.00406fea
mov ecx, edi
call fcn.00406620
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
call fcn.004d8a8d
ret
Function at 0x45d004
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push esi
push edi
push str.Global_MSIExecute
push 0
push 0x100000
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov esi, eax
lea ebx, [edi + 8]
test esi, esi
jne 0x45d037
call fcn.00406710
and dword [edi], esi
mov ecx, ebx
and dword [edi + 4], esi
call fcn.0040687a
jmp 0x45d06b
push 0
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x45d04f
mov dword [edi], 1
jmp 0x45d059
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
and dword [edi], 0
and dword [edi + 4], 0
mov ecx, ebx
call fcn.0040687a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x45d31b
Capabilities:
Delete service

Disassembly:
push 0x1c
mov eax, 0x51b476
call fcn.004d8abf
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov eax, dword [0x57d62c]
xor esi, esi
cmp dword [eax - 0xc], esi
jne 0x45d36d
push 0xd
push 0x80004005
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x28]
call fcn.00406620
mov dword [ebp - 4], esi
lea eax, [ebp - 0x28]
mov ecx, ebx
push eax
call fcn.0040121b
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.00407189
jmp 0x45d450
push 0xf003f
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], 1
test edi, edi
jne 0x45d3c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0xf
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x28]
call fcn.00406620
mov byte [ebp - 4], 2
jmp 0x45d352
push 0xf01ff
push dword [0x57d62c]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x45d3e4
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x45d433
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
je 0x45d42f
cmp eax, 0x430
je 0x45d42f
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x18
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
mov ecx, ebx
call fcn.00406620
test esi, esi
je 0x45d449
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x45d449
test esi, esi
je 0x45d43a
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
and dword [ebx], 0
lea ecx, [ebx + 8]
and dword [ebx + 4], 0
call fcn.0040687a
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
call fcn.004d8a8d
ret
Function at 0x45d886
Capabilities:
Delete service

Disassembly:
push 0x1c
mov eax, 0x51b588
call fcn.004d8abf
mov dword [ebp - 0x14], edx
mov edi, ecx
mov dword [ebp - 0x18], edi
mov ebx, dword [ebp + 8]
mov edx, str.NiniteTempSys
xor esi, esi
mov ecx, dword [ebx]
call fcn.0042981b
test al, al
jne 0x45d8c5
lea ecx, [edi + 8]
mov dword [edi], 1
mov dword [edi + 4], esi
call fcn.0040687a
jmp 0x45da5b
push 0x2d
push dword [ebx]
call fcn.004da090
pop ecx
pop ecx
test eax, eax
jne 0x45d904
push 0xc7
push 0x80004005
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x28]
call fcn.00406620
lea eax, [ebp - 0x28]
mov dword [ebp - 4], esi
push eax
mov ecx, edi
call fcn.0040121b
mov ecx, dword [ebp - 0x20]
jmp 0x45da53
add eax, 2
lea ecx, [ebp - 0x10]
push eax
call fcn.00406fea
mov dword [ebp - 4], 1
push dword [ebp - 0x10]
call fcn.004e4b85
pop ecx
test eax, eax
jne 0x45d95d
push 0xca
push 0x80004005
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x28]
call fcn.00406620
mov byte [ebp - 4], 2
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
call fcn.0040121b
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.00407189
jmp 0x45da50
push eax
push esi
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x45da3a
cmp eax, 5
je 0x45da41
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push 0x10000
inc dword [ebx]
push dword [eax]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
mov dword [ebp + 8], esi
mov byte [ebp - 4], 3
test esi, esi
jne 0x45d9e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0xcf
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x28]
call fcn.00406620
mov byte [ebp - 4], 4
jmp 0x45d942
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x45d9ff
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x430
jne 0x45da08
dec dword [ebx]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x45da41
movzx ecx, ax
or ecx, 0x80070000
mov dword [edi + 4], 0xd5
test eax, eax
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
lea ecx, [edi + 8]
mov dword [edi], eax
call fcn.0040687a
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x45da50
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [edi], 0
lea ecx, [edi + 8]
and dword [edi + 4], 0
call fcn.0040687a
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov eax, edi
call fcn.004d8a8d
ret
Function at 0x45da63
Capabilities:
Enumerate services

