joyce8/EMBER2024-capa huggingface dataset:
Function at 0x60a920
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x3c
mov esi, dword [ebp + 8]
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
lea edi, [ebp - 0x1c]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ecx, edi
push eax
call fcn.005372d0
pcmpeqd xmm0, xmm0
lea ebx, [ebp - 0x48]
movdqu xmmword [ebx + 0x1c], xmm0
movdqu xmmword [ebx + 0x10], xmm0
movdqu xmmword [ebx], xmm0
push edi
push ebx
call fcn.00614c20
add esp, 8
cmp byte [ebx + 0x28], 1
je 0x60a9a2
movsx eax, byte [ebp - 0x11]
test eax, eax
cmovs eax, dword [ebp - 0x18]
cmovs edi, dword [ebp - 0x1c]
test eax, eax
js 0x60a9dd
sete cl
test edi, edi
setne dl
or dl, cl
je 0x60a9dd
push eax
push edi
push esi
call fcn.00648eb0
add esp, 0xc
jmp 0x60a9aa
mov ecx, esi
push ebx
call fcn.004bc9d0
cmp byte [ebp - 0x20], 1
jne 0x60a9b8
lea ecx, [ebp - 0x48]
call fcn.004bcbc0
cmp byte [ebp - 0x11], 0
jns 0x60a9c9
push dword [ebp - 0x1c]
call fcn.005c8b90
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9f16
mov eax, esi
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
ud2

Function at 0x612a10
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x14
mov esi, dword [ebp + 8]
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [ebp - 8], eax
xor ecx, ecx
lea eax, [ebp - 0x10]
mov dword [eax], ecx
mov word [eax + 4], 0x500
lea edx, [ebp - 0x14]
mov dword [edx], ecx
sub esp, 0x2c
mov dword [esp + 0x28], edx
mov dword [esp + 0x24], ecx
xorps xmm0, xmm0
movups xmmword [esp + 0x14], xmm0
movaps xmm0, xmmword [0x786a30]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x612aa5
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x18]
mov dword [ecx], 0
push ecx
push dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x612acc
cmp dword [ebp - 0x18], 0
setne byte [esi]
xor eax, eax
inc eax
mov dword [esi + 4], eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.005c9f16
mov eax, esi
add esp, 0x14
pop esi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0x80004005
cmovne eax, ecx
mov dword [esi], eax
mov dword [esi + 4], 2
jmp 0x612a93
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0x80004005
cmovne eax, ecx
mov dword [esi], eax
mov eax, 2
jmp 0x612a87
Function at 0x612b00
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov ebx, dword [ebp + 8]
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x14]
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push esi
push 0x20008
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x612ba7
mov eax, dword [ebp - 0x14]
xor ebx, ebx
lea edi, [ebp - 0x18]
mov dword [edi], ebx
mov ecx, edi
push eax
call fcn.005375e0
xor eax, eax
inc eax
lea esi, [ebp - 0x1c]
mov dword [esi], eax
lea eax, [ebp - 0x20]
mov dword [eax], ebx
mov ebx, dword [ebp + 8]
push eax
push 4
push esi
push 0x12
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
setne al
cmp dword [esi], 3
sete cl
and cl, al
mov byte [ebx], cl
xor eax, eax
inc eax
mov dword [ebx + 4], eax
mov eax, dword [edi]
inc eax
cmp eax, 2
jb 0x612b93
call fcn.005613d0
push dword [ebp - 0x18]
call fcn.0054cbb0
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9f16
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0x80004005
cmovne eax, ecx
mov dword [ebx], eax
mov dword [ebx + 4], 2
jmp 0x612b93
Function at 0x615260
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x44
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
lea edi, [ebp - 0x3c]
mov dword [edi + 0x24], eax
mov dword [edi + 0x20], eax
pcmpeqd xmm0, xmm0
