joyce8/EMBER2024-capa huggingface dataset:
Function at 0x602ef2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x138c]
mov eax, 0x138c
call fcn.00508210
push 0xffffffffffffffff
push 0x616748
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x710544]
xor eax, ebp
mov dword [ebp + 0x1388], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 0x1394]
push 0x7ffe
mov dword [ebp - 0x18], eax
call fcn.0051a7b4
mov edi, eax
mov dword [esp], 0x1388
xor ebx, ebx
mov dword [ebp - 0x14], 7
lea eax, [ebp]
push ebx
push eax
call fcn.0050c430
add esp, 0xc
mov dword [ebp - 0x10], 0x9c4
push esi
cmp dword [esi + 0x10], ebx
je 0x602f77
push 0x101
jmp 0x602f79
push 1
push ebx
push dword [esi + 4]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x602fa1
push eax
push dword [esi + 4]
push str.ReadDwordRegistryData:_Error_while_opening_registry_key__s_and_the_errorcode_is_:__d
call fcn.00609c05
add esp, 0xc
xor eax, eax
jmp 0x60301c
push 0x6ad104
lea ecx, [ebp - 0x1c]
call fcn.0045290e
lea eax, [ebp - 0x10]
mov dword [ebp - 4], ebx
inc dword [esi + 0x14]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push dword [esi + 0x18]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 0x10]
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004e217a
mov ecx, dword [ebp - 0x10]
mov ebx, eax
mov eax, dword [ebp - 0x18]
push ecx
mov dword [eax], ecx
lea eax, [ebp]
push eax
push ebx
call fcn.0050be00
add esp, 0x10
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x60300f
push edi
call fcn.00518583
pop ecx
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.00452239
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1388]
xor ecx, ebp
call fcn.00507778
add ebp, 0x138c
leave
ret 4
Function at 0x60471c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x604732
xor esi, esi
jmp 0x604735
and esi, 0x10
mov ecx, dword [esp + 8]
add ecx, 0xfffffff0
call fcn.00452239
mov eax, esi
pop esi
ret

Function at 0x604ac5
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x710544]
xor eax, ebp
mov dword [ebp + 0x9c], eax
push 0x118
lea eax, [ebp - 0x7c]
push 0
push eax
call fcn.0050c430
add esp, 0xc
mov dword [ebp - 0x80], 0x11c
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x604b1f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetOsFamily_:_Unable_to_find_the_OSVersion___Errorcode__d__n
call fcn.00609aff
xor eax, eax
pop ecx
inc eax
jmp 0x604b89
cmp dword [ebp - 0x70], 2
jne 0x604b7c
mov ecx, dword [ebp - 0x7c]
push 4
pop eax
cmp ecx, eax
jbe 0x604b7c
cmp ecx, 6
jne 0x604b57
mov ecx, dword [ebp - 0x78]
test ecx, ecx
jne 0x604b40
push 2
pop eax
jmp 0x604b8a
cmp ecx, 1
jne 0x604b49
push 3
jmp 0x604b3d
cmp ecx, 2
je 0x604b8a
cmp ecx, 3
jne 0x604b78
push 5
jmp 0x604b3d
cmp ecx, 0xa
jne 0x604b66
cmp dword [ebp - 0x78], 0
jne 0x604b78
push 6
jmp 0x604b3d
cmp ecx, 5
jne 0x604b78
xor eax, eax
cmp dword [ebp - 0x78], eax
je 0x604b8a
inc eax
cmp dword [ebp - 0x78], eax
jae 0x604b8a
push 7
jmp 0x604b3d
push str.GetOsFamily_:The_windows_is_unable_to_found_.__n
call fcn.00609aff
or eax, 0xffffffff
pop ecx
mov ecx, dword [ebp + 0x9c]
xor ecx, ebp
call fcn.00507778
add ebp, 0xa0
leave
ret
Function at 0x604b9f
Capabilities:
Create directory

