joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52a490
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x9c
mov eax, dword [0x671330]
xor eax, esp
mov dword [esp + 0x98], eax
mov edx, 0x361
mov dword [esp], 0x3610300
mov dword [esp + 4], 0x4860483
lea eax, [esp + 2]
mov dword [esp + 8], 0x9030903
mov dword [esp + 0xc], 0x940093e
mov dword [esp + 0x10], 0x94c0949
mov dword [esp + 0x14], 0x9830982
mov dword [esp + 0x18], 0x9c009be
mov dword [esp + 0x1c], 0x9cc09c7
mov dword [esp + 0x20], 0x9d709d7
mov dword [esp + 0x24], 0xa400a3e
mov dword [esp + 0x28], 0xa830a83
mov dword [esp + 0x2c], 0xac00abe
mov dword [esp + 0x30], 0xacc0ac9
mov dword [esp + 0x34], 0xb030b02
mov dword [esp + 0x38], 0xb3e0b3e
mov dword [esp + 0x3c], 0xb400b40
mov dword [esp + 0x40], 0xb4c0b47
mov dword [esp + 0x44], 0xb570b57
mov dword [esp + 0x48], 0xb830b83
mov dword [esp + 0x4c], 0xbbf0bbe
mov dword [esp + 0x50], 0xbcc0bc1
mov dword [esp + 0x54], 0xbd70bd7
mov dword [esp + 0x58], 0xc030c01
mov dword [esp + 0x5c], 0xc440c41
mov dword [esp + 0x60], 0xc830c82
mov dword [esp + 0x64], 0xcbe0cbe
mov dword [esp + 0x68], 0xcc40cc0
mov dword [esp + 0x6c], 0xccb0cc7
mov dword [esp + 0x70], 0xcd60cd5
mov dword [esp + 0x74], 0xd030d02
mov dword [esp + 0x78], 0xd400d3e
mov dword [esp + 0x7c], 0xd4c0d46
mov dword [esp + 0x80], 0xd570d57
mov dword [esp + 0x84], 0xf7f0f7f
mov dword [esp + 0x88], 0x20e120d0
mov dword [esp + 0x8c], 0x309a3099
mov dword [esp + 0x90], 0xfe23fe20
mov dword [esp + 0x94], 0xffffffff
cmp dx, cx
jae 0x52a5fb
add eax, 4
cmp word [eax], cx
jb 0x52a5f3
sub eax, 2
cmp cx, word [eax]
jb 0x52a620
cmp cx, word [eax + 2]
ja 0x52a620
mov al, 1
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.00544286
add esp, 0x9c
ret
mov ecx, dword [esp + 0x98]
xor al, al
xor ecx, esp
call fcn.00544286
add esp, 0x9c
ret
Function at 0x53a920
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dc39e
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x671330]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x671318]
cmp eax, 0xffffffff
jne 0x53a956
xor ebx, ebx
jmp 0x53a95f
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x53a9a1
nop dword [eax]
cmp dword [ebx + 0x18], 0
mov esi, dword [ebx + 0xc]
jne 0x53a9e0
test esi, esi
jne 0x53a9e4
push 0x539d00
push 0x6839e8
call fcn.005399f0
mov eax, dword [0x671318]
add esp, 8
cmp eax, 0xffffffff
je 0x53a9a1
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [ebp - 4], 1
test ebx, ebx
je 0x53a9ce
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x53a9ce
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x53aa26
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x53aa0f
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x53a9e4
cmp dword [ebx + 0x18], 0
je 0x53a970
mov esi, dword [ebx + 0x14]
mov esi, dword [esi]
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x53aa49
mov edx, dword [esi + 0x1c]
test edx, edx
je 0x53aa49
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebx + 0x14]
call fcn.004bfab0
cmp dword [ebx + 0x18], 0
jne 0x53aa30
jmp 0x53a970

Function at 0x53aa70
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push edi
mov edi, ecx
mov edx, dword [edi]
lea eax, [edx + 0x10]
push eax
push 4
push edx
push 0x53aad0
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x53aa9a
pop edi
xor al, al
pop ebx
ret
mov eax, dword [edi]
push esi
add eax, 4
lock inc dword [eax]
mov esi, dword [edi]
mov eax, dword [esi + 8]
test eax, eax
je 0x53aab8
cmp eax, 0xffffffff
je 0x53aab8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], ebx
mov eax, dword [edi]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
pop edi
mov al, 1
pop ebx
ret
Function at 0x53d0f0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dc8d8
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x671330]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
cmp dword [edi + 0x14], 8
jb 0x53d12b
mov eax, dword [edi]
jmp 0x53d12d
mov eax, edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x53d153
test esi, esi
je 0x53d14c
mov dword [esi], 0
call fcn.00505aa0
mov dword [esi + 4], eax
mov al, 1
jmp 0x53d1e1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0x64], 0
call fcn.00505aa0
mov dword [ebp - 0x60], eax
cmp ebx, 0xb7
jne 0x53d19f
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x6c]
push edi
push eax
call fcn.0053e870
add esp, 0xc
cmp dword [ebp - 0x6c], 3
sete al
test al, al
je 0x53d19f
test esi, esi
je 0x53d1df
mov dword [esi], 0
call fcn.00505aa0
jmp 0x53d1dc
test esi, esi
jne 0x53d1d5
