joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bd880
Capabilities:
Connect socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10
call fcn.00628570
mov eax, dword [0x70d514]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 8], 1
cmp esi, 0xffffffff
jne 0x4bd8d6
push 0x52
push str.C:mediagetdependencies_installeropenssl1_1_win_build_1.1.1qcrypto_bio_b_sock2.c
push 0x87
mov edx, 0x8a
lea ecx, [esi + 0x21]
call fcn.004818c0
add esp, 0xc
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0062844a
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp + 8]
mov eax, ebx
shr eax, 3
and eax, 1
push edi
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x8004667e
push esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
jns 0x4bd92e
push 0xc3
push str.C:mediagetdependencies_installeropenssl1_1_win_build_1.1.1qcrypto_bio_b_sock.c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, 5
push eax
lea ecx, [edx - 3]
call fcn.004818c0
add esp, 0xc
pop edi
pop ebx
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0062844a
mov esp, ebp
pop ebp
ret
jne 0x4bd91b
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
test bl, 4
je 0x4bd97b
push 4
lea eax, [ebp - 8]
push eax
push 8
push 0xffff
push esi
call edi
test eax, eax
je 0x4bd97b
push 0x5c
push str.C:mediagetdependencies_installeropenssl1_1_win_build_1.1.1qcrypto_bio_b_sock2.c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, 0xe
push eax
lea ecx, [edx - 0xc]
call fcn.004818c0
push 0x5d
push str.C:mediagetdependencies_installeropenssl1_1_win_build_1.1.1qcrypto_bio_b_sock2.c
push 0x89
jmp 0x4bda0e
test bl, 0x10
je 0x4bd9ba
push 4
lea eax, [ebp - 8]
push eax
push 1
push 6
push esi
call edi
test eax, eax
je 0x4bd9ba
push 0x65
push str.C:mediagetdependencies_installeropenssl1_1_win_build_1.1.1qcrypto_bio_b_sock2.c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, 0xe
push eax
lea ecx, [edx - 0xc]
call fcn.004818c0
push 0x66
push str.C:mediagetdependencies_installeropenssl1_1_win_build_1.1.1qcrypto_bio_b_sock2.c
push 0x8a
jmp 0x4bda0e
mov edx, dword [ebp - 0x10]
mov edi, 0x10
mov eax, 0x1c
cmp word [edx], 2
cmove eax, edi
push eax
push edx
push esi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x4bda31
or ecx, eax
call fcn.004bdcd0
test eax, eax
jne 0x4bd91b
push 0x6e
push str.C:mediagetdependencies_installeropenssl1_1_win_build_1.1.1qcrypto_bio_b_sock2.c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, 2
push eax
mov ecx, edx
call fcn.004818c0
push 0x6f
push str.C:mediagetdependencies_installeropenssl1_1_win_build_1.1.1qcrypto_bio_b_sock2.c
push 0x67
mov edx, 0x8a
lea ecx, [edx - 0x6a]
call fcn.004818c0
add esp, 0x18
xor eax, eax
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0062844a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop ebx
xor ecx, ebp
pop esi
call fcn.0062844a
mov esp, ebp
pop ebp
ret
Function at 0x4c3fc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 8
call fcn.00628570
cmp dword [ecx], 0x72
push ebx
push esi
mov dword [ebp - 8], edx
jne 0x4c4172
mov esi, dword [ebp + 0x18]
mov ecx, 0x6a8514
mov eax, dword [ebp + 8]
mov ebx, eax
push esi
push dword [ebp + 0x14]
and eax, 1
shr ebx, 1
push dword [ebp + 0x10]
add eax, ebx
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
push eax
call fcn.004c3d20
add esp, 0x14
test eax, eax
je 0x4c418d
push edi
test esi, esi
je 0x4c414d
push esi
mov dword [0x70e32c], 0
call fcn.0063274d
mov edi, eax
add esp, 4
test edi, edi
je 0x4c414d
mov edx, dword [ebp - 8]
mov ecx, 0x694b94
push esi
push edi
push dword [ebp + 0x10]
lea edx, [ebx + edx]
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.004c3d20
add esp, 0x14
test eax, eax
jne 0x4c406e
push esi
push edi
call fcn.00401320
push edi
call fcn.0062f047
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor ebx, ebx
test esi, esi
je 0x4c4131
mov edx, dword [ebp + 0x14]
cmp esi, 0x40
jb 0x4c410a
lea eax, [esi - 1]
lea ecx, [edx - 1]
add eax, edi
add ecx, esi
cmp edx, eax
ja 0x4c4096
cmp ecx, edi
jae 0x4c410a
mov eax, esi
lea ecx, [edi + 0x30]
and eax, 0xffffffc0
mov esi, edi