Disassembly:
push ebp
lea ebp, [esp - 0x464]
sub esp, 0x464
push 0xffffffffffffffff
push 0x616bf2
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x710544]
xor eax, ebp
mov dword [ebp + 0x460], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x1c], esi
mov ebx, ecx
mov dword [ebp - 0x14], ebx
push str.Unzip_called...
call fcn.00609c05
pop ecx
test ebx, ebx
jne 0x604c03
push str.source_path_of_zip_location_is_null
call fcn.00609c05
pop ecx
xor al, al
jmp 0x604d7b
test esi, esi
jne 0x604c0e
push str.destination_of_zip_is_null
jmp 0x604bf6
push ecx
push ecx
mov ecx, ebx
call fcn.0060a109
mov ebx, eax
mov edx, esi
mov ecx, ebx
mov dword [ebp - 0x18], ebx
call fcn.0060d952
lea eax, [ebp + 0x230]
or edx, 0xffffffff
push eax
mov ecx, ebx
call fcn.0060d982
mov eax, dword [ebp + 0x230]
xor ebx, ebx
add esp, 0xc
mov dword [ebp - 0x20], eax
xor edi, edi
inc ebx
test eax, eax
jle 0x604cd4
mov ecx, dword [ebp - 0x18]
lea eax, [ebp]
push eax
mov edx, edi
call fcn.0060d982
test byte [ebp + 0x20c], 0x10
pop ecx
je 0x604cca
call fcn.004e2479
push eax
lea ecx, [ebp - 0x10]
call fcn.00452c50
and dword [ebp - 4], 0
lea eax, [ebp + 4]
push eax
push esi
lea eax, [ebp - 0x10]
push 0x6b2cf8
push eax
call fcn.004533be
mov esi, dword [ebp - 0x10]
add esp, 0x10
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp dword [esi - 4], ebx
jle 0x604cae
push dword [esi - 0xc]
lea ecx, [ebp - 0x10]
call fcn.00452cd9
mov esi, dword [ebp - 0x10]
push esi
push str.unzip_dir_:__s
call fcn.00609c05
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
lea ecx, [esi - 0x10]
call fcn.00452239
mov esi, dword [ebp - 0x1c]
inc edi
cmp edi, dword [ebp - 0x20]
jl 0x604c4f
mov ecx, dword [ebp - 0x18]
call fcn.0060d9ac
push str.Folder_Creation_succeeded_during_unzip
call fcn.00609c05
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.0060a109
mov edi, eax
mov edx, esi
mov ecx, edi
call fcn.0060d952
lea eax, [ebp + 0x230]
or edx, 0xffffffff
push eax
mov ecx, edi
call fcn.0060d982
mov eax, dword [ebp + 0x230]
add esp, 0xc
xor esi, esi
mov dword [ebp - 0x14], eax
test eax, eax
jle 0x604d67
lea eax, [ebp + 0x230]
mov edx, esi
push eax
mov ecx, edi
call fcn.0060d982
push ecx
lea eax, [ebp + 0x234]
mov edx, esi
push eax
mov ecx, edi
call fcn.0060a0dd
add esp, 0xc
test eax, eax
je 0x604d5c
push eax
lea eax, [ebp + 0x234]
push eax
push str.Unzip_failed__s_:__d
call fcn.00609c05
add esp, 0xc
xor bl, bl
inc esi
cmp esi, dword [ebp - 0x14]
jl 0x604d1d
cmp bl, 1
jne 0x604d72
push str.Unzip_done_for_all_files
call fcn.00609c05
pop ecx
mov ecx, edi
call fcn.0060d9ac
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x460]
xor ecx, ebp
call fcn.00507778
add ebp, 0x464
leave
ret
Function at 0x604dad
Capabilities:
Copy file

Disassembly:
push esi
push edi
push 0
push dword [esp + 0x10]
mov esi, ecx
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0xc]
add ecx, 0xfffffff0
mov dword [esi], eax
call fcn.00452239
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.00452239
mov eax, edi
pop edi
pop esi
ret