Disassembly:
push 0x44
mov eax, 0x51b5c2
call fcn.004d8abf
mov eax, edx
mov dword [ebp - 0x28], eax
mov edi, ecx
mov dword [ebp - 0x2c], edi
xor ebx, ebx
push 0xf003f
push ebx
push ebx
mov dword [eax], ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 4], ebx
test esi, esi
jne 0x45dae9
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0xe4
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x50]
call fcn.00406620
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 1
push eax
mov ecx, edi
call fcn.0040121b
mov ecx, dword [ebp - 0x48]
lea ecx, [ecx - 0x10]
call fcn.00407189
jmp 0x45dbfa
push ecx
push 0x4000
lea ecx, [ebp - 0x44]
call fcn.004ae76d
mov byte [ebp - 4], 2
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x20], ebx
mov ecx, dword [ebp - 0x44]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x40]
sub eax, ecx
push eax
push ecx
push 3
push 0x10
push esi
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], ebx
test eax, eax
jne 0x45db48
cmp ebx, 0xea
jne 0x45dbb9
and dword [ebp - 0x24], 0
cmp dword [ebp - 0x14], 0
jbe 0x45db8c
mov edi, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
push ebx
push eax
mov edx, esi
lea ecx, [ebp - 0x50]
call fcn.0045d886
pop ecx
pop ecx
mov ecx, dword [ebp - 0x48]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov eax, dword [ebp - 0x10]
inc edi
add eax, 0x24
mov dword [ebp - 0x10], eax
cmp edi, dword [ebp - 0x14]
jb 0x45db5b
mov edi, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x45dbdc
cmp ebx, 0xea
jne 0x45dbb9
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x44]
sub eax, ecx
cmp eax, dword [ebp - 0x18]
jae 0x45db07
push dword [ebp - 0x18]
lea ecx, [ebp - 0x44]
call fcn.00409336
jmp 0x45db04
movzx ecx, bx
mov eax, 0x80004005
or ecx, 0x80070000
mov dword [edi + 4], 0x10a
test ebx, ebx
cmovle ecx, ebx
test ecx, ecx
cmovs eax, ecx
mov dword [edi], eax
jmp 0x45dbe3
and dword [edi], 0
and dword [edi + 4], 0
lea ecx, [edi + 8]
call fcn.0040687a
lea ecx, [ebp - 0x44]
call fcn.00409384
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
call fcn.004d8a8d
ret
Function at 0x45e2cf
Capabilities:
Acquire debug privileges

Disassembly:
push 0xa4
mov eax, 0x51b6d8
call fcn.004d8af2
mov ebx, edx
mov esi, ecx
mov dword [ebp - 0xa0], esi
mov dword [ebp - 0xa0], esi
xor edi, edi
mov dword [ebp - 0x9c], str.SeCreateTokenPrivilege
mov dword [ebp - 0x98], str.SeAssignPrimaryTokenPrivilege
mov dword [ebp - 0x94], str.SeLoadDriverPrivilege
mov dword [ebp - 0x90], str.SeBackupPrivilege
mov dword [ebp - 0x8c], str.SeRestorePrivilege
mov dword [ebp - 0x88], str.SeDebugPrivilege
mov dword [ebp - 0x84], str.SeTakeOwnershipPrivilege
mov dword [ebp - 0x80], str.SeLockMemoryPrivilege
mov dword [ebp - 0x7c], str.SeIncreaseQuotaPrivilege
mov dword [ebp - 0x78], str.SeUnsolicitedInputPrivilege
mov dword [ebp - 0x74], str.SeMachineAccountPrivilege
mov dword [ebp - 0x70], str.SeTcbPrivilege
mov dword [ebp - 0x6c], 0x552dcc
mov dword [ebp - 0x68], str.SeSystemProfilePrivilege
mov dword [ebp - 0x64], str.SeSystemtimePrivilege
mov dword [ebp - 0x60], str.SeProfileSingleProcessPrivilege
mov dword [ebp - 0x5c], str.SeIncreaseBasePriorityPrivilege
mov dword [ebp - 0x58], str.SeCreatePagefilePrivilege
mov dword [ebp - 0x54], str.SeCreatePermanentPrivilege
mov dword [ebp - 0x50], str.SeShutdownPrivilege
mov dword [ebp - 0x4c], str.SeAuditPrivilege
mov dword [ebp - 0x48], str.SeSystemEnvironmentPrivilege
mov dword [ebp - 0x44], str.SeChangeNotifyPrivilege
mov dword [ebp - 0x40], str.SeRemoteShutdownPrivilege
mov dword [ebp - 0x3c], str.SeUndockPrivilege
mov dword [ebp - 0x38], str.SeSyncAgentPrivilege
mov dword [ebp - 0x34], str.SeEnableDelegationPrivilege
mov dword [ebp - 0x30], str.SeManageVolumePrivilege
mov dword [ebp - 0x2c], str.SeImpersonatePrivilege
mov dword [ebp - 0x28], str.SeCreateGlobalPrivilege
mov dword [ebp - 0x24], str.SeTrustedCredManAccessPrivilege
mov dword [ebp - 0x20], str.SeRelabelPrivilege
mov dword [ebp - 0x1c], str.SeIncreaseWorkingSetPrivilege
mov dword [ebp - 0x18], str.SeTimeZonePrivilege
mov dword [ebp - 0x14], str.SeCreateSymbolicLinkPrivilege
push dword [ebp + edi*4 - 0x9c]
mov edx, ebx
lea ecx, [ebp - 0xb0]
call fcn.0045e248
pop ecx
mov ecx, dword [ebp - 0xa8]
lea ecx, [ecx - 0x10]
call fcn.00407189
inc edi
cmp edi, 0x23
jb 0x45e3fa
and dword [esi], 0
lea ecx, [esi + 8]
and dword [esi + 4], 0
call fcn.0040687a
mov eax, esi
call fcn.004d8aa1
ret
Function at 0x45fc1c
Capabilities:
Get token membership