sub esi, edx
mov dword [ebp - 4], eax
mov dword [ebp - 8], esi
lea eax, [edx + 0x10]
mov esi, dword [ebp + 0x18]
mov edx, dword [ebp - 8]
movups xmm0, xmmword [eax - 0x10]
add ebx, 0x40
lea ecx, [ecx + 0x40]
lea eax, [eax + 0x40]
movups xmm1, xmmword [ecx - 0x70]
pxor xmm1, xmm0
movups xmmword [eax - 0x50], xmm1
movups xmm0, xmmword [eax - 0x40]
movups xmm1, xmmword [edx + eax - 0x40]
pxor xmm1, xmm0
movups xmmword [eax - 0x40], xmm1
movups xmm0, xmmword [eax - 0x30]
movups xmm1, xmmword [ecx - 0x50]
pxor xmm1, xmm0
movups xmm0, xmmword [ecx - 0x40]
movups xmmword [eax - 0x30], xmm1
movups xmm1, xmmword [eax - 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
cmp ebx, dword [ebp - 4]
jb 0x4c40b1
mov edx, dword [ebp + 0x14]
mov dword [ebp - 8], ebx
cmp ebx, esi
jae 0x4c4131
mov eax, edi
lea ecx, [ebx + edx]
sub eax, edx
mov edx, esi
mov dword [ebp - 8], eax
sub edx, ebx
mov esi, eax
nop word [eax + eax]
mov al, byte [ecx + esi]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub edx, 1
jne 0x4c4120
mov esi, dword [ebp + 0x18]
push esi
push edi
call fcn.00401320
push edi
call fcn.0062f047
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, 0x6f
push 0x105
push str.C:mediagetdependencies_installeropenssl1_1_win_build_1.1.1qcryptokdf_tls1_prf.c
push 0x41
lea ecx, [edx - 0x3b]
call fcn.004818c0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004c3d20
add esp, 0x14
test eax, eax
jne 0x4c4195
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4cb5e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xc
call fcn.00628570
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push edi
call ebx
push dword [0x717140]
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
call eax
mov edi, eax
mov eax, dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
mov dword [ebp - 8], eax
call eax
test edi, edi
jne 0x4cb728
push edi
push 0x100
xor ecx, ecx
call fcn.00493940
add esp, 8
test eax, eax
je 0x4cb794
push edi
push edi
xor ecx, ecx
call fcn.00493940
add esp, 8
test eax, eax
je 0x4cb794
lea ecx, [edi + 1]
call fcn.00492bb0
test eax, eax
je 0x4cb794
push 0xc
mov dword [eax], 1
mov dword [0x70e32c], edi
call fcn.0063274d
mov esi, eax
add esp, 4
test esi, esi
je 0x4cb7d1
xorps xmm0, xmm0
mov dword [0x70e32c], edi
movq qword [esi], xmm0
push 0x14
mov dword [esi + 8], edi
call fcn.0063274d
add esp, 4
test eax, eax
je 0x4cb79d
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], edi
push esi
mov dword [esi], eax
mov dword [esi + 8], edi
mov dword [esi + 4], edi
push dword [0x717140]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x4cb715
push 0x16d
push str.C:mediagetdependencies_installeropenssl1_1_win_build_1.1.1qcrypto_async_async.c
push 0x65
lea edx, [edi + 0x65]
lea ecx, [edi + 0x33]
call fcn.004818c0
add esp, 0xc
mov ecx, esi
call fcn.004cbb90
mov edi, dword [esi]
test edi, edi
je 0x4cb78b
push dword [edi + 4]
call fcn.0062f047
add esp, 4
push edi
call fcn.0062f047
add esp, 4
push esi
call fcn.0062f047
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call ebx
push dword [0x717140]
mov esi, eax
call dword [ebp - 4]
push esi
mov edi, eax
call dword [ebp - 8]
mov ecx, dword [edi]
test ecx, ecx
je 0x4cb748
mov edx, dword [ecx]
test edx, edx
je 0x4cb748
mov eax, dword [ecx + 4]
mov esi, dword [eax + edx*4 - 4]
lea eax, [edx - 1]
mov dword [ecx], eax
test esi, esi
jne 0x4cb7f9
mov eax, dword [edi + 8]
test eax, eax
je 0x4cb754
cmp dword [edi + 4], eax
jae 0x4cb794
call fcn.004cb590
mov esi, eax
test esi, esi
je 0x4cb7f9
push 0
push 0x50a060
push 0
call dword [sym.imp.KERNEL32.dll_CreateFiber]
mov dword [esi], eax
test eax, eax
jne 0x4cb7f6
push dword [esi + 0xc]
call fcn.0062f047
add esp, 4
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFiber]
push esi
call fcn.0062f047
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, 0x65
mov dword [esi], 0
push 0x154
push str.C:mediagetdependencies_installeropenssl1_1_win_build_1.1.1qcrypto_async_async.c
push 0x41
lea ecx, [edx - 0x32]
call fcn.004818c0
add esp, 0xc
push esi
call fcn.0062f047