push str.boost::filesystem::create_directory
lea ecx, [ebp - 0x28]
call fcn.0040bdb0
mov dword [ebp - 4], esi
call fcn.00505aa0
push eax
push ebx
push edi
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x5c]
call fcn.0053cc30
push 0x62ee18
lea eax, [ebp - 0x5c]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
call fcn.00505aa0
mov dword [esi], ebx
mov dword [esi + 4], eax
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00544286
mov esp, ebp
pop ebp
ret
Function at 0x53e5a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp dword [esi + 0x14], 8
jb 0x53e5b3
mov eax, dword [esi]
jmp 0x53e5b5
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x53e5dd
push dword [esp + 0x18]
lea eax, [esp + 0xc]
push esi
push eax
call fcn.0053e490
add esp, 0xc
mov eax, dword [eax]
pop esi
pop ebx
add esp, 8
ret
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x53e5f4
mov dword [edi], 0
call fcn.00505aa0
mov dword [edi + 4], eax
pop edi
test ebx, 0x400
je 0x53e62b
push esi
call fcn.0053def0
add esp, 4
test al, al
je 0x53e620
test bl, 0x10
mov eax, 4
mov ecx, 0xb
pop esi
cmovne eax, ecx
pop ebx
add esp, 8
ret
pop esi
mov eax, 9
pop ebx
add esp, 8
ret
and ebx, 0x10
or ebx, 0x20
shr ebx, 4
pop esi
mov eax, ebx
pop ebx
add esp, 8
ret

Function at 0x53e6b0
Capabilities:
Check if file exists
Delete directory

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x14], 8
jb 0x53e6bc
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x53e6fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x53e6fa
cmp eax, 3
je 0x53e6fa
cmp eax, 0x7b
je 0x53e6fa
cmp eax, 0xf
je 0x53e6fa
cmp eax, 0x15
je 0x53e6fa
cmp eax, 0x57
je 0x53e6fa
cmp eax, 0xa1
je 0x53e6fa
cmp eax, 0x35
je 0x53e6fa
xor al, al
ret
mov al, 1
ret

Function at 0x53e700
Capabilities:
Check if file exists
Delete file

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x14], 8
jb 0x53e70c
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x53e74a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x53e74a
cmp eax, 3
je 0x53e74a
cmp eax, 0x7b
je 0x53e74a
cmp eax, 0xf
je 0x53e74a
cmp eax, 0x15
je 0x53e74a
cmp eax, 0x57
je 0x53e74a
cmp eax, 0xa1
je 0x53e74a
cmp eax, 0x35
je 0x53e74a
xor al, al
ret
mov al, 1
ret
Function at 0x53e870
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dcc82
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x671330]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x34], esi
cmp dword [edi + 0x14], 8
jb 0x53e8b1
mov eax, dword [edi]
jmp 0x53e8b3
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x38], eax
cmp eax, 0xffffffff
jne 0x53e8d2
push esi
push edi
push ebx
call fcn.0053e490
add esp, 0xc
jmp 0x53e9ce
test eax, 0x400
je 0x53e98d
cmp dword [edi + 0x14], 8
jb 0x53e8e7
mov eax, dword [edi]
jmp 0x53e8e9
mov eax, edi
push eax
lea ecx, [ebp - 0x28]
call fcn.004644b0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push 0x2000000
push 3
push 0
push 7
push 0
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x2c], esi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.004231c0
cmp esi, 0xffffffff
jne 0x53e942
push dword [ebp - 0x34]
push edi
push ebx
call fcn.0053e490
add esp, 0xc
jmp 0x53e9ce
push edi
call fcn.0053def0
add esp, 4
test al, al
jne 0x53e975
mov eax, dword [ebp - 0x38]
push eax
push edi
call fcn.0053e0d0
add esp, 8
mov dword [ebx], 9
mov dword [ebx + 4], eax
push esi
mov dword [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x53e9ce
push esi
mov dword [ebp - 4], 5
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x34]
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x53e99f
mov dword [esi], 0
call fcn.00505aa0
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x30], 3
push eax
push edi
test al, 0x10
jne 0x53e9b6
mov dword [ebp - 0x30], 2
call fcn.0053e0d0
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x2c], eax
mov eax, dword [ecx]
add esp, 8
mov dword [ebx], eax
mov eax, dword [ecx + 4]
mov dword [ebx + 4], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00544286
mov esp, ebp
pop ebp
ret
Function at 0x53e9f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [esp + 0x18]
cmp dword [esi + 0x14], 8
jb 0x53ea03
mov eax, dword [esi]
jmp 0x53ea05
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x53ea2d
push dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x1c]
push esi
call fcn.0053e490
add esp, 0xc
mov eax, esi
pop esi
pop ebx
add esp, 8
ret
push edi
mov edi, dword [esp + 0x20]
test edi, edi
je 0x53ea44
mov dword [edi], 0
call fcn.00505aa0
mov dword [edi + 4], eax
pop edi
test ebx, 0x400