movdqu xmmword [edi + 0x10], xmm0
movdqu xmmword [edi], xmm0
mov ecx, edi
push 0x200
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push SysReAllocStringLen
call fcn.0063eca0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x4c], eax
jmp 0x6152dc
lea ecx, [ebp - 0x3c]
call fcn.0054ccf0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9f16
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret
push dword [ebp - 0x48]
call fcn.005c8b90
add esp, 4
mov ecx, edi
call fcn.004a7220
mov ecx, edi
call fcn.004a7200
test al, al
je 0x6152b0
xor eax, eax
dec eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
cmp byte [ebp - 0x29], 0
lea eax, [ebp - 0x34]
jns 0x6152ff
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x48]
push eax
call fcn.005372d0
mov esi, dword [ebp + 8]
movsx eax, byte [esi + 0xb]
test eax, eax
jns 0x61531b
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
test eax, eax
js 0x61538b
sete dl
test esi, esi
setne dh
or dh, dl
je 0x61538b
movsx edx, byte [ebp - 0x3d]
test edx, edx
cmovs edx, dword [ebp - 0x44]
mov ebx, dword [ebp - 0x48]
lea ecx, [ebp - 0x48]
cmovns ebx, ecx
test edx, edx
js 0x61538b
sete cl
test ebx, ebx
setne ch
or ch, cl
je 0x61538b
push 0
push eax
push esi
push edx
push ebx
call fcn.0054e6b0
add esp, 0x14
test al, al
je 0x61537c
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x4c]
call dword [0x8072c0]
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x48]
push edx
push eax
call ecx
add esp, 8
cmp byte [ebp - 0x3d], 0
jns 0x6152d5
jmp 0x6152ca
ud2
Function at 0x6157c0
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb0
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor ebx, ebx
push 3
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
lea esi, [ebp - 0x14]
mov dword [esi], ebx
mov ecx, esi
push eax
call fcn.00618050
mov eax, dword [esi]
test eax, eax
jne 0x61580c
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9f16
mov eax, ebx
add esp, 0xb0
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, dword [ebp + 8]
cmp byte [edi + 0xb], 0
mov ecx, edi
jns 0x615819
mov ecx, dword [edi]
push 0x10000
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
lea esi, [ebp - 0x18]
mov dword [esi], 0
mov ecx, esi
push eax
call fcn.00618050
mov eax, dword [esi]
mov bl, 1
test eax, eax
je 0x615858
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x615858
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x430
sete bl
lea esi, [ebp - 0xb8]
mov ecx, esi
push str.SoftwareGoogleUpdate_
call fcn.005372d0
push edi
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00612970
add esp, 0xc
cmp byte [esi + 0xb], 0
jns 0x615899
push dword [ebp - 0xb8]
mov byte [ebp - 0xb9], al
call fcn.005c8b90
mov al, byte [ebp - 0xb9]
add esp, 4
test al, al
jne 0x6158d0
xor ebx, ebx
cmp dword [ebp - 0x18], 0
je 0x6158b3
call fcn.005613d0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 0x14], 0
je 0x6157f5
call fcn.005613d0
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x6157f5
push 0x26
push str.....chromeupdaterutilwin_util.cc
call fcn.00560ce0
add esp, 8
test eax, eax
jle 0x61589f
lea ecx, [ebp - 0xb8]
push 0xffffffffffffffff
push 0x4a1
push str.....chromeupdaterutilwin_util.cc
call fcn.004ba0e0
lea eax, [ebp - 0xb0]
push 0xd
push 0x786e2e
push eax
call fcn.00535510
add esp, 0xc
mov esi, 2
mov ecx, 0x77d14e
push esi
push ecx
push eax
call fcn.00535510
add esp, 0xc
push edi
push eax
call fcn.004b54f0
add esp, 8
push esi
mov ecx, 0x77d14e
push ecx
push eax
call fcn.00535510
add esp, 0xc
movzx edx, bl
mov ecx, eax