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, 0x65
push 0x14e
push str.C:mediagetdependencies_installeropenssl1_1_win_build_1.1.1qcrypto_async_async.c
push 0x41
lea ecx, [edx - 0x32]
call fcn.004818c0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
inc dword [edi + 4]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4cb810
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [0x717140]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebx + 0xc]
call fcn.0062f047
mov dword [ebx + 0xc], 0
add esp, 4
mov ecx, dword [edi]
test ecx, ecx
je 0x4cb856
push dword [ecx]
mov edx, ebx
call fcn.00471ea0
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x4cbbe0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push edi
call ebx
push dword [0x717140]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
je 0x4cbc3b
mov ecx, edi
call fcn.004cbb90
mov esi, dword [edi]
test esi, esi
je 0x4cbc24
push dword [esi + 4]
call fcn.0062f047
push esi
call fcn.0062f047
add esp, 8
push edi
call fcn.0062f047
add esp, 4
push 0
push dword [0x717140]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call ebx
push dword [0x71713c]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
je 0x4cbc6f
cmp dword [edi], 0
je 0x4cbc6f
cmp dword [edi + 4], 0
je 0x4cbc6f
call dword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
mov dword [edi], 0
call ebx
push dword [0x71713c]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
push dword [0x71713c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x4cbca3
push edi
call fcn.0062f047
add esp, 4
pop edi
pop esi
pop ebx
ret

Function at 0x4cbcb0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
push edi
push 0
push 0x100
xor ecx, ecx
call fcn.00493940
add esp, 8
test eax, eax
je 0x4cbcf7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [0x71713c]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
je 0x4cbcf7
mov eax, dword [edi + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x538ad0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xc
call fcn.00628570
push ebx
push esi
mov dword [ebp - 8], ecx
mov ebx, edx
mov ecx, dword [ebp + 0xc]
push edi
xor edi, edi
call fcn.004a0870
mov ecx, dword [ebp + 0xc]
call fcn.004a09e0
mov esi, eax
test esi, esi
je 0x538ce6
mov edx, dword [ebx + 4]
add edx, edx
cmp edx, dword [esi + 8]
jle 0x538b1a
mov ecx, esi
call fcn.004749e0
test eax, eax
je 0x538ce6
mov eax, dword [ebx + 4]
lea ecx, [eax - 1]
test ecx, ecx
js 0x538c9e
mov edi, ecx
nop word [eax + eax]
mov eax, dword [ebx]
mov edx, dword [eax + edi*4]
mov ecx, edx
shr ecx, 1
mov eax, edx
and eax, 0x20000
and ecx, 0x8000
or ecx, eax
mov eax, edx
and eax, 0x40000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x80000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x100000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x200000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x400000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x800000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x1000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x2000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x4000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x8000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x10000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x20000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x40000000
shr ecx, 1
or ecx, eax
and edx, reloc.WS2_32.dll_accept
mov eax, dword [esi]
shr ecx, 1
or ecx, edx
shr ecx, 1
mov dword [eax + edi*8 + 4], ecx
mov eax, dword [ebx]
mov ecx, dword [eax + edi*4]
mov edx, ecx
and edx, 0x8000
mov eax, ecx
add edx, edx
and eax, 0x4000
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x2000
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x1000
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x800
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x400
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x200
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x100
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x80
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x40