Disassembly:
push 0x80
mov eax, 0x51b9a5
call fcn.004d8af2
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x78], esi
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x70]
push 0x12
push 1
push 0x53d240
mov dword [ebp - 0x78], esi
and dword [ebp - 0x78], 0
push eax
call fcn.004d6394
add esp, 0x10
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x6c]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
lea ecx, [ebp - 0x70]
call fcn.004d6486
cmp dword [ebp - 0x78], 0
jne 0x45fc86
and dword [esi + 4], 0
lea ecx, [esi + 8]
mov dword [esi], 1
call fcn.0040687a
jmp 0x45fdcb
and dword [ebp - 0x74], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x74]
push eax
push 0xa
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x45fd02
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x229
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x88]
call fcn.00406620
mov byte [ebp - 4], 1
lea eax, [ebp - 0x88]
mov ecx, esi
push eax
call fcn.0040121b
mov ecx, dword [ebp - 0x80]
lea ecx, [ecx - 0x10]
call fcn.00407189
cmp dword [ebp - 0x74], 0
jmp 0x45fdc0
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
push 1
push 3
push 0
push 0xf01ff
push dword [ebp - 0x74]
call edi
test eax, eax
jne 0x45fd5a
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x22b
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x88]
call fcn.00406620
mov byte [ebp - 4], 2
jmp 0x45fce0
push ebx
push 2
push 3
xor ebx, ebx
push ebx
push 0xf01ff
push dword [ebp - 0x74]
call edi
test eax, eax
jne 0x45fdb0
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x22c
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x88]
call fcn.00406620
mov byte [ebp - 4], 3
jmp 0x45fce0
lea ecx, [esi + 8]
mov dword [esi], ebx
mov dword [esi + 4], ebx
call fcn.0040687a
cmp dword [ebp - 0x74], ebx
je 0x45fdcb
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
call fcn.004d8aa1
ret
Function at 0x46b0a1
Capabilities:
Acquire debug privileges
Terminate process

Disassembly:
push 0x1c
mov eax, 0x51d23d
call fcn.004d8abf
mov esi, ecx
mov dword [ebp - 0x14], esi
mov edx, str.SeDebugPrivilege
lea ecx, [ebp - 0x28]
xor ebx, ebx
call fcn.0040124a
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov eax, dword [esi + 0x70]
mov esi, dword [eax]
cmp esi, eax
je 0x46b16d
lea ecx, [ebp - 0x1c]
call fcn.004ad089
and dword [ebp - 4], 0
push ecx
mov edi, esp
mov dword [ebp - 0x10], edi
mov ecx, dword [esi + 8]
sub ecx, 0x10
call fcn.004070e7
add eax, 0x10
lea ecx, [ebp - 0x1c]
mov dword [edi], eax
call fcn.0043a679
pop ecx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx]
mov dword [ebp - 0x10], eax
cmp eax, ecx
je 0x46b144
push dword [eax + 0x10]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x46b134
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
inc ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x10]
call fcn.004094c2
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x1c]
jne 0x46b110
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.004ad0b7
mov eax, dword [ebp - 0x14]
mov esi, dword [esi]
cmp esi, dword [eax + 0x70]
jne 0x46b0d9
test ebx, ebx
je 0x46b16d
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004d8a8d
ret
Function at 0x4720b1
Capabilities:
Create directory

