joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52b264
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
test dl, dl
je 0x52b27c
add esp, 0xfffffff0
call fcn.004059d8
mov byte [ebp - 9], dl
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x52b396
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 8]
mov dword [eax + 8], ebx
mov eax, ebx
add eax, eax
add eax, eax
add eax, eax
call fcn.004042c4
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
dec ebx
test ebx, ebx
jl 0x52b380
inc ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
call fcn.00525f5c
xor eax, eax
push ebp
push 0x52b36d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
call fcn.00525f5c
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x10]
lea ebx, [eax + edx*8]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov eax, dword [eax + 8]
mov dword [ebx], eax
lea eax, [ebx + 4]
mov edx, dword [ebp - 4]
call fcn.004077e0
jmp 0x52b33e
lea eax, [ebx + 4]
mov ecx, 1
mov edx, 1
call fcn.00407e28
mov eax, dword [ebx + 4]
call fcn.004078e8
dec eax
jle 0x52b352
mov eax, dword [ebx + 4]
cmp word [eax], 0x5f
je 0x52b32c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52b374
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x54]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52b39d
lea eax, [ebp - 4]
call fcn.004070a0
ret
Function at 0x52fb50
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd9c
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x264], eax
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x25c], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x52fc81
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
lea edx, [ebp - 0x25c]
mov eax, 0x52fc9c
call fcn.0041d4d8
mov edx, dword [ebp - 0x25c]
lea eax, [ebp - 8]
mov ecx, 0x52fcc0
call fcn.00407a4c
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x260]
mov ecx, 0x52fcdc
mov edx, dword [ebp - 8]
call fcn.00407a4c
mov eax, dword [ebp - 0x260]
call fcn.0040760c
push eax
call sub.KERNEL32.DLL_FindFirstFileW
mov esi, eax
cmp esi, 0xffffffff
je 0x52fc50
jmp 0x52fc4c
cmp word [ebp - 0x22c], 0x2e
je 0x52fc39
test byte [ebp - 0x258], 0x10
jne 0x52fc39
lea eax, [ebp - 4]
lea edx, [ebp - 0x22c]
mov ecx, 0x104
call fcn.00407778
mov edx, dword [ebp - 4]
mov eax, 0x52fcf0
call fcn.00530e54
test eax, eax
jne 0x52fc39
push dword [ebp - 8]
push 0x52fd08
push dword [ebp - 4]
lea eax, [ebp - 0x264]
mov edx, 3
call fcn.00407b30
mov eax, dword [ebp - 0x264]
call fcn.00532f24
lea eax, [ebp - 0x258]
push eax
push esi
call sub.KERNEL32.DLL_FindNextFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x52fbdc
push esi
call sub.KERNEL32.DLL_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52fc88
lea eax, [ebp - 0x264]
mov edx, 3
call fcn.00407578
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407578
ret

Function at 0x52fff0
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407568
xor eax, eax
push ebp
push 0x530055
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040760c
mov esi, eax
push esi
call sub.KERNEL32.DLL_GetFileAttributesW
mov edi, eax
test bl, bl
je 0x53002d
or edi, 1
jmp 0x530038
test edi, 1
je 0x530038
xor edi, 1
push edi
push esi
call sub.KERNEL32.DLL_SetFileAttributesW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53005c
lea eax, [ebp - 4]
call fcn.00407570
ret

Function at 0x530064
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407568
xor eax, eax
push ebp
push 0x5300c9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040760c
mov esi, eax
push esi
call sub.KERNEL32.DLL_GetFileAttributesW
mov edi, eax
test bl, bl
je 0x5300a1
or edi, 2
jmp 0x5300ac
test edi, 2
je 0x5300ac
xor edi, 2
push edi
push esi
call sub.KERNEL32.DLL_SetFileAttributesW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5300d0
lea eax, [ebp - 4]
call fcn.00407570
ret
Function at 0x5301bc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407568
xor eax, eax
push ebp
push 0x530297
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040760c
push eax
call sub.KERNEL32.DLL_DeleteFileW
xor eax, eax
push ebp
push 0x530264
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, 0x10
mov eax, dword [ebp - 4]
call fcn.004154cc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x530222
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x530281
xor eax, eax
push ebp
push 0x530253
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, ebx
mov ecx, esi
mov eax, dword [ebp - 8]
call fcn.0041553c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53025a
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53029e
lea eax, [ebp - 4]
call fcn.00407570
ret

