joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409070
Capabilities:
Set file attributes

Disassembly:
and ecx, 0xffffb1af
cmp dword [eax + 0x18], 8
jb 0x40908d
mov eax, dword [eax + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
ret
add eax, 4
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
ret

Function at 0x4090a0
Capabilities:
Move file

Disassembly:
mov edx, 8
cmp dword [eax + 0x18], edx
jb 0x4090af
mov eax, dword [eax + 4]
jmp 0x4090b2
add eax, 4
cmp dword [ecx + 0x18], edx
jb 0x4090c8
mov ecx, dword [ecx + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne al
ret
add ecx, 4
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne al
ret

Function at 0x4090e0
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
push 0xffffffffffffffff
push 0x446d68
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4551a0]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
push edi
mov eax, dword [0x4551a0]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x44]
mov ebx, 8
cmp dword [esi + 0x18], ebx
lea edi, [esi + 4]
jb 0x409126
mov ecx, dword [edi]
jmp 0x409128
mov ecx, edi
cmp dword [ebp + 0x18], ebx
jb 0x409132
mov eax, dword [ebp + 4]
jmp 0x409135
lea eax, [ebp + 4]
push 0xb
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x4091e8
cmp dword [esi + 0x18], ebx
jb 0x40914e
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x409220
push 0xffffffffffffffff
lea eax, [esp + 0x18]
xor edi, edi
push eax
xor ebx, ebx
mov eax, esi
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], edi
mov word [esp + 0x20], di
call fcn.00401709
mov dword [esp + 0x3c], edi
lea ecx, [esp + 0x14]
call fcn.004096d0
test al, al
je 0x4091f3
lea eax, [esp + 0x14]
mov ecx, esi
call fcn.004090a0
test al, al
je 0x4091f3
mov eax, esi
mov ecx, ebp
call fcn.004090a0
test al, al
lea ecx, [esp + 0x14]
je 0x4091ec
push ecx
call fcn.00409240
add esp, 4
mov dword [esp + 0x3c], 0xffffffff
cmp dword [esp + 0x2c], 8
jb 0x4091d7
mov edx, dword [esp + 0x18]
push edx
call fcn.0043004e
add esp, 4
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], edi
mov word [esp + 0x18], di
mov al, 1
jmp 0x409222
mov eax, esi
call fcn.004090a0
mov dword [esp + 0x3c], 0xffffffff
cmp dword [esp + 0x2c], 8
jb 0x40920f
mov eax, dword [esp + 0x18]
push eax
call fcn.0043004e
add esp, 4
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], edi
mov word [esp + 0x18], di
xor al, al
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0042fe0e
add esp, 0x30
ret
Function at 0x409240
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x445900
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4551a0]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov esi, dword [esp + 0x44]
mov ebx, 8
cmp dword [esi + 0x18], ebx
lea edi, [esi + 4]
jb 0x40927c
mov eax, dword [edi]
jmp 0x40927e
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x40929f
mov al, 1
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
cmp dword [esi + 0x18], ebx
jb 0x4092a8
mov eax, dword [edi]
jmp 0x4092aa
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
je 0x4093c5
cmp dword [esi + 0x18], ebx
jb 0x4092c7
mov eax, dword [edi]
jmp 0x4092c9
mov eax, edi
xor ebp, ebp
lea esi, [esp + 0x18]
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], ebp
mov word [esp + 0x1c], bp
call fcn.00401625
mov dword [esp + 0x3c], ebp
cmp dword [esp + 0x30], ebx
mov eax, dword [esp + 0x1c]
jae 0x4092f7
lea eax, [esp + 0x1c]
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
test al, al
sete bl
mov dword [esp + 0x3c], 0xffffffff
mov esi, 8
cmp dword [esp + 0x30], esi
jb 0x409329
mov eax, dword [esp + 0x1c]
push eax
call fcn.0043004e
add esp, 4
test bl, bl
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], ebp
mov word [esp + 0x1c], bp
jne 0x4093c5
mov ebx, dword [esp + 0x44]
cmp dword [ebx + 0x18], esi
jb 0x40934f
mov eax, dword [edi]
jmp 0x409351
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x409289
cmp dword [ebx + 0x18], esi
jb 0x409369
mov eax, dword [edi]
jmp 0x40936b
mov eax, edi
lea esi, [esp + 0x18]
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], ebp
mov word [esp + 0x1c], bp
call fcn.00401625
mov dword [esp + 0x3c], 1
mov ecx, dword [esp + 0x14]
mov eax, esi
call fcn.00409070
mov dword [esp + 0x3c], 0xffffffff
cmp dword [esp + 0x30], 8
jb 0x4093b4
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.0043004e
add esp, 4
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], ebp
mov word [esp + 0x1c], bp
xor al, al
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
Function at 0x4093e0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x624
mov eax, dword [0x4551a0]
xor eax, esp
mov dword [esp + 0x620], eax
push esi
push edi
xor edi, edi
cmp dword [0x45655c], edi
mov esi, ecx
je 0x40942c
push ebx
push 0xffffffffffffffff
push esi
xor ebx, ebx
mov eax, 0x456548
call fcn.00401709
pop ebx
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x620]
xor ecx, esp
call fcn.0042fe0e
add esp, 0x624
ret
push 0x20a
lea eax, [esp + 0xe]
push edi
push eax
mov word [esp + 0x14], di
call fcn.004323d0
add esp, 0xc
lea ecx, [esp + 8]
push ecx
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
add eax, 0xffffffff
cmp eax, 0x103
ja 0x4094fa
push 0x410
lea edx, [esp + 0x21a]
push edi
push edx
mov word [esp + 0x21e], di
mov word [esp + 0x220], di
call fcn.004323d0
add esp, 0xc
push 0x208
lea eax, [esp + 0x218]
push eax
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x208
ja 0x4094d8
cmp eax, edi
je 0x4094d8
mov word [esp + eax*2 + 0x214], di
lea eax, [esp + 0x214]
call fcn.00401625
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x620]
xor ecx, esp
call fcn.0042fe0e
add esp, 0x624
ret
lea eax, [esp + 8]
call fcn.00401625
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x620]
xor ecx, esp
call fcn.0042fe0e
add esp, 0x624
ret
mov ecx, dword [esp + 0x628]
pop edi
pop esi
xor ecx, esp
xor al, al
call fcn.0042fe0e
add esp, 0x624
ret