je 0x53ea6e
push esi
call fcn.0053def0
add esp, 4
mov dword [esp + 8], 4
push ebx
push esi
test al, al
jne 0x53ea85
mov dword [esp + 0x10], 9
jmp 0x53ea85
mov dword [esp + 8], 3
push ebx
push esi
test bl, 0x10
jne 0x53ea85
mov dword [esp + 0x10], 2
call fcn.0053e0d0
mov dword [esp + 0x14], eax
lea edx, [esp + 0x10]
mov eax, dword [esp + 0x1c]
add esp, 8
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 4]
pop esi
mov dword [eax + 4], ecx
pop ebx
add esp, 8
ret
Function at 0x53edd0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dcd56
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x671330]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push 0
push 0
push ebx
mov dword [ebp - 0x50], 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push eax
lea ecx, [ebp - 0x4c]
call fcn.00462690
mov edi, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x48]
cmp edi, ecx
mov dword [ebp - 4], 0
sete al
test al, al
jne 0x53ee55
sub ecx, edi
sar ecx, 1
push ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x53ee55
push edi
lea ecx, [ebp - 0x40]
call fcn.0040b2a0
mov ecx, eax
mov ebx, 1
jmp 0x53ee6f
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x28]
mov word [ebp - 0x28], ax
lea ebx, [eax + 2]
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
cmp dword [esi + 0x14], 8
mov byte [ebp - 4], 2
jb 0x53ee8b
mov eax, dword [esi]
jmp 0x53ee8d
mov eax, esi
xor edx, edx
push ecx
mov ecx, esi
mov word [eax], dx
call fcn.004096f0
or ebx, 4
test bl, 2
je 0x53eed4
and ebx, 0xfffffffd
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 3
cmp eax, 8
jb 0x53eec0
inc eax
push 2
push eax
push dword [ebp - 0x28]
call fcn.0040b970
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
test bl, 1
je 0x53ef08
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 4
cmp eax, 8
jb 0x53eef4
inc eax
push 2
push eax
push dword [ebp - 0x40]
call fcn.0040b970
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
mov dword [ebp - 4], 5
test edi, edi
je 0x53ef26
mov ecx, dword [ebp - 0x44]
sub ecx, edi
push 2
sar ecx, 1
push ecx
push edi
call fcn.0040b970
add esp, 0xc
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00544286
mov esp, ebp
pop ebp
ret
Function at 0x53f190
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dce0e
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x671330]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
push 0xffffffffffffffff
push ecx
mov word [ebp - 0x5c], cx
lea ecx, [ebp - 0x5c]
push eax
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x48], 7
mov dword [ebp - 0x4c], 0
call fcn.0040ab20
movups xmm0, xmmword [str.0123456789abcdef]
mov ax, word [0x5f86f4]
xor ebx, ebx
mov ecx, dword [ebp - 0x4c]
mov edx, 0x20
mov dword [ebp - 4], 0
mov word [ebp - 0x24], ax
movups xmmword [ebp - 0x44], xmm0
movups xmm0, xmmword [0x5f86e4]
movups xmmword [ebp - 0x34], xmm0
movups xmm0, xmmword [str.123456789abcdef]
movups xmmword [ebp - 0x20], xmm0
test ecx, ecx
je 0x53f2ea
cmp dword [ebp - 0x48], 8
lea eax, [ebp - 0x5c]
cmovae eax, dword [ebp - 0x5c]
cmp word [eax + ebx*2], 0x25
jne 0x53f2de
cmp edx, 0x20
jne 0x53f2a9
lea eax, [ebp - 0x60]
push eax
call fcn.0053f060
mov esi, eax
add esp, 4
test esi, esi
jne 0x53f289
lea eax, [ebp - 0x20]
push eax
push 0x10
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x53f27a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push 0
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test esi, esi
je 0x53f293
push edi
push esi
call fcn.0053f0d0
add esp, 8
test edi, edi
je 0x53f2a7
xor ecx, ecx
mov eax, fcn.00402a20
cmp dword [edi], ecx
cmove eax, ecx
test eax, eax
jne 0x53f314
xor edx, edx
mov cl, dl
and cl, 1
shl cl, 2
mov eax, edx
test eax, eax
jns 0x53f2ba
add eax, 1
sar eax, 1
movsx eax, byte [ebp + eax - 0x20]
inc edx
sar eax, cl
lea ecx, [ebp - 0x5c]
cmp dword [ebp - 0x48], 8
cmovae ecx, dword [ebp - 0x5c]
and eax, 0xf
mov ax, word [ebp + eax*2 - 0x44]
mov word [ecx + ebx*2], ax
mov ecx, dword [ebp - 0x4c]
inc ebx
cmp ebx, ecx
jb 0x53f232
mov esi, dword [ebp - 0x64]
test edi, edi
je 0x53f2fc
mov dword [edi], 0
call fcn.00505aa0
mov dword [edi + 4], eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
cmp dword [esi + 0x14], 8
jb 0x53f330
mov eax, dword [esi]
jmp 0x53f332
mov ecx, dword [ebp - 0x64]
push 0
push 0x6091d8
call fcn.0053ef50
lea ecx, [ebp - 0x5c]
call fcn.0040a7f0
mov eax, dword [ebp - 0x64]
jmp 0x53f365
mov eax, esi
xor ecx, ecx
push 0xffffffffffffffff
mov word [eax], cx
lea eax, [ebp - 0x5c]
push ecx
push eax
mov ecx, esi
call fcn.0040ab20