Function at 0x604de8
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x118]
sub esp, 0x118
push 0xffffffffffffffff
push 0x616c43
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x710544]
xor eax, ebp
mov dword [ebp + 0x114], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov ebx, ecx
mov dword [ebp - 0x14], ebx
xor edi, edi
lea eax, [ebp]
mov dword [ebp - 4], edi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], edi
push eax
mov dword [ebp], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0x6b2778
mov ecx, ebx
call fcn.0045290e
mov dword [ebp - 4], edi
mov dword [ebp - 0x18], 1
cmp esi, 5
jne 0x604f04
push str.XP_OS
call fcn.00609aff
pop ecx
mov dword [ebp - 0x14], edi
call fcn.004e2479
push eax
lea ecx, [ebp - 0x10]
call fcn.00452c50
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], 1
call fcn.00603425
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 2
push 0x6b2840
push eax
call fcn.004533be
mov edi, dword [ebp - 0x10]
pop ecx
mov esi, esp
add edi, 0xfffffff0
push edi
mov dword [ebp - 0x1c], esi
call fcn.00452eea
pop ecx
add eax, 0x10
lea ecx, [ebp - 0x3c]
mov dword [esi], eax
call fcn.00452353
push 0xa
push str.CSDVersion
lea ecx, [ebp - 0x24]
call fcn.00452fb2
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x3c]
call fcn.00602ef2
mov esi, eax
mov ecx, ebx
push esi
call fcn.00452dae
push dword [ebx]
push esi
push 0x6b2784
call fcn.00609c05
add esp, 0xc
lea ecx, [ebp - 0x3c]
call fcn.00452382
mov ecx, edi
call fcn.00452239
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x114]
xor ecx, ebp
call fcn.00507778
add ebp, 0x118
leave
ret
Function at 0x604f29
Capabilities:
Move file

Disassembly:
push 0x14
mov eax, 0x616cb3
call fcn.00508068
mov bl, dl
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 1
call fcn.00605e00
mov byte [ebp - 4], 2
mov esi, dword [ebp - 0x18]
test bl, bl
je 0x60504b
push 0
push esi
lea ecx, [ebp + 0xc]
call fcn.004527c8
test eax, eax
jne 0x60504b
call fcn.004e2479
push eax
lea ecx, [ebp - 0x10]
call fcn.00452c50
mov byte [ebp - 4], 3
call fcn.004e2479
push eax
lea ecx, [ebp - 0x14]
call fcn.00452c50
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 4
push eax
call fcn.005fbfcb
mov byte [ebp - 4], 5
push dword [eax]
lea eax, [ebp - 0x10]
push esi
push 0x6b3024
push eax
call fcn.004533be
mov byte [ebp - 4], 4
add esp, 0x10
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.00452239
lea eax, [ebp - 0x1c]
push eax
call fcn.005fc0a3
mov byte [ebp - 4], 6
push dword [eax]
lea eax, [ebp - 0x14]
push esi
push 0x6b3030
push eax
call fcn.004533be
mov byte [ebp - 4], 4
add esp, 0x10
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.00452239
mov edi, dword [ebp - 0x10]
cmp dword [edi - 4], 1
jle 0x605006
push dword [edi - 0xc]
lea ecx, [ebp - 0x10]
call fcn.00452cd9
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
cmp dword [esi - 4], 1
jle 0x60501d
push dword [esi - 0xc]
lea ecx, [ebp - 0x14]
call fcn.00452cd9
mov esi, dword [ebp - 0x14]
push edi
push esi
call fcn.005205ce
push esi
push edi
push eax
push str.File_rename__d__s_:__s
call fcn.00609c05
add esp, 0x18
lea ecx, [esi - 0x10]
call fcn.00452239
lea ecx, [edi - 0x10]
mov byte [ebp - 4], 2
call fcn.00452239
mov esi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x20]
test ebx, ebx
jne 0x605087
mov edi, dword [ebp + 0xc]
cmp dword [edi - 4], 1
jle 0x605069
push dword [edi - 0xc]
lea ecx, [ebp + 0xc]
call fcn.00452cd9
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
cmp dword [ecx - 4], 1
jle 0x605080
push dword [ecx - 0xc]
lea ecx, [ebp + 8]
call fcn.00452cd9
mov ecx, dword [ebp + 8]
mov edx, edi
call fcn.00604b9f
cmp ebx, 1
jne 0x6050f8
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.004525e6
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x14]
push dword [ebp + 0xc]
call fcn.004525e6
mov byte [ebp - 4], 8
mov edi, dword [ebp - 0x14]
cmp dword [edi - 4], ebx
jle 0x6050c0
push dword [edi - 0xc]
lea ecx, [ebp - 0x14]
call fcn.00452be3
mov edi, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
cmp dword [edx - 4], 1
jle 0x6050d7
push dword [edx - 0xc]
lea ecx, [ebp - 0x10]
call fcn.00452be3
mov edx, dword [ebp - 0x10]
push edi
call fcn.00460890
pop ecx
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00452239
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00452239
push 0
lea ecx, [ebp + 8]
call fcn.00452c9e
push eax
call fcn.00517a29
pop ecx
lea ecx, [esi - 0x10]
call fcn.00452239
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00452239
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00452239
mov al, 1
call fcn.00508031
ret
Function at 0x60512f
Capabilities:
Create directory