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x20
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x10
or edx, eax
mov eax, ecx
add edx, edx
and eax, 8
or edx, eax
mov eax, ecx
add edx, edx
and eax, 4
or edx, eax
mov eax, ecx
add edx, edx
and eax, 2
or edx, eax
and ecx, 1
mov eax, dword [esi]
add edx, edx
or edx, ecx
mov dword [eax + edi*8], edx
sub edi, 1
jns 0x538b30
mov eax, dword [ebx + 4]
xor edi, edi
add eax, eax
mov dword [esi + 4], eax
test eax, eax
jle 0x538cc3
mov ecx, dword [esi]
lea ecx, [ecx + eax*4]
nop dword [eax]
cmp dword [ecx - 4], 0
lea ecx, [ecx - 4]
jne 0x538cbe
dec eax
test eax, eax
jg 0x538cb0
mov dword [esi + 4], eax
test eax, eax
jne 0x538ccc
mov dword [esi + 0xc], 0
push dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov edx, esi
call fcn.005384f0
add esp, 4
mov ecx, 1
test eax, eax
cmovne edi, ecx
mov ecx, dword [ebp + 0xc]
call fcn.004a0970
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5a42be
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x20], 0
je 0x5a42d9
push 2
push dword [esi + 0x88]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov byte [esi + 0x20], 0
pop esi
ret

Function at 0x5a4ee5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 8
mov eax, 0x653599
call fcn.0062848a
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x14]
mov dword [ebp - 4], ebx
push eax
push dword [ebp + 8]
call fcn.005b9975
pop ecx
pop ecx
push 0x65c9d0
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x5a4f4a
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push ebx
mov dword [edi + 8], eax
mov dword [edi + 0xc], ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x5a4f4a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
mov dword [edi + 0x10], eax
setne bl
cmp dword [ebp - 0x14], 0
je 0x5a4f59
push dword [ebp - 0x14]
call fcn.0062f047
pop ecx
mov al, bl
call fcn.00628458
ret 4

Function at 0x5a54a6
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
mov esi, ecx
push eax
xor eax, eax
push eax
push esi
push 0x5a2784
push eax
push eax
mov byte [esi + 0x20], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x88], eax
pop esi
leave
ret
Function at 0x5a5a6b
Capabilities:
Create pipe

Disassembly:
push 0x3c
mov eax, 0x65373c
call fcn.006284bd
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
cmp dword [esi + 4], 0xffffffff
mov dword [ebp - 4], ebx
jne 0x5a5b11
call fcn.005b954b
push eax
lea eax, [ebp - 0x28]
push str..pipe_
push eax
call fcn.005a0eb7
push str._admin_proxy_pipe_in
push eax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
call fcn.005a0e4e
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
push ecx
push eax
call fcn.005b9975
add esp, 0x20
lea ecx, [ebp - 0x40]
call fcn.00449330
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.00449330
push ebx
push ebx
push ebx
push ebx
push 0xff
push ebx
push 2
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
jne 0x5a5b11
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.005b9a5f
pop ecx
pop ecx
mov byte [ebp - 4], 3
jmp 0x5a5b99
cmp dword [esi + 8], 0xffffffff
jne 0x5a5ba8
call fcn.005b954b
push eax
lea eax, [ebp - 0x40]
push str..pipe_
push eax
call fcn.005a0eb7
push str._admin_proxy_pipe_out
push eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 4
push eax
call fcn.005a0e4e
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 5
push ecx
push eax
call fcn.005b9975
add esp, 0x20
lea ecx, [ebp - 0x28]
call fcn.00449330
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], bl
call fcn.00449330
push ebx
push ebx
push ebx
push ebx
push 0xff
push ebx
push 1
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov dword [esi + 8], eax
cmp eax, 0xffffffff
jne 0x5a5ba8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.005b9a5f
pop ecx
pop ecx
mov byte [ebp - 4], 6
call fcn.005b1635
lea ecx, [ebp - 0x28]
call fcn.00449330
jmp 0x5a5baa
mov bl, 1
cmp dword [ebp - 0x48], 0
je 0x5a5bb9
push dword [ebp - 0x48]
call fcn.0062f047
pop ecx
mov al, bl
call fcn.0062846c
ret
Function at 0x5a5c69
Capabilities:
Connect pipe