mov eax, dword [ebp - 0x48]
mov dword [ebp - 4], 1
cmp eax, 8
jb 0x53f363
push 2
inc eax
push eax
push dword [ebp - 0x5c]
call fcn.0040b970
add esp, 0xc
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00544286
mov esp, ebp
pop ebp
ret
Function at 0x53fa40
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x671330]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push eax
push 0
push 0x400
xor bl, bl
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x53fb26
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push 2
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x53fb18
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 2
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
test eax, eax
je 0x53fb0e
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xc], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
mov word [ebp - 8], 0x500
push eax
mov dword [ebp - 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x53fb0e
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
cmp dword [ebp - 0x18], 0
push dword [ebp - 0x1c]
setne bl
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x53fb18
push eax
call edi
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x53fb22
push ecx
call edi
push esi
call edi
pop edi
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.00544286
mov esp, ebp
pop ebp
ret
Function at 0x541000
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x54101c
test al, 0x10
je 0x54101c
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x5416c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x5416dc
test al, 0x10
jne 0x5416dc
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x5416e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x334
mov eax, dword [0x671330]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push eax
lea eax, [ebp - 0x330]
mov dword [ebp - 0x334], 0
push eax
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64_s]
push 0x208
mov edi, eax
lea eax, [ebp - 0x30c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x14
test edi, edi
jne 0x541752
lea eax, [ebp - 0x330]
push eax
push str._Y__m__d__H:_M:_S
lea eax, [ebp - 0x30c]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_wcsftime]
add esp, 0x10
jmp 0x541788
push 0x100
lea eax, [ebp - 0x104]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push edi
lea eax, [ebp - 0x104]
push 0x80
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wcserror_s]
add esp, 0x18
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
cmp word [ebp - 0x30c], ax
jne 0x5417a8
xor ecx, ecx
jmp 0x5417c0
lea ecx, [ebp - 0x30c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5417b1
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x30c]
mov ecx, esi
push eax
call fcn.0040b190
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00544286
mov esp, ebp
pop ebp
ret

Function at 0x541f40
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x671330]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
push ebx
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push eax
movlpd qword [ebp - 0xc], xmm0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x541fb0
push esi
push edi
lea eax, [ebp - 0xc]
xorps xmm0, xmm0
push eax
push ebx
movq qword [ebp - 0xc], xmm0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov edi, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov edx, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00544286
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
xor ecx, ebp
mov edx, dword [ebp - 8]
pop ebx
call fcn.00544286
mov esp, ebp
pop ebp
ret
Function at 0x541fd0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x671330]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x14], eax
xor esi, esi
lea eax, [ebp - 0xc]
mov dword [ebp - 8], ecx
push eax
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x542067
push edi
push ebx
call fcn.00544079
mov edi, eax
add esp, 4
test edi, edi
je 0x542054
push edi
push ebx
push esi
push dword [ebp - 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x54204b
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
lea eax, [ebp - 0x10]
push eax
push 0x5f8474
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x54204b
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov esi, dword [ecx + 0x10]
test eax, eax
je 0x54204b
mov ecx, dword [ecx + 0x14]
mov dword [eax], ecx
push edi
call fcn.00544082
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00544286
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00544286
mov esp, ebp
pop ebp
ret