joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401227
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor ecx, ecx
push 8
mov eax, ecx
pop edx
mov esi, eax
and esi, 1
dec esi
not esi
and esi, 0xedb88320
shr eax, 1
xor eax, esi
dec edx
jne 0x40122f
mov dword [ecx*4 + 0x415d58], eax
inc ecx
cmp ecx, 0x100
jb 0x40122a
mov edx, 0x800
jmp 0x40127c
mov eax, dword [ecx*4 + 0x415958]
mov esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x415d58]
inc ecx
mov dword [ecx*4 + 0x415d54], eax
cmp ecx, edx
jb 0x40125b
mov dword [0x417d58], 0x4014bf
call fcn.0040116d
test eax, eax
jne 0x40129d
mov dword [0x417d58], 0x40155b
pop esi
ret

Function at 0x4012f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [esi]
test edi, edi
je 0x401338
and dword [esi], 0
mov eax, 0x400000
cmp edi, eax
ja 0x401309
mov eax, edi
and dword [ebp - 4], 0
push 0
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
add dword [ebp + 0xc], ecx
add dword [esi], ecx
sub edi, ecx
test eax, eax
je 0x40133d
test ecx, ecx
je 0x401338
test edi, edi
jne 0x4012fe
xor eax, eax
pop edi
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40133a
Function at 0x405913
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
sub esp, 0xc
xor eax, eax
and edx, 7
cmp ecx, 5
jae 0x40592a
leave
ret
or dword [ebp - 4], 0xffffffff
push ebx
push esi
mov esi, dword [ebp + 8]
lea ecx, [esi + ecx - 4]
push edi
mov dword [ebp - 8], ecx
lea edi, [eax + esi]
jmp 0x405949
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x40594e
inc edi
cmp edi, dword [ebp - 8]
jb 0x405940
mov eax, edi
sub eax, esi
cmp edi, dword [ebp - 8]
jae 0x405a3d
mov ecx, eax
sub ecx, dword [ebp - 4]
cmp ecx, 3
jbe 0x4059d0
xor edx, edx
mov cl, byte [edi + 4]
mov dword [ebp - 4], eax
test cl, cl
je 0x40597a
cmp cl, 0xff
jne 0x4059ff
movzx esi, cl
movzx ecx, byte [edi + 3]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 2]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 1]
shl esi, 8
or esi, ecx
sub esi, eax
lea ebx, [esi - 5]
mov dword [ebp - 0xc], ebx
test edx, edx
je 0x405a10
movzx esi, byte [edx + 0x4121e8]
push 0x18
shl esi, 3
pop ecx
sub ecx, esi
shr ebx, cl
mov cl, bl
test cl, cl
je 0x4059c0
cmp cl, 0xff
jne 0x405a0d
push 0x20
pop ecx
sub ecx, esi
xor esi, esi
inc esi
shl esi, cl
dec esi
xor esi, dword [ebp - 0xc]
jmp 0x405998
dec ecx
shl edx, cl
and edx, 7
je 0x405967
movzx ecx, byte [edx + 0x4121e8]
mov ebx, edi
sub ebx, ecx
cmp byte [edx + 0x4121e0], 0
mov cl, byte [ebx + 4]
je 0x4059fc
test cl, cl
je 0x4059fc
cmp cl, 0xff
jne 0x405967
mov dword [ebp - 4], eax
and edx, 3
add edx, edx
or edx, 1
inc eax
jmp 0x40593b
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp + 8]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [edi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [edi + 3], cl
mov ecx, ebx
shr ecx, 8
mov byte [edi + 2], cl
mov byte [edi + 1], bl
add eax, 5
jmp 0x40593b
mov esi, eax
sub esi, dword [ebp - 4]
push 3
lea ecx, [esi - 1]
shl edx, cl
pop edi
and edx, 7
cmp edi, esi
sbb ecx, ecx
not ecx
pop edi
and ecx, edx
mov edx, dword [ebp + 0xc]
pop esi
mov dword [edx], ecx
pop ebx
leave
ret
Function at 0x40674e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x41429c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x210], 0
push esi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
mov esi, ecx
call fcn.00406e60
add esp, 0xc
push 1
push 0x1a
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x20c]
push eax
call fcn.00405e9d
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00406ad9
leave
ret

Function at 0x4067b7
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x41429c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x14], 8
jb 0x4067d7
mov eax, dword [esi]
jmp 0x4067d9
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4067eb
mov al, 1
jmp 0x40688b
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.00406e60
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x406811
mov esi, dword [esi]
push edi