Disassembly:
sub esp, 0x4c4
mov eax, dword [0x710544]
xor eax, esp
mov dword [esp + 0x4c0], eax
push ebx
push ebp
push esi
xor ebx, ebx
lea esi, [esp + 0x274]
push edi
mov edi, ecx
mov dword [esp + 0x10], ebx
mov ecx, ebx
mov edx, edi
sub esi, edi
movzx eax, word [edx]
mov word [esi + edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x60515c
lea esi, [esp + 0x278]
lea edx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, bx
jne 0x605175
sub esi, edx
mov dword [esp + 0x1c], ebx
sar esi, 1
test esi, esi
jle 0x605213
mov edx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ebx, [esp + 0x278]
lea eax, [esp + 0x20]
mov dword [esp + 0x18], edx
sub ebx, eax
cmp esi, 0x12c
jge 0x605213
lea eax, [esp + 0x20]
lea eax, [eax + ecx*2]
movzx ebp, word [ebx + eax]
mov dword [esp + 0x14], eax
cmp ebp, 0x5c
je 0x6051c8
cmp ebp, 0x2f
jne 0x6051fe
cmp ecx, 0x12c
jae 0x605233
xor ecx, ecx
mov word [eax], cx
lea eax, [esp + 0x20]
push ecx
push eax
call edx
test eax, eax
je 0x6051f2
lea eax, [esp + 0x20]
push eax
push str._nDirectory__s_Created
call fcn.00458b75
pop ecx
pop ecx
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov word [eax], bp
inc ecx
mov eax, dword [esp + 0x1c]
inc eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x1c], eax
cmp eax, esi
jl 0x6051a7
push edi
call fcn.005205a4
pop ecx
mov ecx, dword [esp + 0x4d0]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00507778
add esp, 0x4c4
ret
call fcn.00507b37
int3

Function at 0x605239
Capabilities:
Create process on windows

Disassembly:
push 0x3c
mov eax, 0x616ce6
call fcn.00508068
mov esi, edx
mov ebx, ecx
mov dword [ebp - 4], 2
lea ecx, [ebp + 8]
xor edi, edi
mov dword [ebp - 0x48], 0x3c
push edi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], str.runas
call fcn.00452c9e
push edi
lea ecx, [ebp + 0x10]
mov dword [ebp - 0x38], eax
call fcn.00452c9e
push edi
lea ecx, [ebp + 0xc]
mov dword [ebp - 0x34], eax
call fcn.00452c9e
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
cmp esi, 1
jne 0x6052a7
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov edi, eax
cmp edi, esi
jne 0x6052d0
jmp 0x6052c3
push 1
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push dword [ebp + 8]
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jge 0x6052cd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx], eax
jmp 0x6052d0
xor edi, edi
inc edi
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00452239
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00452239
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.00452239
mov eax, edi
call fcn.00508031
ret
Function at 0x6052f9
Capabilities:
Create directory
Get session user name
Set current directory

