joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1041f0d
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push 0x10
mov eax, 0x105e88a
call fcn.0104dc9c
xor edi, edi
push 0x1066af4
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], edi
call fcn.010442ec
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov esi, dword [ecx - 0xc]
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.01030ac4
cmp esi, 8
jb 0x1041f6d
push 8
push 0x1010540
push dword [ebp - 0x14]
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x1041f6d
push edi
lea ecx, [ebp - 0x14]
call fcn.0103033f
add eax, 0x10
jmp 0x1041fa0
cmp esi, 4
jb 0x1041f97
push 4
push 0x1010534
push dword [ebp - 0x14]
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x1041f97
push edi
lea ecx, [ebp - 0x14]
call fcn.0103033f
add eax, 8
jmp 0x1041fa0
push edi
lea ecx, [ebp - 0x14]
call fcn.0103033f
mov ebx, dword [sym.imp.msvcrt.dll_wcschr]
push 0x5c
push eax
call ebx
pop ecx
pop ecx
cmp eax, edi
jne 0x1041fe3
mov esi, dword [ebp - 0x14]
push esi
push 0x1010508
mov eax, 0x800700a1
push 0x10104f8
push eax
mov dword [ebp - 0x18], eax
call fcn.01048c52
lea ecx, [esi - 0x10]
add esp, 0x10
call fcn.0102fb3e
mov eax, dword [ebp - 0x18]
call fcn.0104dd50
ret 8
push dword [ebp - 0x14]
lea esi, [eax + 2]
movzx edi, word [esi]
xor eax, eax
mov word [esi], ax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1042015
test al, 0x10
jne 0x1042067
mov esi, dword [ebp - 0x14]
push esi
push 0x10104bc
mov eax, 0x800700b7
push 0x10104ac
jmp 0x1041fc4
push dword [ebp + 0xc]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1042067
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jle 0x104203b
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x18], eax
test eax, eax
jl 0x1042049
mov dword [ebp - 0x18], 0x80004005
mov edi, dword [ebp - 0x14]
push edi
push 0x10104bc
push 0x101049c
call esi
push eax
call fcn.01048d15
lea ecx, [edi - 0x10]
jmp 0x1041fd0
push 0x5c
push esi
mov word [esi], di
call ebx
pop ecx
pop ecx
test eax, eax
jne 0x1041fe3
mov eax, dword [ebp + 8]
push dword [eax]
push 0x1002428
push 0x1010488
push 0x4000000
call fcn.01048e9b
mov ecx, dword [ebp - 0x14]
add esp, 0x10
add ecx, 0xfffffff0
jmp 0x1041fd3
Function at 0x1042765
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x1c
mov eax, 0x105e965
call fcn.0104dc9c
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
xor esi, esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x24], ebx
mov ecx, dword [ebp + 0x14]
mov byte [ebp - 4], 1
call fcn.01030104
test byte [ebp + 0x18], 1
je 0x104279e
mov esi, 0x100
cmp dword [ebp + 0xc], ebx
je 0x10427fc
lea eax, [ebp - 0x18]
push eax
or esi, 0x20019
push esi
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
je 0x1042802
jg 0x10427c6
mov dword [ebp - 0x14], eax
jmp 0x10427d7
mov ecx, eax
and ecx, 0xffff
or ecx, 0x80070000
mov dword [ebp - 0x14], ecx
push dword [ebp + 0xc]
push 0x1010ab8
push 0x1010a98
push eax
call fcn.01048dd8
add esp, 0x10
push ebx
mov byte [ebp - 4], bl
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
jmp 0x104291c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x1c]
push eax
push ebx
lea eax, [ebp - 0x20]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp - 0x18]
call edi
cmp eax, ebx
je 0x1042845
jg 0x1042825
mov dword [ebp - 0x14], eax
jmp 0x1042836
mov ecx, eax
and ecx, 0xffff
or ecx, 0x80070000
mov dword [ebp - 0x14], ecx