Function at 0x5302a8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407568
xor eax, eax
push ebp
push 0x530370
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0041407c
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.004075d4
mov eax, dword [ebp - 4]
movzx esi, word [eax]
mov eax, dword [ebp - 4]
call fcn.0040760c
push eax
call sub.KERNEL32.DLL_GetDriveTypeW
mov ebx, eax
push 1
call sub.KERNEL32.DLL_SetErrorMode
mov word [ebp - 8], ax
xor eax, eax
push ebp
push 0x53034b
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 2
jne 0x530333
mov eax, esi
sub al, 0x40
call fcn.00415f4c
cmp edx, 0xffffffff
jne 0x530333
cmp eax, 0xffffffff
jne 0x530333
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x530352
movzx eax, word [ebp - 8]
push eax
call sub.KERNEL32.DLL_SetErrorMode
ret

Function at 0x530434
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407568
xor eax, eax
push ebp
push 0x53047c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040760c
push eax
call sub.KERNEL32.DLL_GetDriveTypeW
cmp eax, 2
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x530483
lea eax, [ebp - 4]
call fcn.00407570
ret

Function at 0x5304c4
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffe08
mov ebx, eax
push 0xfa
lea eax, [esp + 4]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryW
mov edx, ebx
mov eax, esp
call fcn.0041640c
add esp, 0x1f8
pop ebx
ret

Function at 0x5304f0
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, eax
push esp
push 0xff
call sub.KERNEL32.DLL_GetTempPathW
mov edx, ebx
mov eax, esp
call fcn.0041640c
add esp, 0x200
pop ebx
ret
Function at 0x53061c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, eax
mov dword [ebp - 8], 0x10
mov eax, ebx
xor edx, edx
call fcn.00407580
mov eax, dword [ebp - 8]
add eax, eax
call fcn.004042dc
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x530681
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetComputerNameW
test eax, eax
je 0x53066b
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040773c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x530688
mov eax, dword [ebp - 4]
call fcn.004042f8
ret

Function at 0x530a50
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd44
push ebx
push esi
push edi
mov byte [ebp - 5], cl
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407568
xor eax, eax
push ebp
push 0x530adc
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
test bl, bl
jne 0x530a87
mov edi, 0x10
jmp 0x530a92
cmp dword [ebp - 4], 0
jne 0x530a92
mov edi, 0x20
cmp byte [ebp - 5], 0
je 0x530a9f
mov esi, 0x110
jmp 0x530aa4
mov esi, 0x111
push esi
push 0x2b4
lea eax, [ebp - 0x2b9]
push eax
push edi
mov eax, dword [ebp - 4]
call fcn.0040760c
push eax
call sub.shell32.dll_SHGetFileInfoW
mov ebx, dword [ebp - 0x2b5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x530ae3
lea eax, [ebp - 4]
call fcn.00407570
ret