push edx
call fcn.00410b80
lea ecx, [ebp - 0xb8]
call fcn.004ba5c0
jmp 0x61589f
Function at 0x61dbe0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x28
mov esi, dword [ebp + 8]
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [ebp - 0xc], eax
xorps xmm0, xmm0
lea edi, [ebp - 0x2c]
movups xmmword [edi + 0x10], xmm0
movups xmmword [edi], xmm0
lea eax, [ebp - 0x30]
mov dword [eax], 0x10
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
xorps xmm0, xmm0
movsd qword [esi], xmm0
mov dword [esi + 8], 0
test eax, eax
je 0x61dc32
push esi
push dword [ebp - 0x30]
push edi
call fcn.004b5460
add esp, 0xc
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.005c9f16
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebp
ret

Function at 0x61ddc0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xcc
mov edi, dword [ebp + 8]
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x14], eax
xorps xmm0, xmm0
movups xmmword [ebp - 0x24], xmm0
movups xmmword [ebp - 0x34], xmm0
cmp byte [edi + 0xb], 0
mov ecx, edi
jns 0x61ddf3
mov ecx, dword [edi]
lea edx, [ebp - 0x34]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x61de8a
push edi
call fcn.004ad2f0
add esp, 4
movzx eax, al
xor eax, 5
cmp byte [edi + 0xb], 0
mov ecx, edi
jns 0x61de20
mov ecx, dword [edi]
push eax
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x61def4
push 0x3a
push str.....chromeinstallerutildelete_after_reboot_helper.cc
call fcn.00560ce0
add esp, 8
mov bl, 1
test eax, eax
jle 0x61dedd
lea esi, [ebp - 0xd8]
mov ecx, esi
push 0xffffffffffffffff
push 0x64
push str.....chromeinstallerutildelete_after_reboot_helper.cc
call fcn.004ba0e0
lea eax, [ebp - 0xd0]
push 0x18
push str.Scheduled_for_deletion:
push eax
call fcn.00535510
add esp, 0xc
push edi
push eax
call fcn.004b54f0
add esp, 8
mov ecx, esi
call fcn.004ba5c0
jmp 0x61dedd
push 1
call fcn.00560ca0
add esp, 4
test al, al
je 0x61dedb
call fcn.00646ae0
lea esi, [ebp - 0xd8]
mov ecx, esi
push eax
push 1
push 0x45
push str.....chromeinstallerutildelete_after_reboot_helper.cc
call fcn.00646c90
lea eax, [ebp - 0xd0]
push edi
push eax
call fcn.004b54f0
add esp, 8
push 0x10
push str._does_not_exist.
push eax
call fcn.00535510
add esp, 0xc
mov ecx, esi
call fcn.00646cf0
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9f16
mov eax, ebx
add esp, 0xcc
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.00560ca0
add esp, 4
test al, al
je 0x61dedb
call fcn.00646ae0
lea esi, [ebp - 0xd8]
mov ecx, esi
push eax
push 2
push 0x50
push str.....chromeinstallerutildelete_after_reboot_helper.cc
call fcn.00646c90
lea eax, [ebp - 0xd0]
push 0x13
push str.Could_not_schedule
push eax
call fcn.00535510
add esp, 0xc
push edi
push eax
call fcn.004b54f0
add esp, 8
push 0xe
push str._for_deletion.
jmp 0x61decb
Function at 0x6223f0
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x622469
mov edi, ecx
lea esi, [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov bl, 1
test eax, eax
jne 0x62243e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push 1
call fcn.00560ca0
add esp, 4
test al, al
jne 0x62246d
cmp ebx, 0x430
sete bl
cmp dword [esi], 0
je 0x622450
call fcn.005613d0
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9f16
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret 4
xor ebx, ebx
jmp 0x622450
call fcn.00646ae0
lea ecx, [ebp - 0xb4]
push eax
push 1
push 0x264
push str.....chromeinstallerutilinstall_service_work_item_impl.cc
call fcn.00646c90
lea eax, [ebp - 0xac]
push 0x15
push str.DeleteService_failed
push eax