push dword [ebp + 0x10]
push 0x1010a50
push 0x1010a34
jmp 0x10427e4
cmp dword [ebp - 0x20], 1
je 0x1042868
push 0x10109f0
mov eax, 0x8007000d
push 0x10109d4
push eax
mov dword [ebp - 0x14], eax
call fcn.01048c52
add esp, 0xc
jmp 0x10427ed
mov eax, dword [ebp - 0x1c]
add eax, 2
push eax
lea ecx, [ebp - 0x24]
call fcn.01041a8e
mov esi, dword [ebp - 0x24]
cmp esi, ebx
jne 0x104288f
push 0x1010880
mov eax, 0x8007000e
push 0x10109b8
jmp 0x104285a
mov eax, dword [ebp - 0x1c]
mov byte [esi + eax], bl
mov eax, dword [ebp - 0x1c]
mov byte [esi + eax - 1], bl
lea eax, [ebp - 0x1c]
push eax
push esi
lea eax, [ebp - 0x20]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp - 0x18]
call edi
cmp eax, ebx
je 0x10428e6
jg 0x10428b9
mov dword [ebp - 0x14], eax
jmp 0x10428ca
mov ecx, eax
and ecx, 0xffff
or ecx, 0x80070000
mov dword [ebp - 0x14], ecx
push dword [ebp + 0x10]
push 0x1010a50
push 0x101099c
push eax
call fcn.01048dd8
add esp, 0x10
push esi
jmp 0x10427ee
mov ecx, dword [ebp + 0x14]
push esi
call fcn.01031359
jmp 0x10428e0
cmp dword [ebp + 0xc], ebx
je 0x104292f
cmp dword [ebp - 0x18], ebx
je 0x104292f
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x14]
call fcn.0104dd50
ret 0x14
Function at 0x1042a46
Capabilities:
Get user security identifier

Disassembly:
push 0x18
mov eax, 0x105e9ad
call fcn.0104dc9c
mov esi, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x100
mov dword [ebp - 0x1c], 0x20
mov dword [ebp - 4], ebx
cmp esi, ebx
jne 0x1042a8e
push 0x1010df4
mov eax, 0x80070057
push 0x1010de0
push eax
mov ebx, eax
call fcn.01048c52
add esp, 0xc
jmp 0x1042c02
push dword [ebp - 0x18]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call edi
mov dword [esi], eax
test eax, eax
jne 0x1042ab8
push 0x1010d98
mov eax, 0x8007000e
push 0x1010d84
jmp 0x1042a7e
mov eax, dword [ebp - 0x1c]
add eax, eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call edi
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x1042aef
push 0x1010d20
push 0x1010d08
mov eax, 0x8007000e
push eax
mov ebx, eax
call fcn.01048c52
add esp, 0xc
jmp 0x1042be6
mov edi, dword [sym.imp.KERNEL32.dll_HeapReAlloc]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push eax
push dword [esi]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x1042be4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1042b7b
push dword [ebp - 0x18]
push dword [esi]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call edi
mov dword [ebx], eax
test eax, eax
jne 0x1042b47
push 0x1010d98
push 0x1010cf4
jmp 0x1042ada
and dword [ebx], 0
mov dword [esi], eax
mov eax, dword [ebp - 0x1c]
add eax, eax
push eax
push dword [ebp - 0x14]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call edi
test eax, eax
jne 0x1042b73
push 0x1010d20
push 0x1010ce0
jmp 0x1042ada
mov dword [ebp - 0x14], eax
jmp 0x1042af5
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
jle 0x1042b91
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
jl 0x1042b9c
mov ebx, 0x80004005
push 0x1010cbc
push 0x1010ca8
call edi
push eax
call fcn.01048d15
jmp 0x1042ae7
xor ebx, ebx
cmp dword [ebp - 0x14], 0
je 0x1042bfe
push dword [ebp - 0x14]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
je 0x1042c1b
mov eax, dword [esi]
test eax, eax
je 0x1042c1b
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
and dword [esi], 0
mov eax, ebx
call fcn.0104dd50
ret 0xc
Function at 0x1043322
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x1c