Function at 0x530aec
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd44
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407568
xor eax, eax
push ebp
push 0x530b7d
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x530b23
mov edi, 0x10
jmp 0x530b25
xor edi, edi
test bl, bl
je 0x530b30
mov esi, 0x110
jmp 0x530b35
mov esi, 0x111
push esi
push 0x2b4
lea eax, [ebp - 0x2bc]
push eax
push edi
mov eax, dword [ebp - 4]
call fcn.0040760c
push eax
call sub.shell32.dll_SHGetFileInfoW
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x2bc]
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x2b8]
mov dword [eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x530b84
lea eax, [ebp - 4]
call fcn.00407570
ret
Function at 0x530eec
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe04
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x531033
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x531040
push 0
push esi
call sub.user32.dll_FindWindowExW
push 0
push 0x531050
push 0
push eax
call sub.user32.dll_FindWindowExW
push 0
push 0x53106c
push 0
push eax
call sub.user32.dll_FindWindowExW
push 0
push 0x531088
push 0
push eax
call sub.user32.dll_FindWindowExW
push 0
push 0x53109c
push 0
push eax
call sub.user32.dll_FindWindowExW
lea edx, [ebp - 0x1fa]
push edx
push 0xfa
push 0xd
push eax
call sub.user32.dll_SendMessageW
mov eax, ebx
lea edx, [ebp - 0x1fa]
mov ecx, 0xfb
call fcn.00407778
call fcn.0053418c
test al, al
je 0x53101d
push 0
push 0x5310a8
push 0
push esi
call sub.user32.dll_FindWindowExW
push 0
push 0x531050
push 0
push eax
call sub.user32.dll_FindWindowExW
push 0
push 0x5310b8
push 0
push eax
call sub.user32.dll_FindWindowExW
push 0
push 0x5310dc
push 0
push eax
call sub.user32.dll_FindWindowExW
push 0
push 0x531100
push 0
push eax
call sub.user32.dll_FindWindowExW
push 0
push 0x531124
push 0
push eax
call sub.user32.dll_FindWindowExW
lea edx, [ebp - 0x1fa]
push edx
push 0xfa
push 0xd
push eax
call sub.user32.dll_SendMessageW
lea eax, [ebp - 4]
lea edx, [ebp - 0x1fa]
mov ecx, 0xfb
call fcn.00407778
push ebx
mov cl, 1
mov edx, 0x531150
mov eax, dword [ebp - 4]
call fcn.0052f97c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53103a
lea eax, [ebp - 4]
call fcn.00407570
ret

Function at 0x531908
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407568
xor eax, eax
push ebp
push 0x5319be
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
je 0x531966
push 0
push 1
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 4]
mov edx, 0x5319d8
call fcn.00407a4c
mov eax, dword [ebp - 0xc]
call fcn.0040760c
mov edx, eax
lea eax, [ebp - 8]
call fcn.0040773c
mov eax, dword [ebp - 8]
xor ecx, ecx
xor edx, edx
call fcn.00532540
jmp 0x531996
push 1
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.004077bc
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 0x531a08
call fcn.00406c10
mov eax, dword [ebp - 0x10]
call fcn.00406e28
push eax
call sub.KERNEL32.DLL_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5319c5
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004067b0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00407578
ret
Function at 0x531a14
Capabilities:
Connect network resource