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.00407aa1
and dword [ebp - 0x230], 0
pop ecx
pop ecx
push 6
xor eax, eax
pop ecx
lea edi, [ebp - 0x22c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x210]
mov dword [ebp - 0x228], eax
mov eax, 0x1494
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x230]
push eax
mov dword [ebp - 0x22c], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
cmp dword [ebp - 0x21e], 0
pop edi
je 0x406874
xor al, al
jmp 0x40688b
test eax, eax
je 0x406888
cmp eax, 2
je 0x406888
cmp eax, 0x402
je 0x406888
xor eax, eax
jmp 0x40688b
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00406ad9
leave
ret
Function at 0x406898
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40f40a
mov eax, dword fs:[0]
push eax
mov eax, 0x229c
call fcn.0040d2b0
mov eax, dword [0x41429c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x22a4], eax
mov eax, dword [ebp + 0xc]
xor esi, esi
mov dword [ebp - 0x22a8], eax
cmp eax, esi
je 0x406a2f
lea eax, [ebp - 0x244]
push eax
mov edi, 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, edi
jae 0x406a2f
cmp eax, esi
je 0x406a2f
push esi
call fcn.00407ac2
push eax
call fcn.00407965
pop ecx
pop ecx
mov dword [ebp - 0x22a0], esi
jmp 0x406921
xor esi, esi
xor eax, eax
mov dword [ebp - 0x2268], 7
mov dword [ebp - 0x226c], esi
mov word [ebp - 0x227c], ax
mov eax, dword [ebp - 0x22a4]
push 0xffffffffffffffff
push esi
lea edi, [ebp - 0x227c]
mov dword [ebp - 4], esi
call fcn.00405f81
push 9
xor eax, eax
pop ecx
mov word [ebp - 0x38], ax
lea edi, [ebp - 0x36]
rep stosd dword es:[edi], eax
push 0xa
stosw word es:[edi], ax
lea eax, [ebp - 0x38]
push 0x14
push eax
call fcn.00407977
cdq
mov ecx, 0x7fff
idiv ecx
push edx
call fcn.00407a77
lea eax, [ebp - 0x38]
push eax
call fcn.004077a6
add esp, 0x14
lea ecx, [ebp - 0x38]
mov ebx, eax
push ecx
lea eax, [ebp - 0x227c]
call fcn.00405eeb
lea eax, [ebp - 0x244]
push eax
lea esi, [ebp - 0x2298]
call fcn.00405e9d
mov edi, eax
push 0
lea eax, [ebp - 0x227c]
xor ebx, ebx
push eax
inc ebx
or eax, 0xffffffff
mov byte [ebp - 4], bl
call fcn.004060d9
push eax
lea eax, [ebp - 0x2260]
call fcn.00405e75
push ebx
xor edi, edi
mov byte [ebp - 4], 3
call fcn.00406099
cmp dword [ebp - 0x224c], 8
mov eax, dword [ebp - 0x2260]
jae 0x4069f1
lea eax, [ebp - 0x2260]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x406a4b
push ebx
xor edi, edi
lea esi, [ebp - 0x2260]
call fcn.00406099
or dword [ebp - 4], 0xffffffff
push ebx
lea esi, [ebp - 0x227c]
call fcn.00406099
inc dword [ebp - 0x22a0]
cmp dword [ebp - 0x22a0], 0x32
jl 0x40691f
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00406ad9
leave
ret
xor eax, eax
push 0x1ffe
push eax
mov word [ebp - 0x2244], ax
lea eax, [ebp - 0x2242]
push eax
call fcn.00406e60
mov eax, dword [ebp - 0x2260]
add esp, 0xc
cmp dword [ebp - 0x224c], 8
jae 0x406a7e
lea eax, [ebp - 0x2260]
push 0x1000
lea ecx, [ebp - 0x2244]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
jne 0x406ac0
mov byte [ebp - 0x2299], al
push ebx
xor edi, edi
lea esi, [ebp - 0x2260]
call fcn.00406099
push ebx
lea esi, [ebp - 0x227c]
call fcn.00406099
mov al, byte [ebp - 0x2299]
jmp 0x406a31
mov ecx, dword [ebp - 0x22a8]
lea eax, [ebp - 0x2244]
call fcn.00406017
mov byte [ebp - 0x2299], bl
jmp 0x406a9b

Function at 0x406ad9
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41429c]
jne 0x406ae3
repz ret
jmp fcn.00407cb3
Function at 0x40b1fc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41429c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040a23e
and dword [ebp - 0x14], 0
cmp dword [0x415cdc], 0
mov dword [ebp - 0x18], eax
jne 0x40b2af
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40b357
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x410dec
push ebx
call edi
test eax, eax
je 0x40b357
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x415cdc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x415ce0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x415ce4], eax
call edi
push eax
call esi