mov eax, 0x105e9ed
call fcn.0104dc9c
mov ebx, dword [ebp + 0x14]
xor edi, edi
xor esi, esi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
cmp ebx, edi
jne 0x1043365
push 0x1011184
mov esi, 0x80070057
push 0x1011168
push esi
call fcn.01048c52
add esp, 0xc
jmp 0x1043450
mov dword [ebp - 4], edi
cmp dword [ebp + 0xc], edi
je 0x10433b2
lea eax, [ebp - 0x14]
push eax
push 0x20019
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
je 0x10433b8
mov esi, eax
jle 0x1043397
and esi, 0xffff
or esi, 0x80070000
push dword [ebp + 0xc]
push 0x1010ab8
push 0x101114c
push eax
call fcn.01048dd8
add esp, 0x10
jmp 0x1043450
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x1c]
push eax
push edi
push dword [ebp + 0x10]
mov dword [ebp - 0x18], 8
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
je 0x10433fb
mov esi, eax
jle 0x10433ec
and esi, 0xffff
or esi, 0x80070000
push dword [ebp + 0x10]
push 0x1010a50
push 0x1011130
jmp 0x10433a4
cmp dword [ebp - 0x1c], 0xb
je 0x1043445
push 0x10110e8
mov esi, 0x8007000d
push 0x10110c8
jmp 0x1043357
mov eax, dword [ebp - 0x28]
mov dword [ebx], eax
mov eax, dword [ebp - 0x24]
mov dword [ebx + 4], eax
cmp dword [ebp + 0xc], edi
je 0x1043463
cmp dword [ebp - 0x14], edi
je 0x1043463
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
call fcn.0104dd50
ret 0x10
Function at 0x1043472
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x18
mov eax, 0x105ea0d
call fcn.0104dc9c
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x10434db
lea eax, [ebp - 0x14]
push eax
push 0x20019
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
je 0x10434e1
mov esi, eax
jle 0x10434c0
and esi, 0xffff
or esi, 0x80070000
push dword [ebp + 0xc]
push 0x1010ab8
push 0x1011254
push eax
call fcn.01048dd8
add esp, 0x10
jmp 0x104357a
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
push 4
pop edi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push dword [ebp + 0x10]
mov dword [ebp - 0x18], edi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
je 0x1043523
mov esi, eax
jle 0x1043514
and esi, 0xffff
or esi, 0x80070000
push dword [ebp + 0x10]
push 0x1010a50
push 0x1011238
jmp 0x10434cd
cmp dword [ebp - 0x1c], edi
je 0x1043572
push 0x10111f0
mov esi, 0x8007000d
push 0x10111d0
push esi
call fcn.01048c52
add esp, 0xc
jmp 0x104357a
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
cmp dword [ebp + 0xc], ebx
je 0x104358d
cmp dword [ebp - 0x14], ebx
je 0x104358d
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
call fcn.0104dd50
ret 0x10

Function at 0x104359c
Capabilities:
Set registry value

Disassembly:
push 0xc
mov eax, 0x105ea2d
call fcn.0104dc9c
xor edi, edi
xor esi, esi
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], edi
cmp dword [ebp + 0xc], edi
je 0x10435fc
push edi
lea eax, [ebp - 0x14]
push eax
push edi
push 2
push dword [ebp + 0x18]
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, edi
je 0x1043602
mov esi, eax
jle 0x10435e4
and esi, 0xffff
or esi, 0x80070000
push dword [ebp + 0xc]
push 0x10112fc
push 0x10112e4
push eax
call fcn.01048dd8
add esp, 0x10
jmp 0x1043668
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
push 4
lea eax, [ebp + 0x14]
push eax
push 4
push edi
push dword [ebp + 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, edi
je 0x1043668
mov esi, eax
jle 0x104362b
and esi, 0xffff
or esi, 0x80070000
push dword [ebp + 0x10]
push 0x10112a0
push 0x1011288
jmp 0x10435f1