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov ebx, ecx
mov byte [ebp - 9], dl
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00407568
xor eax, eax
push ebp
push 0x531c04
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x524758]
call fcn.00405474
mov edi, eax
test bl, bl
jne 0x531a69
lea ecx, [ebp - 8]
mov dl, 1
mov eax, edi
call fcn.00524b84
cmp byte [ebp + 0x10], 0
je 0x531a78
cmp dword [esi], 0
jne 0x531b09
mov eax, esi
mov edx, 0x531c24
call fcn.00407580
jmp 0x531aa3
lea eax, [ebp - 0x10]
mov edx, dword [esi]
movzx edx, word [edx]
dec edx
call fcn.004076fc
mov edx, dword [ebp - 0x10]
mov eax, esi
mov ecx, 0x531c38
call fcn.00407a4c
mov eax, dword [esi]
call fcn.005302a8
test al, al
jne 0x531a86
mov eax, dword [esi]
call fcn.005303dc
test al, al
jne 0x531a86
mov eax, dword [esi]
call fcn.0051e824
test al, al
je 0x531ad2
mov eax, dword [esi]
mov edx, dword [ebp - 4]
call fcn.00531874
test al, al
je 0x531a86
test bl, bl
jne 0x531af2
lea eax, [ebp - 0x14]
mov edx, dword [esi]
movzx edx, word [edx]
call fcn.004076fc
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.004080c8
test eax, eax
jne 0x531a86
mov eax, dword [esi]
movzx eax, word [eax]
cmp ax, 0x42
jae 0x531b09
mov eax, esi
mov edx, 0x531c48
call fcn.00407580
cmp byte [ebp + 0xc], 0
je 0x531b2b
lea eax, [ebp - 0x18]
mov edx, dword [esi]
movzx edx, word [edx]
call fcn.004076fc
mov edx, dword [ebp - 0x18]
mov ecx, 8
mov eax, edi
call fcn.00525154
mov eax, edi
call fcn.004054a4
mov eax, dword [ebp - 4]
test eax, eax
je 0x531b4f
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x531b4f
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.0040693c
cmp word [eax], 0x5c
jne 0x531b72
mov eax, dword [esi]
call fcn.0040760c
push eax
push 0x531c50
mov eax, dword [ebp - 4]
call fcn.0040760c
push eax
call sub.mpr.dll_WNetAddConnectionW
jmp 0x531bd3
cmp byte [ebp - 9], 0
je 0x531bab
push 0
push 1
push 0x531c60
push dword [esi]
push 0x531c90
push dword [ebp - 4]
push 0x531ca4
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00407b30
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
xor edx, edx
call fcn.00532540
jmp 0x531bd3
lea eax, [ebp - 0x20]
mov ecx, dword [ebp - 4]
mov edx, 0x531cb4
call fcn.00407a4c
mov eax, dword [ebp - 0x20]
call fcn.0040760c
push eax
mov eax, dword [esi]
call fcn.0040760c
push eax
push 1
call sub.KERNEL32.DLL_DefineDosDeviceW
mov eax, dword [esi]
call fcn.0051e824
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x531c0b
lea eax, [ebp - 0x20]
mov edx, 5
call fcn.00407578
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407578
ret
Function at 0x531cc0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407568
xor eax, eax
push ebp
push 0x531da1
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 4]
test eax, eax
je 0x531d02
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x531d02
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.0040693c
test eax, eax
je 0x531d0b
sub eax, 4
mov eax, dword [eax]
cmp eax, 2
jne 0x531d7b
push 0
push 0x531dbc
push dword [ebp - 4]
push 0x531dec
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00407b30
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov ecx, 0
call fcn.004077bc
mov eax, dword [ebp - 8]
call fcn.00406e28
push eax
call sub.KERNEL32.DLL_WinExec
push 0
mov eax, dword [ebp - 4]
call fcn.0040760c
push eax
push 2
call sub.KERNEL32.DLL_DefineDosDeviceW
push 0xffffffffffffffff
push 1
mov eax, dword [ebp - 4]
call fcn.0040760c
push eax
call sub.mpr.dll_WNetCancelConnection2W
mov eax, dword [ebp - 4]
call fcn.0051e824
mov ebx, eax
xor bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x531da8
lea eax, [ebp - 0xc]
call fcn.00407570
lea eax, [ebp - 8]
call fcn.0040678c
lea eax, [ebp - 4]
call fcn.00407570
ret