Function at 0x409520
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x4551a0]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
push esi
mov esi, dword [esp + 0x21c]
push edi
push 0x20a
lea eax, [esp + 0x12]
push 0
push eax
mov ebx, ecx
mov edi, edx
mov word [esp + 0x18], 0
call fcn.004323d0
mov eax, 8
add esp, 0xc
cmp dword [edi + 0x18], eax
jb 0x40956c
mov edi, dword [edi + 4]
jmp 0x40956f
add edi, 4
cmp dword [ebx + 0x18], eax
jb 0x409579
mov ebx, dword [ebx + 4]
jmp 0x40957c
add ebx, 4
lea ecx, [esp + 0xc]
push ecx
push 0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jbe 0x4095bc
lea eax, [esp + 0xc]
mov word [esp + 0x216], 0
call fcn.00401625
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.0042fe0e
add esp, 0x210
ret
mov ecx, dword [esp + 0x218]
pop edi
pop esi
pop ebx
xor ecx, esp
xor al, al
call fcn.0042fe0e
add esp, 0x210
ret
Function at 0x409960
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x50
mov eax, dword [0x4551a0]
xor eax, esp
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x58]
push ebx
push ebp
mov ebp, dword [esp + 0x5c]
cdq
push esi
push edx
mov esi, ecx
push eax
lea ecx, [esp + 0x18]
call fcn.00404f00
add esp, 8
push 0xffffffffffffffff
push esi
xor ebx, ebx
mov eax, edi
call fcn.00401709
push 0x44b884
mov ebx, 1
mov eax, esi
call fcn.00403a55
lea eax, [esp + 0x10]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4099b0
sub eax, edx
sar eax, 1
lea ecx, [esp + 0x10]
mov ebx, eax
push ecx
mov eax, esi
call fcn.00403a55
push 0x44b888
mov ebx, 1
mov eax, esi
call fcn.00403a55
push 0xffffffffffffffff
push 0
mov eax, ebp
call fcn.00403cbf
cmp dword [esi + 0x18], 8
jb 0x4099f4
mov esi, dword [esi + 4]
jmp 0x4099f7
add esi, 4
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, dword [esp + 0x54]
pop esi
xor edx, edx
cmp eax, 0xffffffff
pop ebp
sete dl
pop ebx
xor ecx, esp
mov al, dl
call fcn.0042fe0e
add esp, 0x50
ret