cmp dword [ebp + 0xc], edi
je 0x104367b
cmp dword [ebp - 0x14], edi
je 0x104367b
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
call fcn.0104dd50
ret 0x14
Function at 0x104368a
Capabilities:
Set registry value

Disassembly:
push 0xc
mov eax, 0x105ea4d
call fcn.0104dc9c
xor edi, edi
xor esi, esi
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], edi
cmp dword [ebp + 0xc], edi
je 0x10436e8
push edi
lea eax, [ebp - 0x14]
push eax
push edi
push 2
push edi
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, edi
je 0x10436ee
mov esi, eax
jle 0x10436d0
and esi, 0xffff
or esi, 0x80070000
push dword [ebp + 0xc]
push 0x10112fc
push 0x1011368
push eax
call fcn.01048dd8
add esp, 0x10
jmp 0x104375f
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 0x14]
push 1
push edi
push dword [ebp + 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, edi
je 0x104375f
mov esi, eax
jle 0x1043722
and esi, 0xffff
or esi, 0x80070000
push dword [ebp + 0x10]
push 0x10112a0
push 0x101134c
jmp 0x10436dd
cmp dword [ebp + 0xc], edi
je 0x1043772
cmp dword [ebp - 0x14], edi
je 0x1043772
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
call fcn.0104dd50
ret 0x10

Function at 0x1043781
Capabilities:
Delete registry value

Disassembly:
push 0xc
mov eax, 0x105ea6d
call fcn.0104dc9c
xor esi, esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], esi
cmp dword [ebp + 0xc], esi
je 0x10437d9
lea eax, [ebp - 0x14]
push eax
push 2
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
je 0x10437df
mov esi, eax
jle 0x10437c1
and esi, 0xffff
or esi, 0x80070000
push dword [ebp + 0xc]
push 0x1011418
push 0x1011400
push eax
call fcn.01048dd8
add esp, 0x10
jmp 0x104383a
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
push dword [ebp + 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, esi
je 0x104383a
mov esi, eax
jle 0x10437ff
and esi, 0xffff
or esi, 0x80070000
push dword [ebp + 0x10]
push 0x10113b8
push 0x101139c
jmp 0x10437ce
cmp dword [ebp + 0xc], 0
je 0x104384f
cmp dword [ebp - 0x14], 0
je 0x104384f
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
call fcn.0104dd50
ret 0xc
Function at 0x104385e
Capabilities:
Shutdown system

Disassembly:
push 0x20
mov eax, 0x105ea8d
call fcn.0104dc9c
push 4
pop edi
lea eax, [ebp - 0x14]
xor esi, esi
push eax
push 0x28
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp eax, esi
jne 0x10438b1
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
push 0x1011540
push 0x101152c
call edi
push eax
call fcn.01048d15
add esp, 0xc
jmp 0x104398a
lea eax, [ebp - 0x28]
push eax
push 0x1011504
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push esi
push esi
push esi
lea eax, [ebp - 0x2c]
push eax
push esi
push dword [ebp - 0x14]
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x20], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
test eax, eax
je 0x10438fc
call ebx
push 0x10114c0
push 0x10114a8
call ebx
jmp 0x10438a3
cmp dword [ebp + 8], esi
je 0x1043904
push 7
pop edi
cmp dword [ebp + 0xc], esi
jne 0x104390e
or edi, 0x20
jmp 0x1043914
or edi, 0x80
mov ebx, dword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
push 0x80020010
push edi
push dword [ebp + 0xc]
push esi
push esi
call ebx
cmp eax, esi
je 0x1043941
push 0x80020010
and edi, 0xffffffdf
or edi, 3
push edi
push 0x78
push esi
push esi
call ebx
cmp eax, esi
jne 0x104394c
mov dword [ebp - 0x18], 1
cmp eax, esi
je 0x104398a
push 0x1011470
push 0x101145c