call fcn.00535510
add esp, 0xc
mov dword [ebp - 0xc4], eax
lea eax, [ebp - 0xc0]
mov ecx, edi
mov edi, eax
push eax
call fcn.00622120
mov eax, edi
cmp byte [edi + 0xb], 0
jns 0x6224c4
mov eax, dword [ebp - 0xc0]
push eax
push dword [ebp - 0xc4]
call fcn.00645040
add esp, 8
cmp byte [ebp - 0xb5], 0
jns 0x6224ea
push dword [ebp - 0xc0]
call fcn.005c8b90
add esp, 4
lea ecx, [ebp - 0xb4]
call fcn.00646cf0
jmp 0x622435

Function at 0x622c90
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov dword [ebp - 0xc4], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [0x80e040]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
movsx edx, byte [eax + 0x33]
test edx, edx
js 0x622cbd
lea ecx, [eax + 0x28]
jmp 0x622cc3
mov edx, dword [eax + 0x2c]
mov ecx, dword [eax + 0x28]
test edx, edx
cmove ecx, edx
mov edi, dword [eax + 0x1c]
xor edx, edx
cmp edi, dword [eax + 0x20]
cmove edi, edx
movsx esi, byte [eax + 0x1b]
test esi, esi
js 0x622ce0
lea ebx, [eax + 0x10]
jmp 0x622ce6
mov esi, dword [eax + 0x14]
mov ebx, dword [eax + 0x10]
test esi, esi
cmove ebx, esi
push ecx
push edx
push edx
push edi
push edx
push edx
push ebx
push dword [eax + 0xc]
push dword [eax + 8]
push dword [eax + 4]
mov eax, dword [ebp - 0xc4]
push dword [eax + 0x98]
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov edi, eax
test eax, eax
jne 0x622d21
push 1
call fcn.00560ca0
add esp, 4
test al, al
jne 0x622d3f
test edi, edi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9f16
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.00646ae0
lea ecx, [ebp - 0xb4]
push eax
push 1
push 0x1a6
push str.....chromeinstallerutilinstall_service_work_item_impl.cc
call fcn.00646c90
lea eax, [ebp - 0xac]
push 0x20
push str.Failed_to_change_service_config
push eax
call fcn.00535510
add esp, 0xc
mov ebx, eax
lea esi, [ebp - 0xc0]
mov ecx, dword [ebp - 0xc4]
push esi
call fcn.00622120
cmp byte [esi + 0xb], 0
jns 0x622d92
mov esi, dword [ebp - 0xc0]
push esi
push ebx
call fcn.00645040
add esp, 8
cmp byte [ebp - 0xb5], 0
jns 0x622db3
push dword [ebp - 0xc0]
call fcn.005c8b90
add esp, 4
lea ecx, [ebp - 0xb4]
call fcn.00646cf0
jmp 0x622d21
Function at 0x623160
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xd0
mov dword [ebp - 0xc8], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [0x80e040]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0xffffffff
mov ebx, dword [eax + 0x1c]
xor ecx, ecx
cmp ebx, dword [eax + 0x20]
cmove ebx, ecx
cmp byte [eax + 0x1b], 0
js 0x62319d
lea ecx, [eax + 0x10]
jmp 0x6231a0
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0xd0], ecx
cmp byte [eax + 0x33], 0
js 0x6231b1
lea ecx, [eax + 0x28]
jmp 0x6231b4
mov ecx, dword [eax + 0x28]
mov dword [ebp - 0xcc], ecx
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xd8], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0xdc], ecx
mov eax, dword [eax + 8]
mov dword [ebp - 0xd4], eax
lea edi, [ebp - 0xb8]
mov ecx, dword [ebp - 0xc8]
push edi
call fcn.00622120
cmp byte [edi + 0xb], 0
jns 0x6231f3
mov edi, dword [ebp - 0xb8]
xor esi, esi
push esi
push esi
push ebx
push esi
push esi
push dword [ebp - 0xd0]
push dword [ebp - 0xd8]
push dword [ebp - 0xd4]
push dword [ebp - 0xdc]
push 0x10003
push dword [ebp - 0xcc]
push edi
mov eax, dword [ebp - 0xc8]
push dword [eax + 0x94]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
lea ecx, [ebp - 0x14]
mov dword [ecx], esi
push eax
call fcn.00618050
cmp byte [ebp - 0xad], 0
jns 0x623252
push dword [ebp - 0xb8]
call fcn.005c8b90
add esp, 4
mov ebx, dword [ebp - 0x14]