Function at 0x532214
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407568
xor eax, eax
push ebp
push 0x5322a5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x532280
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00415a7c
mov eax, dword [ebp - 8]
call fcn.0040760c
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.0040760c
push eax
push 0x5322b4
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x53228a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5322ac
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407578
ret
Function at 0x532540
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff90
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 8], ebx
mov ebx, ecx
mov byte [ebp - 9], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407568
mov eax, dword [ebp + 0xc]
call fcn.00407568
xor eax, eax
push ebp
push 0x53271f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.00404cb4
lea eax, [ebp - 0x6c]
xor ecx, ecx
mov edx, 0x44
call fcn.00404cb4
mov dword [ebp - 0x6c], 0x44
mov dword [ebp - 0x40], 1
mov word [ebp - 0x3a], 0
xor eax, eax
mov dword [ebp - 0x38], eax
test bl, bl
je 0x5325ba
mov word [ebp - 0x3c], 1
jmp 0x5325c0
mov word [ebp - 0x3c], 0
cmp dword [ebp + 0xc], 0
je 0x5325e7
mov eax, dword [ebp + 0xc]
call fcn.0040760c
mov edi, eax
lea eax, [ebp - 0x70]
mov edx, dword [ebp + 0xc]
call fcn.004077f4
mov eax, dword [ebp - 0x70]
call fcn.00407290
mov esi, eax
jmp 0x5325eb
xor edi, edi
xor esi, esi
xor eax, eax
mov dword [ebp - 0x14], eax
xor ebx, ebx
call fcn.0053418c
test al, al
je 0x53269d
cmp byte [ebp - 9], 0
jne 0x532620
lea eax, [ebp - 0x14]
push eax
push 0x2000000
mov eax, 0x532740
call fcn.00532464
push eax
call sub.advapi32.dll_OpenProcessToken
jmp 0x532634
lea eax, [ebp - 0x14]
push eax
push 0x2000000
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
lea eax, [ebp - 0x18]
push eax
push 1
push 2
push 0
push 0x2000000
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_DuplicateTokenEx
test eax, eax
je 0x5326f1
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004077f4
mov eax, dword [ebp - 8]
call fcn.00407290
mov edi, eax
push edi
push 0
push 0
push esi
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x28]
push eax
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x18]
call fcn.0052f360
test eax, eax
jne 0x532689
mov bl, 1
mov eax, dword [ebp - 0x18]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.DLL_CloseHandle
jmp 0x5326c9
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x6c]
push eax
push edi
push 0
push 0x4000000
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040760c
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessW
test eax, eax
jne 0x5326c9
mov bl, 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
cmp byte [ebp + 8], 0
je 0x5326f1
test bl, bl
jne 0x5326f1
push 0xffffffffffffffff
mov eax, dword [ebp - 0x28]
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x28]
push eax
call sub.KERNEL32.DLL_GetExitCodeProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x532726
lea eax, [ebp - 0x70]
call fcn.004070a0
lea eax, [ebp - 8]
call fcn.004070a0
lea eax, [ebp - 4]
call fcn.00407570
lea eax, [ebp + 0xc]
call fcn.00407570
ret
Function at 0x53275c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff90
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 8], ebx
mov ebx, ecx
mov byte [ebp - 9], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407568
mov eax, dword [ebp + 0xc]
call fcn.00407568
xor eax, eax
push ebp
push 0x532928
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.00404cb4
lea eax, [ebp - 0x6c]
xor ecx, ecx
mov edx, 0x44
call fcn.00404cb4
mov dword [ebp - 0x6c], 0x44
mov dword [ebp - 0x40], 1
mov word [ebp - 0x3a], 0
xor eax, eax
mov dword [ebp - 0x38], eax
test bl, bl
je 0x5327d6
mov word [ebp - 0x3c], 1
jmp 0x5327dc
mov word [ebp - 0x3c], 0
cmp dword [ebp + 0xc], 0
je 0x532803
mov eax, dword [ebp + 0xc]
call fcn.0040760c
mov edi, eax
lea eax, [ebp - 0x70]
mov edx, dword [ebp + 0xc]
call fcn.004077f4
mov eax, dword [ebp - 0x70]
call fcn.00407290
mov esi, eax
jmp 0x532807
xor edi, edi
xor esi, esi
xor eax, eax
mov dword [ebp - 0x14], eax
xor ebx, ebx
call fcn.0053418c
test al, al
je 0x5328a6
lea eax, [ebp - 0x14]
push eax
push 0x2000000
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
lea eax, [ebp - 0x18]
push eax
push 1
push 2
push 0
push 0x2000000
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_DuplicateTokenEx
test eax, eax
je 0x5328fa
cmp byte [ebp - 9], 0
jne 0x53285d
lea eax, [ebp - 0x18]
call fcn.00532320
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004077f4
mov eax, dword [ebp - 8]
call fcn.00407290
mov edi, eax
push edi
push 0
push 0
push esi
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x28]
push eax
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x18]
call fcn.0052f360
test eax, eax
jne 0x532892
mov bl, 1
mov eax, dword [ebp - 0x18]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.DLL_CloseHandle
jmp 0x5328d2
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x6c]
push eax
push edi
push 0
push 0x4000000
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040760c
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessW
test eax, eax
jne 0x5328d2
mov bl, 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
cmp byte [ebp + 8], 0
je 0x5328fa
test bl, bl
jne 0x5328fa
push 0xffffffffffffffff
mov eax, dword [ebp - 0x28]
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x28]
push eax
call sub.KERNEL32.DLL_GetExitCodeProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53292f
lea eax, [ebp - 0x70]
call fcn.004070a0
lea eax, [ebp - 8]
call fcn.004070a0
lea eax, [ebp - 4]
call fcn.00407570
lea eax, [ebp + 0xc]
call fcn.00407570
ret