push eax
call fcn.01048dd8
jmp 0x10438a9
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x14], esi
je 0x10439b7
push esi
push esi
push esi
lea eax, [ebp - 0x2c]
push eax
push esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
cmp dword [ebp - 0x14], esi
je 0x10439b7
cmp dword [ebp - 0x14], 0xffffffff
je 0x10439b7
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x18]
call fcn.0104dd50
ret 8
Function at 0x104410b
Capabilities:
Get file version info

Disassembly:
push 0x1c
mov eax, 0x105eae5
call fcn.0104dc9c
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov esi, dword [ebp + 8]
mov eax, dword [esi]
lea ecx, [ebp - 0x20]
push ecx
push eax
mov byte [ebp - 4], 1
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
cmp edi, ebx
jne 0x1044185
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, ebx
jle 0x104415a
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov dword [ebp - 0x14], eax
jl 0x1044168
mov dword [ebp - 0x14], 0x80004005
push dword [esi]
push 0x1011970
push 0x101195c
call edi
push eax
call fcn.01048d15
add esp, 0x10
push ebx
jmp 0x104429d
push edi
lea ecx, [ebp - 0x18]
call fcn.01041a8e
cmp dword [ebp - 0x18], ebx
jne 0x10441b0
push 0x1010880
mov eax, 0x8007000e
push 0x101194c
push eax
mov dword [ebp - 0x14], eax
call fcn.01048c52
add esp, 0xc
jmp 0x104417f
push dword [ebp - 0x18]
mov eax, dword [esi]
push edi
push ebx
push eax
call sub.VERSION.dll_GetFileVersionInfoW
cmp eax, ebx
jne 0x1044201
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, ebx
jle 0x10441d7
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov dword [ebp - 0x14], eax
jl 0x10441e5
mov dword [ebp - 0x14], 0x80004005
push dword [esi]
push 0x10118f0
push 0x10118e0
call edi
push eax
call fcn.01048d15
add esp, 0x10
jmp 0x104429a
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x1001520
push dword [ebp - 0x18]
call sub.VERSION.dll_VerQueryValueW
cmp eax, ebx
jne 0x1044279
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, ebx
jle 0x1044230
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov dword [ebp - 0x14], eax
jl 0x104423e
mov dword [ebp - 0x14], 0x80004005
push dword [esi]
push 0x10118f0
push 0x10118d0
jmp 0x10441f1
mov eax, dword [ebp - 0x1c]
movzx edx, word [eax + 0xa]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], edx
movzx edx, word [eax + 8]
mov dword [ecx + 4], edx
movzx edx, word [eax + 0xe]
mov dword [ecx + 8], edx
movzx eax, word [eax + 0xc]
mov dword [ecx + 0xc], eax
push dword [ebp - 0x18]
mov byte [ebp - 4], bl
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
mov eax, dword [ebp - 0x14]
call fcn.0104dd50
ret 8
Function at 0x10455d0
Capabilities:
Get common file path

Disassembly:
push 0x10
mov eax, 0x105eccb
call fcn.0104dc9c
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push ebx
push ebx
mov byte [ebp - 4], 1
call esi
cmp eax, ebx
jne 0x1045647
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, ebx
jle 0x104560f
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov dword [ebp - 0x14], eax
jl 0x104561d
mov dword [ebp - 0x14], 0x80004005
push 0x10048e0
push 0x1011f14
call esi
push eax
call fcn.01048d15
add esp, 0xc
push ebx
mov byte [ebp - 4], bl
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
mov eax, dword [ebp - 0x14]
call fcn.0104dd50
ret 4
lea edi, [eax + 1]
push edi
lea ecx, [ebp - 0x18]
call fcn.01033530
movzx eax, al
cmp eax, ebx
jne 0x104567a
push 0x10048a8