test ebx, ebx
jne 0x623299
push 1
call fcn.00560ca0
add esp, 4
test al, al
jne 0x6232bb
cmp dword [ebp - 0x14], 0
je 0x62327b
call fcn.005613d0
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebx, ebx
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9f16
mov eax, ebx
add esp, 0xd0
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, dword [ebp - 0xc8]
add esi, 0x98
mov dword [ebp - 0x14], 0
call fcn.005613d0
mov ecx, esi
push ebx
call fcn.00618050
jmp 0x623267
call fcn.00646ae0
lea ecx, [ebp - 0xb8]
push eax
push 1
push 0x255
push str.....chromeinstallerutilinstall_service_work_item_impl.cc
call fcn.00646c90
lea eax, [ebp - 0xb0]
push 0x19
push str.Failed_to_create_service
push eax
call fcn.00535510
add esp, 0xc
mov edi, eax
lea esi, [ebp - 0xc4]
mov ecx, dword [ebp - 0xc8]
push esi
call fcn.00622120
cmp byte [esi + 0xb], 0
jns 0x62330e
mov esi, dword [ebp - 0xc4]
push esi
push edi
call fcn.00645040
add esp, 8
cmp byte [ebp - 0xb9], 0
jns 0x62332f
push dword [ebp - 0xc4]
call fcn.005c8b90
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.00646cf0
jmp 0x623267
Function at 0x6410f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 4], 1
je 0x641112
mov eax, dword [esi]
jmp 0x641118
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x64115e
mov bl, 1
cmp byte [ebp + 0xc], 0
je 0x641148
cmp byte [esi + 4], 1
je 0x641136
mov eax, dword [esi]
jmp 0x64113c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9f16
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [esi + 4], 1
je 0x64116e
mov eax, dword [esi]
jmp 0x641174
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x641188
xor ebx, ebx
jmp 0x641148
mov dword [ebp - 0x14], 0xffffffff
cmp byte [esi + 4], 1
je 0x641199
mov eax, dword [esi]
jmp 0x64119f
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov bl, 1
jmp 0x641148

Function at 0x6412c0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
lea edi, [ecx + 0xc]
lea eax, [ecx + 0x10]
push 0x228
push 0
push eax
call fcn.005cced0
add esp, 0xc
mov dword [esi + 0xc], 0x22c
cmp byte [esi + 8], 0
jne 0x6412f9
mov byte [esi + 8], 1
push edi
push dword [esi + 4]
call sub.KERNEL32.dll_Process32FirstW
jmp 0x641302
push edi
push dword [esi + 4]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
setne al
pop esi
pop edi
pop ebp
ret
Function at 0x641420
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xb0
mov ebx, edx
mov dword [esp + 0xc], ecx
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [esp + 0xa8], eax
mov dword [esp + 0x20], 0xb
mov eax, dword [0x78ef14]
mov al, byte [eax + 0xb]
test al, al
jne 0x641649
xor edi, edi
dec edi
mov dword [esp + 0x98], edi
mov dword [esp + 0x9c], edi
mov dword [esp + 0xa0], edi
lea esi, [esp + 0x50]
mov ecx, ebx
push esi
call fcn.004bcef0
cmp byte [esi + 0xb], 0
mov dword [esp + 8], ebx
js 0x64150f
mov eax, dword [esp + 0x58]
mov dword [esp + 0xa0], eax
movq xmm0, qword [esp + 0x50]
movq qword [esp + 0x98], xmm0
lea ebx, [esp + 0x50]
mov ecx, ebx
call fcn.005617f0
lea esi, [esp + 0x8c]
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov edi, ebx
mov ecx, dword [esp + 8]
push esi
call fcn.00648ff0
pxor xmm0, xmm0
movq qword [ebx + 0x34], xmm0
pxor xmm0, xmm0
movdqu xmmword [ebx + 0x24], xmm0
mov dword [ebx], 0x3c
mov dword [ebx + 4], 0x40
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], str.runas
cmp byte [esp + 0xa3], 0
js 0x641525
lea ecx, [esp + 0x98]
jmp 0x64152c
lea ecx, [esp + 0x98]
push dword [esp + 0x54]
push dword [esp + 0x54]
call fcn.00535800
jmp 0x6414a7