mov dword [0x415cec], eax
test eax, eax
je 0x40b2af
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x415ce8], eax
mov eax, dword [0x415ce8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40b308
cmp dword [0x415cec], ecx
je 0x40b308
push eax
call esi
push dword [0x415cec]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40b308
test ebx, ebx
je 0x40b308
call edi
test eax, eax
je 0x40b2ff
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40b2ff
test byte [ebp - 8], 1
jne 0x40b308
or dword [ebp + 0x10], 0x200000
jmp 0x40b33b
mov eax, dword [0x415ce0]
cmp eax, dword [ebp - 0x18]
je 0x40b33b
push eax
call esi
test eax, eax
je 0x40b33b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40b33b
mov eax, dword [0x415ce4]
cmp eax, dword [ebp - 0x18]
je 0x40b33b
push eax
call esi
test eax, eax
je 0x40b33b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x415cdc]
call esi
test eax, eax
je 0x40b357
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40b359
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406ad9
leave
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x40cb50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x40cb5f
pop dword [ebp - 0x2c]
mov eax, 0x45dfd2c9
sub eax, 0x459f076a
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x34676
push 0
mov eax, 0xa47fb8
add eax, 0xff9c6120
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0xdf4b9824
add ecx, 0x20b49c85
xor esi, esi
add esi, eax
mov edi, 0x8a84b121
sub edi, 0x8a43755d
add edi, dword [ebp - 0x2c]
mov edx, 0xb0739b33
add dword [ebp - 0x20], ebx
mov ebx, dword [edi]
add dword [ebp - 8], esi
sub ebx, edx
xor dword [ebp - 0x20], ebx
mov dword [esi], ebx
mov dword [ebp - 0x20], 0x209f49b9
add esi, 0x4c1025cd
add esi, 0xb3efda37
add edi, 4
loop 0x40cbba
add eax, 0xc577
mov ebx, eax
add eax, 0x3e50911c
sub eax, 0x3e509117
mov ecx, 0x400000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x40d673
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x40d6a4
call fcn.00403763
mov dword [eax], esi
call fcn.00403750
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0040cb50
add esp, 0x14
push 0x16
pop eax
jmp 0x40d6f9
test dword [ebp + 0xc], 0xfffffff9
jne 0x40d680
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40d6d1
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.0040cb50
pop ecx
call fcn.00403750
mov eax, dword [eax]
jmp 0x40d6f9
test al, 0x10
jne 0x40d6f7
test al, 1
je 0x40d6f7
test byte [ebp + 0xc], 2
je 0x40d6f7
call fcn.00403763
mov dword [eax], 5
call fcn.00403750
mov dword [eax], 0xd
jmp 0x40d6c8
xor eax, eax
pop esi
pop ebp
ret
Function at 0x42eb10
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x100
mov esi, ecx
mov eax, dword [0x5f3024]
xor eax, ebp
mov dword [esp + 0xf8], eax
push 0
call fcn.004cfe20
add esp, 4
test al, al
jne 0x42ebfc
pxor xmm0, xmm0
movdqu xmmword [esp + 0x44], xmm0
movdqu xmmword [esp + 0x34], xmm0
movdqu xmmword [esp + 0x24], xmm0
movdqu xmmword [esp + 0x14], xmm0
mov dword [esp + 0x10], 0x44
pcmpeqd xmm0, xmm0
movdqa xmmword [esp], xmm0
add esi, 4
lea edi, [esp + 0x54]
mov ecx, esi
push 0x15
push 0x5d4566
push edi
call fcn.004cf1f0
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x42eb90
mov eax, dword [esp + 0x54]
sub esp, 0x28
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x38]
mov dword [esp + 0x20], ecx
xor ecx, ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], ecx
pxor xmm0, xmm0
movdqu xmmword [esp + 4], xmm0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
mov ecx, edi
call fcn.004ceef0
test esi, esi
jne 0x42ebdf
push 2
call fcn.004cfe20
add esp, 4
test al, al
jne 0x42ec33
test esi, esi
setne bl
mov ecx, dword [esp + 0xf8]
xor ecx, ebp
call fcn.0050db32
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea edi, [esp + 0x54]
mov ecx, edi
push 0
push 0xf2
push str.....operadesktopwindows_assistantinstaller_assistant_installer.cc
call fcn.00458830
lea eax, [esp + 0x5c]
push 0x11
push str.Running_Assistant
push eax
call fcn.0053f210
add esp, 0xc