Create process on windows
Create thread

Disassembly:
push 0x5c
mov eax, 0x6537bc
call fcn.006284bd
mov esi, ecx
cmp byte [esi], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x64], eax
je 0x5a5c9f
mov edi, str.AdministrativeProxy_is_already_running
push edi
call fcn.0062f100
pop ecx
push eax
push edi
lea ecx, [esi + 0x10]
call fcn.00448f70
mov al, 1
jmp 0x5a5e1a
cmp byte [esi + 0xc], 0
je 0x5a5cac
xor al, al
jmp 0x5a5e1a
lea edi, [esi + 0x10]
call fcn.005a5a6b
test al, al
jne 0x5a5ccf
mov esi, str.unable_to_listen_on_admin_proxy_pipes
push esi
call fcn.0062f100
pop ecx
push eax
push esi
mov ecx, edi
call fcn.00448f70
jmp 0x5a5ca5
xor ebx, ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
lea eax, [ebp - 0x60]
mov dword [ebp - 4], ebx
push eax
push dword [ebp - 0x64]
call fcn.005b9975
pop ecx
pop ecx
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
push ebx
push ebx
push ebx
push dword [ebp - 0x60]
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jge 0x5a5d44
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.005b8fb1
push eax
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 1
push str.ShellExecute_for_admin_proxy_failed__
push eax
call fcn.005a0e81
add esp, 0x14
mov ecx, edi
push eax
call fcn.005a1f05
lea ecx, [ebp - 0x58]
call fcn.00449330
lea ecx, [ebp - 0x28]
call fcn.00449330
mov byte [esi + 0xc], 1
jmp 0x5a5e09
push ebx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x5a5d8d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.005b9a5f
push eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push str.ConnectNamedPipe_for_admin_proxy_failed__
push eax
call fcn.005a0e81
add esp, 0x14
mov ecx, edi
push eax
call fcn.005a1f05
lea ecx, [ebp - 0x28]
call fcn.00449330
lea ecx, [ebp - 0x58]
jmp 0x5a5e04
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push eax
mov dword [esi + 0x40], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp - 0x68]
push eax
push ebx
push esi
push 0x5a5851
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x40]
mov ecx, esi
push eax
call fcn.005a5bc1
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x28]
push str.got_adminStatus_from_admin_proxy__
push eax
call fcn.005a0eb7
add esp, 0xc
mov ecx, edi
push eax
call fcn.005a1f05
lea ecx, [ebp - 0x28]
call fcn.00449330
push str.STATUS:ADMIN
lea ecx, [ebp - 0x40]
call fcn.005a58fd
mov byte [esi], al
lea ecx, [ebp - 0x40]
mov bl, al
call fcn.00449330
cmp dword [ebp - 0x60], 0
je 0x5a5e18
push dword [ebp - 0x60]
call fcn.0062f047
pop ecx
mov al, bl
call fcn.0062846c
ret 4
Function at 0x5a6059
Capabilities:
Write file on windows

Disassembly:
push 0xc
mov eax, 0x653860
call fcn.0062848a
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x18]
mov dword [ebp - 4], ebx
push eax
push dword [ebp + 8]
call fcn.005b9975
pop ecx
pop ecx
push ebx
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp - 0x14]
add eax, eax
push eax
push dword [ebp - 0x18]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
lea eax, [ebp + 8]
mov dword [ebp - 0x10], 0x1234
push eax
push 2
lea eax, [ebp - 0x10]
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 0x18], ebx
je 0x5a60c0
push dword [ebp - 0x18]
call fcn.0062f047
pop ecx
call fcn.00628458
ret 4
Function at 0x5af1ea
Capabilities:
Get common file path

Disassembly:
push 0x3c
mov eax, 0x654d58
call fcn.006284bd
push 0x208
push 0
mov dword [ebp - 0x44], 0x104
call fcn.0062f062
pop ecx
mov esi, eax
pop ecx
mov dword [ebp - 0x48], esi
and dword [ebp - 4], 0
push 0
push 0x23
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x5af270
lea eax, [ebp - 0x40]
push esi
push eax
call fcn.005ba695
push str..exe
push eax
xor ebx, ebx
lea eax, [ebp - 0x28]
inc ebx
push eax
mov byte [ebp - 4], bl
call fcn.005a0e4e
add esp, 0x14
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 3
call fcn.00449330
lea eax, [ebp - 0x28]
push eax
call fcn.005b6ed9
pop ecx
lea ecx, [ebp - 0x28]
test al, al
je 0x5af26b
call fcn.00449330
jmp 0x5af272
call fcn.00449330
xor bl, bl
test esi, esi
je 0x5af27d
push esi
call fcn.0062f047
pop ecx
mov al, bl
call fcn.0062846c
ret