Function at 0x409ff0
Capabilities:
Clear file content

Disassembly:
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [edi], ebx
push ebp
push esi
jne 0x40a007
xor al, al
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
push 1
push ebx
push ebx
lea esi, [esp + 0x20]
mov eax, edi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call fcn.00409f40
test al, al
je 0x409ffc
mov eax, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
push ebx
push eax
push ebp
lea esi, [esp + 0x18]
mov eax, edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call fcn.00409f40
test al, al
je 0x409ffc
mov ecx, dword [esp + 0xc]
xor bl, bl
cmp ecx, ebp
jne 0x40a075
mov edx, dword [esp + 0x10]
cmp edx, dword [esp + 0x24]
jne 0x40a075
mov eax, dword [edi]
test eax, eax
jne 0x40a062
xor bl, bl
jmp 0x40a075
cmp dword [eax], 0xffffffff
je 0x40a05e
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne bl
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push 0
push ecx
push edx
lea esi, [esp + 0x18]
mov eax, edi
call fcn.00409f40
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x10
ret 8
Function at 0x40a170
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x420
mov eax, dword [0x4551a0]
xor eax, esp
mov dword [esp + 0x41c], eax
mov eax, dword [esp + 0x424]
cmp dword [eax + 0x18], 8
push ebx
push esi
mov esi, dword [esp + 0x430]
push edi
mov edi, edx
jb 0x40a1a2
mov eax, dword [eax + 4]
jmp 0x40a1a5
add eax, 4
lea edx, [esp + 0xc]
push edx
push 0x20019
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40a232
mov ebx, dword [esp + 0xc]
test ebx, ebx
je 0x40a232
push 0x410
push eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x1c], 0x40f
call fcn.004323d0
add esp, 0xc
cmp dword [edi + 0x18], 8
jb 0x40a1ef
mov edi, dword [edi + 4]
jmp 0x40a1f2
add edi, 4
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
jne 0x40a21a
lea eax, [esp + 0x18]
call fcn.00401625
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40a229
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test edi, edi
sete al
jmp 0x40a234
xor al, al
mov ecx, dword [esp + 0x428]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0042fe0e
add esp, 0x420
ret 8

Function at 0x40a250
Capabilities:
Set registry value

Disassembly:
cmp dword [eax + 0x18], 8
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov esi, ecx
jb 0x40a264
mov eax, dword [eax + 4]
jmp 0x40a267
add eax, 4
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
push 0
push 0x2001f
push 0
push 0x44b18c
push 0
push eax
mov eax, dword [esp + 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40a2e6
mov edi, dword [esp + 0x14]
test edi, edi
je 0x40a2e6
mov ecx, dword [esi + 0x14]
add ecx, ecx
cmp dword [esi + 0x18], 8
jb 0x40a2a9
mov edx, dword [esi + 4]
jmp 0x40a2ac
lea edx, [esi + 4]
cmp dword [ebp + 0x18], 8
jb 0x40a2b7
mov eax, dword [ebp + 4]
jmp 0x40a2ba
lea eax, [ebp + 4]
push ecx
push edx
push 1
push 0
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40a2d9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
test esi, esi
pop esi
sete al
pop ebp
ret 8
pop edi
pop esi
xor al, al
pop ebp
ret 8
Function at 0x40a540
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
push ecx
push esi
push edi
mov esi, eax
call fcn.0040a740
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x40a5a7
cmp dword [esi + 0x18], 8
jb 0x40a56a
mov eax, dword [esi + 4]
jmp 0x40a56d
lea eax, [esi + 4]
push 0
push 0
push 0x44b18c
push 0
push 0
push eax
push 1
push 2
push 0x110
push 0xf01ff
push str.2345
push str.2345Safe
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov esi, eax
test esi, esi
jne 0x40a5ad
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
xor al, al
pop esi
pop ecx
ret
lea eax, [esp + 8]
push eax
push 1
push esi
mov dword [esp + 0x14], 0x44b890
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
call fcn.0040b0c0
pop edi
mov al, 1
pop esi
pop ecx
ret
Function at 0x40a740
Capabilities:
Check for time delay via gettickcount
Query service status
Stop service