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x194
push 0xffffffffffffffff
push 0x616d3c
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x710544]
xor eax, ebp
mov dword [ebp + 0x190], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
lea eax, [ebp]
push 0x190
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.0050c430
add esp, 0xc
mov dword [ebp - 0x24], 0xc8
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
call fcn.00605516
push eax
lea eax, [ebp]
push eax
push str.USER:_s___AdminProcess:_d
call fcn.00609aff
add esp, 0xc
call fcn.004e2479
push eax
lea ecx, [ebp - 0x10]
call fcn.00452c50
mov byte [ebp - 4], 1
call fcn.004e2479
push eax
lea ecx, [ebp - 0x14]
call fcn.00452c50
mov byte [ebp - 4], 2
call fcn.004e2479
push eax
lea ecx, [ebp - 0x20]
call fcn.00452c50
lea ecx, [ebp]
mov byte [ebp - 4], 3
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x6053b0
sub ecx, edx
lea eax, [ebp]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.00452fb2
mov edx, 0x67a106
lea ecx, [ebp + 0x19c]
call fcn.00453623
test al, al
je 0x6053f1
lea eax, [ebp + 0x19c]
push eax
lea ecx, [ebp - 0x10]
call fcn.00452dcd
jmp 0x605444
push ebx
push 0x6b2a7c
lea ecx, [ebp - 0x14]
call fcn.004527c8
test eax, eax
lea ecx, [ebp - 0x18]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x1c]
push eax
js 0x60541e
push 0x23
pop edx
call fcn.006060a2
pop ecx
pop ecx
mov byte [ebp - 4], 4
jmp 0x60542c
push 0x1c
pop edx
call fcn.006060a2
pop ecx
pop ecx
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x10]
call fcn.00452dcd
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00452239
push 0x6b2a8c
lea ecx, [ebp - 0x10]
call fcn.00452823
lea eax, [ebp - 0x1c]
push eax
call fcn.005fcfe4
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x10]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.004531cd
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.00452239
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x20]
call fcn.00452dcd
mov esi, dword [ebp - 0x20]
push esi
call fcn.005205a4
pop ecx
test eax, eax
je 0x6054ac
call fcn.00518570
cmp dword [eax], 0x11
je 0x6054ac
push esi
push str.Unable_to_create_directory:___s
call fcn.00609c05
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x6054c4
push str.Unable_to_set_working_directory
call fcn.00609c05
pop ecx
jmp 0x6054c6
mov bl, 1
lea ecx, [esi - 0x10]
call fcn.00452239
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00452239
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00452239
mov ecx, dword [ebp + 0x19c]
add ecx, 0xfffffff0
call fcn.00452239
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp + 0x190]
xor ecx, ebp
call fcn.00507778
add ebp, 0x194
leave
ret
Function at 0x605516
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x710544]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov word [ebp - 8], 0x500
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x60556a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.AllocateAndInitializeSid_Status_:__d
call fcn.00609c05
pop ecx
pop ecx
xor eax, eax
jmp 0x6055a1
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x605595
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CheckTokenMembership_Status_:__d
call fcn.00609c05
pop ecx
pop ecx
mov dword [ebp - 0x10], ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00507778
leave
ret

Function at 0x6055ae
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x210]
sub esp, 0x210
push 0xffffffffffffffff
push 0x616d7d
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x710544]
xor eax, ebp
mov dword [ebp + 0x20c], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
and dword [ebp - 4], 0
lea eax, [ebp]
push eax
mov dword [ebp - 0x18], esi
and dword [ebp - 0x10], 0
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
call fcn.004e2479
push eax
mov ecx, esi
call fcn.00452c50
and dword [ebp - 4], 0
lea eax, [ebp]
push eax
push 0x6b2a44
push esi
mov dword [ebp - 0x10], 1
call fcn.004533be
add esp, 0xc
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp + 0x20c]
xor ecx, ebp
call fcn.00507778
add ebp, 0x210
leave
ret
Function at 0x605f05
Capabilities:
Check os version
Get token membership

Disassembly:
push ebp
lea ebp, [esp - 0x15c]
sub esp, 0x15c
push 0xffffffffffffffff
push 0x616ed9
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x710544]
xor eax, ebp
mov dword [ebp + 0x158], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
mov dword [ebp], 0x114
push 0x110
lea eax, [ebp + 4]
mov dword [ebp - 0x1c], edi
push edi
push eax
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
call fcn.0050c430
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.004e2625
lea eax, [ebp - 0x10]
push eax
push 0xa
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push 4
pop ebx
test eax, eax
je 0x606027
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x606027
cmp dword [ebp + 4], 6
jb 0x605fd7
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x18]
push eax
push ebx
lea eax, [ebp - 0x20]
push eax
push 0x12
push dword [ebp - 0x10]
call esi
test eax, eax
je 0x606027
cmp dword [ebp - 0x20], 3
jne 0x605fd7
lea eax, [ebp - 0x18]
push eax
push ebx
lea eax, [ebp - 0x14]
push eax
push 0x13
push dword [ebp - 0x10]
call esi
test eax, eax
je 0x606027
cmp dword [ebp - 0x14], 0
jne 0x605ff0
lea eax, [ebp - 0x14]
push eax
push 1
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
test eax, eax
je 0x606027
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x44
push eax
lea eax, [ebp + 0x114]
push eax
push edi
push 0x1a
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
je 0x606027
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp + 0x114]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x60602d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x10], 0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x606041
push dword [ebp - 0x10]
call esi
mov dword [ebp - 0x10], edi
cmp dword [ebp - 0x14], 0
je 0x60604f
push dword [ebp - 0x14]
call esi
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], ebx
call fcn.004e2708
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x158]
xor ecx, ebp
call fcn.00507778
add ebp, 0x15c
leave
ret