mov ecx, dword [esp + 0x98]
mov al, byte [ebp + 8]
mov dword [esp + 0x60], ecx
cmp byte [esp + 0x97], 0
jns 0x641544
mov esi, dword [esp + 0x8c]
mov dword [esp + 0x64], esi
xor esi, esi
mov dword [esp + 0x68], esi
xor al, 1
movzx eax, al
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], esi
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x6415c5
cmp byte [ebp + 0xc], 0
je 0x6415be
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x20]
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea esi, [esp + 0x10]
push 0x9e
push str....._baseprocesslaunch_win.cc
push str.LaunchElevatedProcess
push esi
call fcn.005613a0
add esp, 0x10
mov ecx, ebx
push 0
push esi
call fcn.005546a0
push 0xffffffffffffffff
push dword [esp + 0x8c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, ebx
call fcn.00554710
mov esi, dword [esp + 0x88]
mov ecx, dword [esp + 0xc]
push esi
call fcn.004a90a0
cmp byte [esp + 0x97], 0
jns 0x6415e8
push dword [esp + 0x8c]
call fcn.005c8b90
add esp, 4
cmp byte [esp + 0xa3], 0
jns 0x641601
push dword [esp + 0x98]
call fcn.005c8b90
add esp, 4
mov dword [esp + 0x20], 0xb
mov eax, dword [0x78ef14]
mov al, byte [eax + 0xb]
test al, al
jne 0x64162b
mov ecx, dword [esp + 0xa8]
xor ecx, ebp
call fcn.005c9f16
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
movzx eax, al
mov dword [esp + 0x50], 0
lea ecx, [esp + 0x20]
push 2
push edi
push ecx
push eax
call fcn.00544ed0
add esp, 0x10
jmp 0x641615
movzx eax, al
lea ecx, [esp + 0x50]
mov dword [ecx], str.LaunchElevatedProcess
lea edx, [esp + 0x20]
push 1
push ecx
push edx
push eax
call fcn.00544ed0
add esp, 0x10
jmp 0x64145b
Function at 0x641e80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x430
mov ebx, ecx
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [esp + 0x428], eax
cmp byte [0x815394], 0
jne 0x641f42
cmp byte [ebx + 0x31], 1
jne 0x641f42
cmp byte [ebx + 0x30], 0
jne 0x641f42
lea edi, [esp + 0x30]
mov ecx, edi
call fcn.004daa40
mov eax, dword [edi + 0x3e8]
cmp eax, 0xfb
jae 0x641fee
mov esi, ebx
test eax, eax
je 0x641fac
shl eax, 2
xor ecx, ecx
xor ebx, ebx
xor ebx, dword [esp + ecx + 0x30]
add ecx, 4
cmp eax, ecx
jne 0x641eed
mov dword [esp + 0x2c], 0x14
mov dword [esp + 0x28], 0x1dd76000
mov dword [esp], edi
mov dword [esp + 0xc], 0x199
mov dword [esp + 8], 0x791650
mov dword [esp + 4], str.HandleWorkMessage
call fcn.005613a0
movq xmm0, qword [esp + 0x28]
movq qword [esp + 8], xmm0
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.006487a0
mov ebx, esi
cmp dword [ebx + 8], 0
je 0x641fa6
mov ecx, ebx
call fcn.004aa380
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x30]
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov eax, dword [ebx + 8]
mov edi, dword [eax]
mov eax, dword [edi]
mov dword [esp + 0x24], ebx
mov ebx, dword [eax + 4]
mov ecx, ebx
call dword [0x8072c0]
mov dword [esp], esi
mov ecx, edi
call ebx
sub esp, 4
mov eax, dword [esi]
or eax, dword [esi + 4]
jne 0x641fb3
mov ecx, dword [esp + 0x24]
call fcn.0054ee80
mov ecx, dword [esp + 0x428]
xor ecx, ebp
call fcn.005c9f16
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov byte [ebx + 4], 0
jmp 0x641f90
xor ebx, ebx
jmp 0x641ef8
mov esi, dword [esp + 0x24]
mov eax, dword [esi + 8]
mov edi, dword [eax]
mov eax, dword [edi]
mov ebx, dword [eax + 0xc]
mov ecx, ebx
call dword [0x8072c0]
mov ecx, edi
call ebx
movdqa xmm0, xmmword [esp + 0x30]
movaps xmm1, xmmword [esp + 0x40]
movups xmmword [esp + 0x10], xmm1
movdqu xmmword [esp], xmm0
mov ecx, esi
call fcn.00641c80
sub esp, 0x20
jmp 0x641f90
int3