mov ecx, edi
call fcn.00458c70
jmp 0x42eb41
lea edi, [esp + 0x54]
mov ecx, edi
push 2
push 0xfd
push str.....operadesktopwindows_assistantinstaller_assistant_installer.cc
call fcn.00458830
lea eax, [esp + 0x5c]
push 0x1b
push str.CreateProcess_failed_w_err
push eax
call fcn.0053f210
add esp, 0xc
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, ebx
push eax
call fcn.0042ad20
mov ecx, edi
call fcn.00458c70
jmp 0x42ebdf
Function at 0x4314e0
Capabilities:
Inspect section memory permissions

Disassembly:
test eax, 0xeb0c5d89
push es
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x431504
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x431522
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x431580
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x431567
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x431570
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x43157a
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x43155c
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x4314e6
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x4315cd
dec eax
je 0x4315c4
sub eax, 3
je 0x4315bb
mov dword [ebp - 4], 0x40
jmp 0x4315ea
mov dword [ebp - 4], 4
jmp 0x4315d0
mov dword [ebp - 4], 0x20
jmp 0x4315d0
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x43161c
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x43159c
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00430e2d
insb byte es:[edi], dx
fmul qword [ecx - 0x11]
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x431628
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x438100
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20c
mov eax, dword [0x5f3024]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x218]
mov dword [esi], 0x101
lea ebx, [ebp - 0x212]
push 0x202
push 0xff
push ebx
call fcn.00510dc0
add esp, 0xc
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov esi, eax
test eax, eax
jne 0x438165
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050db32
mov eax, ebx
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, dword [ebp + 8]
push ebx
call fcn.0052a854
add esp, 4
mov ecx, edi
push eax
push ebx
call fcn.00451610
jmp 0x438149
Function at 0x43bbf0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xc0
mov esi, esp
mov dword [esi + 8], ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [0x5f3024]
xor eax, ebp
mov dword [esi + 0xb8], eax
pxor xmm0, xmm0
movdqu xmmword [esi + 0x3c], xmm0
movdqu xmmword [esi + 0x5c], xmm0
movdqu xmmword [esi + 0x4c], xmm0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x34], 0x3c
mov dword [esi + 0x38], 0x40
mov dword [esi + 0x40], str.runas
xor ebx, ebx
dec ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
lea edi, [esi + 0x70]
push edi
call fcn.004537b0
cmp byte [edi + 0xb], 0
js 0x43bd79
mov eax, dword [esi + 0x78]
mov dword [esi + 0x30], eax
movq xmm0, qword [esi + 0x70]
movq qword [esi + 0x28], xmm0
lea ecx, [esi + 0x70]
call fcn.004ceef0
cmp byte [esi + 0x33], 0
jns 0x43bc85
mov eax, dword [esi + 0x28]
jmp 0x43bc88
lea eax, [esi + 0x28]
mov dword [esi + 0x44], eax
lea edi, [esi + 0x1c]
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov ecx, dword [ebp + 0xc]
push edi
call fcn.00454610
cmp byte [edi + 0xb], 0
jns 0x43bca8
mov edi, dword [esi + 0x1c]
lea eax, [esi + 0x34]
mov dword [eax + 0x14], edi
mov dword [eax + 0x1c], 5
pcmpeqd xmm0, xmm0
lea ebx, [esi + 0x70]
movdqa xmmword [ebx + 0x30], xmm0
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea edi, [esi + 0xc]
push 0x176
push str.....operadesktopwindowsos_operationsos_operations_impl.cc
push str.RunElevatedProcess
push edi
call fcn.004cfde0
add esp, 0x10
mov ecx, ebx
push 0
push edi
call fcn.004da670
lea eax, [esi + 0x34]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [esi + 4], esp
sub esp, 0xc
mov ebx, esp
lea ecx, [ebx + 4]
test eax, eax
je 0x43bd12
push dword [esi + 0x6c]
jmp 0x43bd14
push 0
call fcn.004df870
mov eax, dword [ebp + 8]
mov dword [ebx], eax