Disassembly:
push 0x14
mov eax, 0x51e3a2
call fcn.004d8abf
mov dword [ebp - 0x1c], edx
mov edi, ecx
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x18], 1
and dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.004282f6
mov esi, eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.004283a1
push esi
mov edx, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10]
call fcn.0040a037
pop ecx
mov byte [ebp - 4], 3
mov ebx, dword [ebp + 0x10]
mov ecx, ebx
push eax
call fcn.00405d6e
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00407189
push 0
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x472176
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x1daf
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
mov ecx, edi
call fcn.00406620
mov ecx, dword [ebp + 0x1c]
lea ecx, [ecx - 0x10]
jmp 0x47226d
push dword [ebp + 0x20]
push ecx
mov esi, esp
mov dword [ebp + 0x10], esp
mov dword [ebp - 0x18], esi
mov eax, dword [ebp + 0x1c]
add eax, 0xfffffff0
mov ecx, eax
mov dword [ebp - 0x14], eax
call fcn.004070e7
add eax, 0x10
mov dword [esi], eax
push dword [ebp + 0x18]
mov byte [ebp - 4], 4
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push ecx
mov esi, esp
mov dword [ebp - 0x18], esi
mov ecx, dword [ebx]
sub ecx, 0x10
call fcn.004070e7
push dword [ebp + 8]
mov edx, dword [ebp - 0x1c]
add eax, 0x10
mov dword [esi], eax
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.004713b4
add esp, 0x1c
mov byte [ebp - 4], 5
cmp dword [edi], 0
mov dword [ebp - 0x18], 3
jl 0x472221
cmp dword [edi], 1
je 0x472221
mov eax, dword [0x57d3ec]
add eax, 0x54
mov byte [ebp + 0x13], 1
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 6
call fcn.0044f24f
imul ecx, dword [ebp + 0xc], 0xa8
push ebx
add ecx, 0x58
add ecx, dword [eax + 0x1ac]
call fcn.00405d6e
lea ecx, [ebp + 0x13]
call fcn.0044f694
jmp 0x47226a
push ecx
mov esi, esp
mov dword [ebp + 0x10], esi
mov ecx, dword [ebx]
sub ecx, 0x10
call fcn.004070e7
add eax, 0x10
xor ecx, ecx
mov dword [esi], eax
call fcn.00428b15
pop ecx
test eax, eax
jns 0x47226a
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ecx
mov esi, esp
mov dword [ebp + 0x10], esi
mov ecx, dword [ebx]
sub ecx, 0x10
call fcn.004070e7
add eax, 0x10
xor ecx, ecx
mov dword [esi], eax
call fcn.00428b15
pop ecx
mov ecx, dword [ebp - 0x14]
call fcn.00407189
mov eax, edi
call fcn.004d8a8d
ret
Function at 0x476c5c
Capabilities:
Identify system language via api

Disassembly:
push 0x230
mov eax, 0x51eee3
call fcn.004d8af2
mov edi, ecx
xor ebx, ebx
call fcn.004013b8
mov byte [edi], al
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
lea edx, [edi + 4]
movzx esi, ax
lea ecx, [ebp - 0x23c]
call fcn.0043b840
mov ecx, dword [ebp - 0x234]
lea ecx, [ecx - 0x10]
call fcn.00407189
push esi
lea ecx, [edi + 0xc]
push 0x54b5a4
push ecx
call fcn.00409fd2
add esp, 0xc
lea ecx, [ebp - 0x22c]
call fcn.0042b0ee
lea ecx, [ebp - 0x230]
push ecx
mov ecx, eax
call fcn.0042adaa
push eax
lea ecx, [edi + 0x10]
mov dword [ebp - 4], ebx
call fcn.00405d6e
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x230]
lea ecx, [ecx - 0x10]
call fcn.00407189
push 0x100
lea eax, [ebp - 0x110]
push ebx
push eax
call fcn.004d9f30
add esp, 0xc
lea eax, [ebp - 0x110]
push 0x80
push eax
push 0x40cd
push dword [0x57d39c]
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x110]
push eax
lea esi, [edi + 0x14]
call fcn.004ddaa2
pop ecx
push eax
lea eax, [ebp - 0x110]
mov ecx, esi
push eax
call fcn.00406efb
mov dword [edi + 0x18], ebx
push 0x2c
push dword [esi]
call fcn.004da090
pop ecx
pop ecx
test eax, eax
je 0x476d82
mov edx, dword [esi]
sub eax, edx
sar eax, 1
cmp eax, 0xffffffff
je 0x476d82
lea ecx, [eax + 1]
mov eax, dword [edx - 0xc]
sub eax, ecx
push eax
push ecx
lea eax, [ebp - 0x230]
mov ecx, esi
push eax
call fcn.0040467c
mov esi, dword [ebp - 0x230]
push esi
call fcn.004e4b85
pop ecx
lea ecx, [esi - 0x10]
mov dword [edi + 0x18], eax
call fcn.00407189
call fcn.004d8aa1
ret