Disassembly:
push 0xffffffffffffffff
push 0x446ca4
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x4551a0]
xor eax, esp
mov dword [esp + 0x74], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4551a0]
xor eax, esp
push eax
lea eax, [esp + 0x8c]
mov dword fs:[0], eax
push str.GlobalRC_SAFE_D83E09CB_2765_4301_84EA_5B679756AAF4
lea eax, [esp + 0x68]
push eax
call fcn.0042e750
xor ebx, ebx
mov dword [esp + 0x94], ebx
mov eax, dword [esp + 0x64]
cmp eax, ebx
mov esi, dword [sym.imp.KERNEL32.dll_SetEvent]
je 0x40a79e
push eax
call esi
push str.GlobalRC_SAFE_1103A027_8DC6_473c_A3BC_C913CBA0A9C3
lea ecx, [esp + 0x44]
push ecx
call fcn.0042e750
mov byte [esp + 0x94], 1
mov eax, dword [esp + 0x40]
cmp eax, ebx
je 0x40a7c0
push eax
call esi
lea edx, [esp + 0x40]
push edx
mov byte [esp + 0x98], 0
call fcn.0042e830
lea eax, [esp + 0x64]
push eax
mov dword [esp + 0x98], 0xffffffff
call fcn.0042e830
call fcn.0040a900
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
cmp edi, ebx
je 0x40a8cf
push 0x24
push str.2345Safe
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
cmp esi, ebx
jne 0x40a823
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x40a8cf
xor eax, eax
lea ecx, [esp + 0x1c]
push ecx
push 1
push esi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x40a8c3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [esp + 0x20], 1
mov dword [esp + 0x18], eax
je 0x40a8c3
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
jmp 0x40a880
mov edx, dword [esp + 0x34]
push edx
mov dword [esp + 0x18], 0
call ebp
lea eax, [esp + 0x14]
push eax
push 0x24
lea ecx, [esp + 0x24]
push ecx
push 0
push esi
call ebx
test eax, eax
je 0x40a8c3
cmp dword [esp + 0x20], 1
je 0x40a8c3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x18]
cmp eax, 0xbb8
ja 0x40a8c3
cmp dword [esp + 0x20], 1
jne 0x40a880
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
call fcn.0040b060
mov ecx, dword [esp + 0x8c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x74]
xor ecx, esp
call fcn.0042fe0e
add esp, 0x84
ret
Function at 0x40bfe0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x445fb3
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x4551a0]
xor eax, esp
mov dword [esp + 0x428], eax
push ebx
push esi
push edi
mov eax, dword [0x4551a0]
xor eax, esp
push eax
lea eax, [esp + 0x440]
mov dword fs:[0], eax
test byte [0x457a04], 1
mov esi, ecx
jne 0x40c085
or dword [0x457a04], 1
xor ebx, ebx
mov dword [esp + 0x448], ebx
call fcn.0040d1a0
mov dword [0x4579f4], eax
mov byte [eax + 0x2d], 1
mov eax, dword [0x4579f4]
mov dword [eax + 4], eax
mov eax, dword [0x4579f4]
mov dword [eax], eax
mov eax, dword [0x4579f4]
mov dword [eax + 8], eax
mov dword [0x4579f8], ebx
push 0x448f20
mov byte [esp + 0x44c], bl
call fcn.0043033e
add esp, 4
mov dword [esp + 0x448], 0xffffffff
mov eax, dword [0x4579f4]
mov dword [esp + 0x18], eax
lea ebx, [ebp + 8]
lea eax, [esp + 0x1c]
call fcn.0040c6d0
mov edi, eax
mov eax, dword [edi]
xor ebx, ebx
cmp eax, ebx
je 0x40c0ab
cmp eax, 0x4579f0
je 0x40c0b0
call fcn.00430697
mov ecx, dword [esp + 0x18]
cmp dword [edi + 4], ecx
je 0x40c0c6
lea ecx, [ebp + 8]
call fcn.0040c540
push 0xffffffffffffffff
push esi
jmp 0x40c142
push 0x40e
lea edx, [esp + 0x2a]
push ebx
push edx
mov word [esp + 0x30], bx
call fcn.004323d0
mov ecx, dword [ebp + 8]
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push ecx
push ebx
mov dword [esp + 0x1c], ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x40c119
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x24]
push edx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
jne 0x40c11d
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x40c119
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor al, al
jmp 0x40c14b
lea eax, [esp + 0x24]
call fcn.00401625
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x40c135
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea ecx, [ebp + 8]
call fcn.0040c540