mov edi, dword [esi + 8]
mov eax, dword [edi]
mov ebx, dword [eax + 0x60]
mov ecx, ebx
call dword [section..00cfg]
mov ecx, edi
call ebx
mov esp, dword [esi + 4]
lea ecx, [esi + 0x70]
call fcn.004da6f0
cmp byte [esi + 0x27], 0
jns 0x43bd4e
push dword [esi + 0x1c]
call fcn.0050d52e
add esp, 4
cmp byte [esi + 0x33], 0
jns 0x43bd5f
push dword [esi + 0x28]
call fcn.0050d52e
add esp, 4
mov ecx, dword [esi + 0xb8]
xor ecx, ebp
call fcn.0050db32
mov eax, dword [ebp + 8]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
lea ecx, [esi + 0x28]
push dword [esi + 0x74]
push dword [esi + 0x70]
call fcn.00451350
jmp 0x43bc72
Function at 0x452f20
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [0x5f92d4]
test ebx, ebx
jne 0x452fa2
push 0x28
call fcn.0050d4fe
add esp, 4
mov esi, eax
xor edi, edi
mov dword [eax], edi
mov dword [eax + 4], edi
mov byte [eax + 8], 0
push 0xc
call fcn.0050d4fe
add esp, 4
mov dword [esi + 0xc], eax
lea ecx, [eax + 0xc]
mov dword [esi + 0x14], ecx
test eax, eax
je 0x452fac
mov dword [eax + 4], edi
mov dword [eax], edi
mov dword [eax + 8], edi
mov dword [esi + 0x10], ecx
mov eax, esi
add eax, 0x1c
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x18], eax
mov dword [esi + 0x24], 1
mov dword [0x5f92d4], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
je 0x452fc7
mov edi, eax
push eax
call fcn.0052a854
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.00452fd0
test ebx, ebx
sete al
pop esi
pop edi
pop ebx
pop ebp
ret
push str.null_pointer_given_to_construct_at
push str.__location___nullptr
push 0x23
push str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
push str._s:_d:_assertion__s_failed:__s
call fcn.0053ff10
int3
Function at 0x452fd0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov edi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [0x5f3024]
xor edx, ebp
mov dword [ebp - 0x10], edx
lea esi, [ebp - 0x20]
push 3
push ecx
push eax
push esi
call fcn.00468e90
add esp, 0x10
mov eax, dword [esi + 4]
test eax, eax
je 0x453126
mov esi, dword [ebp - 0x20]
mov dword [edi], esi
mov dword [edi + 4], eax
xor eax, eax
mov dword [ebp - 0x14], eax
push 0x800
mov dword [ebp - 0x24], 0
push eax
push 0x5da89c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], eax
je 0x453163
push 0x5da8ec
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x45305c
mov ecx, eax
call dword [section..00cfg]
lea eax, [ebp - 0x14]
push eax
push esi
call ecx
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 0x14]
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov edi, 0
mov dword [ebp - 0x28], 0
test ebx, ebx
je 0x4530c6
shl ebx, 2
cmp ebx, 0x55555555
jae 0x453173
lea esi, [ebx + ebx*2]
push esi
call fcn.0050d4fe
add esp, 4
mov edi, eax
mov dword [ebp - 0x20], eax
add eax, esi
mov dword [ebp - 0x18], eax
xor esi, esi
mov dword [ebp - 0x28], edi
test edi, edi
je 0x45313a
mov ecx, edi
mov eax, dword [ebp - 0x24]
push dword [eax + esi]
call fcn.0053f3e0
add edi, 0xc
add esi, 4
cmp ebx, esi
jne 0x4530a4
mov dword [ebp - 0x1c], edi
mov esi, dword [ebp - 0x30]
mov ecx, esi
lea eax, [ebp - 0x20]
push eax
call fcn.00452cd0
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x4530f2
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [ebp - 0x28]
test esi, esi
je 0x453126
cmp edi, esi
je 0x45311d
add edi, 0xfffffff4
test edi, edi
je 0x453155
cmp byte [edi + 0xb], 0
jns 0x453114
push dword [edi]
call fcn.0050d52e
add esp, 4
lea eax, [edi - 0xc]
cmp edi, esi
mov edi, eax
jne 0x453100
push esi
call fcn.0050d52e
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050db32
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 8
push str.null_pointer_given_to_construct_at
push str.__location___nullptr
push 0x23
push str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
push str._s:_d:_assertion__s_failed:__s
call fcn.0053ff10
push str.null_pointer_given_to_destroy_at
push str.__loc___nullptr
push 0x3f
jmp 0x453146
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x453059
call fcn.00522670
int3