mov eax, 0x8007000e
push 0x1011efc
push eax
mov dword [ebp - 0x14], eax
call fcn.01048c52
add esp, 0xc
push dword [ebp - 0x18]
jmp 0x1045633
push edi
mov edi, dword [ebp - 0x18]
push edi
call esi
cmp eax, ebx
jne 0x10456c4
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, ebx
jle 0x104569b
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov dword [ebp - 0x14], eax
jl 0x10456a9
mov dword [ebp - 0x14], 0x80004005
push 0x1004858
push 0x1011ee4
call esi
push eax
call fcn.01048d15
add esp, 0xc
push edi
jmp 0x1045633
mov ecx, dword [ebp + 8]
push edi
call fcn.01031359
jmp 0x10456be
Function at 0x1045b61
Capabilities:
Create process on windows
Manipulate boot configuration

Disassembly:
push 0xb0
mov eax, 0x105edca
call fcn.0104dd12
xor ebx, ebx
mov esi, 0x1066af4
push esi
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x64], ebx
mov dword [ebp - 4], ebx
call fcn.010442ec
push esi
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 1
call fcn.010442ec
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x60], ebx
push 0xe
pop ecx
push 0x44
mov esi, 0x10122a8
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
pop esi
push esi
lea eax, [ebp - 0xbc]
push ebx
push eax
mov byte [ebp - 4], 4
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [ebp - 0x74]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
lea eax, [ebp - 0x54]
push eax
mov dword [ebp - 0xbc], esi
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x90], 0x100
call fcn.010455d0
cmp eax, ebx
mov dword [ebp - 0x50], eax
jge 0x1045c1c
push 0x1002fa0
push 0x1012294
push eax
call fcn.01048c52
add esp, 0xc
mov ecx, dword [ebp - 0x5c]
add ecx, 0xfffffff0
call fcn.0102fb3e
mov ecx, dword [ebp - 0x54]
add ecx, 0xfffffff0
call fcn.0102fb3e
mov eax, dword [ebp - 0x50]
call fcn.0104dd7d
ret
push dword [ebp - 0x54]
lea eax, [ebp - 0x5c]
push 0x1012264
push eax
call fcn.01030c5e
mov edi, dword [ebp - 0x5c]
add esp, 0xc
push edi
push 0x1002428
push 0x1012210
push 0x4000000
call fcn.01048e9b
add esp, 0x10
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0xbc]
push eax
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
lea eax, [ebp - 0x4c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, ebx
jne 0x1045cb1
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, ebx
jle 0x1045c85
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov dword [ebp - 0x50], eax
jl 0x1045c93
mov dword [ebp - 0x50], 0x80004005
push edi
push 0x1012160
push 0x101214c
call esi
push eax
call fcn.01048d15
add esp, 0x10
lea ecx, [edi - 0x10]
jmp 0x1045c03
mov eax, dword [ebp - 0x74]
mov edi, dword [ebp - 0x70]
push 0xffffffffffffffff
push eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x60], edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp eax, ebx
jne 0x1045d32
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, ebx
jle 0x1045ced
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov dword [ebp - 0x50], eax
jl 0x1045cfb
mov dword [ebp - 0x50], 0x80004005
push 0x1002ad8
push 0x1012138
call esi
push eax
call fcn.01048d15
add esp, 0xc
cmp edi, ebx
je 0x1045d1c
lea ecx, [ebp - 0x60]
call fcn.0102fb22
cmp dword [ebp - 0x58], ebx
je 0x1045bfd
lea ecx, [ebp - 0x58]
call fcn.0102fb22
jmp 0x1045bfd
cmp dword [ebp - 0x64], ebx
je 0x1045d10
push dword [ebp - 0x64]
mov eax, 0x80004005
push 0x10120f0
push 0x10120d8
push eax
mov dword [ebp - 0x50], eax
call fcn.01048c52
add esp, 0x10
jmp 0x1045d10