push 0xffffffffffffffff
push eax
mov eax, esi
xor ebx, ebx
call fcn.00401709
mov al, 1
mov ecx, dword [esp + 0x440]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.0042fe0e
mov esp, ebp
pop ebp
ret
Function at 0x40c1f0
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x24
lea eax, [esp + 4]
push eax
push 0x20
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40c2bd
lea ecx, [esp + 8]
push ecx
push 0x44bba8
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x40c24c
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x24
ret
mov ecx, dword [esp + 0xc]
push 0
xor eax, eax
push 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x10]
push 0x10
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x14]
push 0
push eax
mov dword [esp + 0x28], 1
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x40c2a5
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x24
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x514
je 0x40c23d
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x24
ret
Function at 0x40f740
Capabilities:
Check os version
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4476d8
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4551a0]
xor eax, esp
push eax
lea eax, [esp + 0x6c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0xb4]
xor ebx, ebx
mov dword [esp + 0x74], 1
cmp dword [esp + 0x90], ebx
jne 0x40f7bf
lea edi, [esp + 0x50]
call fcn.00408e30
push 0xffffffffffffffff
lea ecx, [esp + 0x80]
push ecx
mov byte [esp + 0x7c], 2
call fcn.00401709
mov edi, 8
mov byte [esp + 0x74], 1
cmp dword [esp + 0x68], edi
jb 0x40f7bb
mov edx, dword [esp + 0x54]
push edx
call fcn.0043004e
add esp, 4
xor ebx, ebx
jmp 0x40f7c4
mov edi, 8
cmp dword [esp + 0xac], ebx
jne 0x40f7dd
lea esi, [esp + 0x98]
lea edx, [esp + 0x7c]
call fcn.00406cc0
push 0x3c
lea eax, [esp + 0x18]
push ebx
push eax
call fcn.004323d0
add esp, 0xc
cmp byte [0x4579dc], bl
mov dword [esp + 0x14], 0x3c
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], 0x540
je 0x40f810
mov eax, dword [0x456708]
jmp 0x40f827
push 0x456710
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [0x456708], eax
mov byte [0x4579dc], 1
cmp eax, ebx
je 0x40f83c
cmp dword [0x456714], 6
mov dword [esp + 0x20], 0x44bf6c
jae 0x40f844
mov dword [esp + 0x20], str.open
cmp dword [esp + 0x94], edi
jb 0x40f85a
mov ecx, dword [esp + 0x80]
mov dword [esp + 0x24], ecx
jmp 0x40f865
lea edx, [esp + 0x80]
mov dword [esp + 0x24], edx
cmp dword [esp + 0xb0], edi
jb 0x40f87b
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x2c], eax
jmp 0x40f886
lea ecx, [esp + 0x9c]
mov dword [esp + 0x2c], ecx
cmp dword [ebp + 0x18], edi
jb 0x40f894
mov edx, dword [ebp + 4]
mov dword [esp + 0x28], edx
jmp 0x40f89b
add ebp, 4
mov dword [esp + 0x28], ebp
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x34], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x40f914
cmp dword [esp + 0x94], edi
jb 0x40f8cb
mov ecx, dword [esp + 0x80]
push ecx
call fcn.0043004e
add esp, 4
cmp dword [esp + 0xb0], edi
mov dword [esp + 0x94], 7
mov dword [esp + 0x90], ebx
mov word [esp + 0x80], bx
jb 0x40f8fe
mov edx, dword [esp + 0x9c]
push edx
call fcn.0043004e
add esp, 4
xor al, al
mov ecx, dword [esp + 0x6c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
mov edx, dword [esp + 0x4c]
cmp edx, ebx
je 0x40f948
cmp byte [esp + 0xb8], bl
je 0x40f941
mov ecx, dword [esp + 0xbc]
or eax, 0xffffffff
cmp ecx, ebx
jl 0x40f935
mov eax, ecx
push eax
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0x4c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x94], edi
jb 0x40f961
mov eax, dword [esp + 0x80]
push eax
call fcn.0043004e
add esp, 4
cmp dword [esp + 0xb0], edi
mov dword [esp + 0x94], 7
mov dword [esp + 0x90], ebx
mov word [esp + 0x80], bx
jb 0x40f994
mov ecx, dword [esp + 0x9c]
push ecx
call fcn.0043004e
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x6c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret