joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b92c0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10c
mov eax, dword [0x5c7004]
xor eax, esp
mov dword [esp + 0x108], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x10]
mov edx, dword [ecx]
push ebx
mov ebx, dword [ecx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ecx + 4]
mov dword [esp + 0xfc], eax
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ecx + 8]
movzx eax, ax
mov ch, al
mov cl, ah
movzx eax, word [esp + 0x106]
mov word [esp + 0x104], cx
mov ch, al
mov cl, ah
lea eax, [esi + 0x10]
push eax
push 4
push dword [0x5cd55c]
bswap edx
mov dword [esp + 0x20], edx
mov word [esp + 0x112], cx
mov dword [esp + 0x24], eax
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ecx, dword [esp + 0x14]
push esi
push dword [esp + 0x14]
mov dword [eax], ecx
mov ecx, dword [esp + 0x10c]
mov dword [eax + 4], ecx
mov dword [eax + 8], edi
mov dword [esp + 0x14], eax
mov dword [eax + 0xc], ebx
add eax, 0x10
push eax
call fcn.00537fe0
mov bl, byte [ebp + 0x18]
add esp, 0xc
cmp bl, 3
jne 0x4b93ec
lea eax, [esi + 0x10]
mov dword [esp + 0x28], 0x67452301
mov esi, dword [esp + 0xc]
lea ecx, [esp + 0x20]
push eax
mov edx, esi
mov dword [esp + 0x30], 0xefcdab89
mov dword [esp + 0x34], 0x98badcfe
mov dword [esp + 0x38], 0x10325476
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call fcn.00523740
lea ecx, [esp + 0x20]
call fcn.00523820
mov eax, dword [esp + 0x7c]
mov edi, dword [esp + 0x78]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 0x14], eax
jmp 0x4b948f
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x88]
mov esi, dword [esp + 0xc]
mov edx, esi
push eax
mov dword [esp + 0xa4], 0x67452301
mov dword [esp + 0xa8], 0xefcdab89
mov dword [esp + 0xac], 0x98badcfe
mov dword [esp + 0xb0], 0x10325476
mov dword [esp + 0xb4], 0xc3d2e1f0
mov dword [esp + 0xb8], 0
mov dword [esp + 0xbc], 0
call fcn.00525ac0
lea edx, ds:[esp + 0x100]
lea ecx, [esp + 0x88]
call fcn.00525b80
mov eax, dword [esp + 0x10c]
mov bl, 5
mov edi, dword [esp + 0x100]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x108]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x104]
mov dword [esp + 0xc], eax
push esi
push 0
push dword [0x5cd55c]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov edx, dword ds:[esp + 0x1c]
mov eax, dword [esp + 0xc]
shl bl, 4
mov dword [edx], edi
mov dword [edx + 4], eax
mov eax, dword [esp + 0x10]
mov dword [edx + 8], eax
mov eax, dword [esp + 0x14]
mov dword [edx + 0xc], eax
mov eax, dword [edx]
bswap eax
mov dword [edx], eax
movzx eax, word [edx + 4]
mov ch, al
mov cl, ah
movzx eax, word [edx + 6]
mov word [edx + 4], cx
mov ch, al
mov cl, ah
mov ax, cx
mov ecx, dword [esp + 0x114]
mov word [edx + 6], ax
shr eax, 8
and al, 0xf
or al, bl
mov byte [edx + 7], al
mov al, byte [edx + 8]
pop edi
and al, 0x3f
pop esi
or al, 0x80
pop ebx
xor ecx, esp
mov byte [edx + 8], al
call fcn.00534c91
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4ba400
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
test byte [0x5cb454], 1
push esi
push edi
jne 0x4ba485
mov esi, 0x5cb454
lock bts dword ds:[esi], 0x1f
jae 0x4ba436
test byte [0x5cb454], 1
jne 0x4ba485
xor edx, edx
mov ecx, esi
call sym.ProcessHacker.exe_PhfWaitForEvent
jmp 0x4ba485
push 4
push 0x5cf000
push 0xe
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x4ba458
mov dword [0x5cf000], 0x2e
push 4
push 0x5cf020
push 0xf
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x4ba47a
mov dword [0x5cf020], 0x2c
mov ecx, esi
call sym.ProcessHacker.exe_PhfEndInitOnce
mov eax, dword [ebp + 0xc]
mov ecx, 3
mov dword [esp + 0x10], eax
xor eax, eax
cmp byte [ebp + 0x10], al
push 0
cmovne eax, ecx
mov dword [esp + 0x18], 0
push 0
mov dword [esp + 0x20], eax
lea eax, [esp + 0x18]
push eax
push dword [ebp + 8]
mov dword [esp + 0x2c], 0x5cf000
push 0
push 0x400
mov dword [esp + 0x38], 0x5cf020
mov dword [esp + 0x3c], 1
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
push dword [0x5cd4f8]
mov edi, eax
lea esi, [edi + edi]
lea ecx, [esi + 0xa]
push ecx
call sym.ProcessHacker.exe_PhCreateObject
push edi
xor edx, edx
mov dword [esp + 0x10], eax
lea ecx, [eax + 8]
mov dword [eax], esi
mov dword [eax + 4], ecx
mov word [ecx + esi], dx
push dword [eax + 4]
lea eax, [esp + 0x18]
push eax
push dword [ebp + 8]
push edx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
test eax, eax
jne 0x4ba539
mov ecx, dword [esp + 0xc]
or eax, 0xffffffff
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4ba52f
call fcn.004c1f60
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov esi, dword [esp + 0xc]
push dword [esi + 4]
call sym.ProcessHacker.exe_PhCountStringZ
add eax, eax
mov dword [esi], eax
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4ba760
Capabilities:
Map section object

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 0xc]
push ebx
push esi
push edi
push 0x60
push 1
push 5
push 0x80
push 0x100081
push ecx
push eax
call sym.ProcessHacker.exe_PhCreateFile
test eax, eax
js 0x4ba886
cmp dword [0x5c7aa8], 0x3e
mov edi, dword [ebp - 0xc]
sbb eax, eax
push edi
and eax, 0xf0000000
add eax, 0x11000000
push eax
push 2
push 0
push 0
push 5
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ntdll.dll_NtCreateSection]
push edi
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
js 0x4ba886
cmp dword [0x5c7aa8], 0x67
push 2
sbb eax, eax
mov dword [ebp - 8], 0
and eax, 0xfffc0000
mov dword [ebp - 0x10], 0
add eax, 0x40000
push eax
push 1
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
push 0xffffffffffffffff
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
js 0x4ba886
mov edi, dword [ebp - 8]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
or edi, 2
push eax
push 0x10
push 1
push edi
call sym.ProcessHacker.exe_PhLoadResource
test al, al
je 0x4ba874
mov esi, dword [ebp - 0xc]
push esi
push 4
push dword [0x5cd55c]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push esi
push dword [ebp - 0x14]
mov ebx, eax
push ebx
call fcn.00537fe0
add esp, 0xc
cmp byte [ebx + 4], 0x20
jge 0x4ba874
and edi, 0xfffffffd
push edi
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
and edi, 0xfffffffd
push edi
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4bbd80
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
mov eax, dword [0x5c7004]
xor eax, esp
mov dword [esp + 4], eax
mov ecx, dword [0x5cf014]
push esi
mov esi, dword [ebp + 8]
push edi
test ecx, ecx
je 0x4bbdc3
mov eax, dword [0x5cf010]
mov dword [esi], eax
mov dword [esi + 4], ecx
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret 4
push 0x7ffe0030
call sym.ProcessHacker.exe_PhCountStringZ
lea ecx, ds:[eax + eax]
movzx eax, word [ecx + 0x7ffe002e]
mov edx, ecx
mov edi, eax
cmp eax, 0x5c
jne 0x4bbde8
lea edx, [ecx - 2]
lea eax, [ecx - 2]
mov dword [esi], edx
cmp edi, 0x5c
mov dword [esi + 4], 0x7ffe0030
cmovne eax, ecx
xor ecx, ecx
mov dword [0x5cf010], eax
lea eax, [esp + 8]
lock or dword [eax], ecx
mov ecx, dword [esp + 0xc]
pop edi
pop esi
xor ecx, esp
mov dword [0x5cf014], 0x7ffe0030
call fcn.00534c91
mov esp, ebp
pop ebp
ret 4
Function at 0x4bc060
Capabilities:
Create process on windows
Resolve function by parsing pe exports
Resume thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x6c
lea eax, [esp + 0xc]
push ebx
push esi
push edi
push 0
push 0
push eax
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U_WithStatus]
mov edi, edi
test eax, eax
jns 0x4bc090
lfence
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x28
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x4bc0b6
movzx eax, word [edx]
mov word [esp + 0x20], ax
add eax, 2
cmp dword [edx], 0xfffe
mov word [esp + 0x22], ax
mov eax, dword [edx + 4]
mov dword [esp + 0x24], eax
ja 0x4bc0dc
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x4bc0ea
movzx eax, word [esi]
mov word [esp + 0x28], ax
add eax, 2
cmp dword [esi], 0xfffe
mov word [esp + 0x2a], ax
mov eax, dword [esi + 4]
mov dword [esp + 0x2c], eax
jbe 0x4bc0ea
mov eax, 0xc0000106
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x28
mov ecx, dword [ebp + 0x18]
test ecx, ecx
je 0x4bc0fd
mov edi, dword [ecx + 4]
mov eax, dword [ecx + 8]
test edi, edi
jne 0x4bc103
jmp 0x4bc0ff
xor eax, eax
lea edi, [esp + 0x18]
test eax, eax
jne 0x4bc116
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
add eax, 0x78
test ecx, ecx
je 0x4bc133
mov esi, dword [ecx + 0xc]
mov ebx, dword [ecx + 0x10]
mov ecx, dword [ecx]
mov dword [esp + 0x14], esi
mov esi, dword [ebp + 0x14]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x14]
jmp 0x4bc13b
xor ebx, ebx
xor ecx, ecx
mov dword [esp + 0xc], ecx
push ebx
push ecx
push eax
push edi
push dword [ebp + 0x10]
test edx, edx
lea ecx, [esp + 0x2c]
lea eax, [esp + 0x34]
cmove eax, ecx
xor ecx, ecx
push eax
test esi, esi
lea eax, [esp + 0x40]
cmove eax, ecx
push eax
push dword [esp + 0x28]
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.ntdll.dll_RtlCreateProcessParameters]
mov ebx, dword [ebp + 0x1c]
mov esi, eax
test esi, esi
js 0x4bc1b2
lea eax, ds:[esp + 0x30]
push eax
push 0
push 0
mov al, bl
and al, 1
movzx eax, al
push eax
push dword [ebp + 0x20]
lea eax, [esp + 0x2c]
push 0
push 0
push dword [esp + 0x2c]
push 0x40
push eax
call dword [sym.imp.ntdll.dll_RtlCreateUserProcess]
push dword [esp + 0x10]
mov esi, eax
call dword [sym.imp.ntdll.dll_RtlDestroyProcessParameters]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
lea ecx, [ecx]
test esi, esi
js 0x4bc228
test bl, 4
jne 0x4bc1d5
push 0
push dword [esp + 0x3c]
call dword [sym.imp.ntdll.dll_NtResumeThread]
mov edx, dword [ebp + 0x24]
test edx, edx
je 0x4bc1e9
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
mov dword [edx], eax
mov dword [edx + 4], ecx
mov ecx, dword [ebp + 0x28]
test ecx, ecx
je 0x4bc1f8
mov eax, dword [esp + 0x34]
mov dword [ecx], eax
jmp 0x4bc206
push dword ds:[esp + 0x34]
call dword [sym.imp.ntdll.dll_NtClose]
mov ecx, dword [ebp + 0x2c]
test ecx, ecx
je 0x4bc21e
mov eax, dword [esp + 0x38]
mov dword [ecx], eax
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x28
push dword [esp + 0x38]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x28
Function at 0x4bce80
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
push edi
push 0x38
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x40], 0x3c
push 0
push eax
call fcn.00536b00
mov eax, dword [ebp + 0xc]
add esp, 0xc
mov edi, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x3c], 0x400
mov dword [ebp - 0x24], 5
mov dword [ebp - 0x38], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x4bcf38
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4bcedf
push eax
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x4bcee5
push eax
call sym.ProcessHacker.exe_PhGetWin32Message
mov esi, eax
test esi, esi
je 0x4bcf23
push dword [esi + 4]
push 0x5634d8
push str.Unable_to_execute_the_program.
push 0xfffe
push 0x20
push edi
call sym.ProcessHacker.exe_PhShowMessage2
add esp, 0x18
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4bcf38
call fcn.004c1f60
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
push str.Unable_to_execute_the_program.
push 0x5981b0
push 0x10
push edi
call sym.ProcessHacker.exe_PhShowMessage
add esp, 0x10
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4bd2c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push esi
push edi
push 0x38
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x40], 0x3c
push 0
push eax
call fcn.00536b00
mov eax, dword [ebp + 0xc]
add esp, 0xc
mov edi, dword [ebp + 8]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x24], 5
push eax
mov dword [ebp - 0x3c], 0x40c
mov dword [ebp - 0x34], str.properties
mov dword [ebp - 0x38], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x4bd37b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4bd322
push eax
call sym.ProcessHacker.exe_PhGetNtMessage
mov edi, edi
jmp 0x4bd328
push eax
call sym.ProcessHacker.exe_PhGetWin32Message
mov esi, eax
test esi, esi
je 0x4bd366
push dword [esi + 4]
push 0x5634d8
push str.Unable_to_execute_the_program.
push 0xfffe
push 0x20
push edi
call sym.ProcessHacker.exe_PhShowMessage2
add esp, 0x18
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4bd37b
call fcn.004c1f60
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push str.Unable_to_execute_the_program.
push 0x5981b0
push 0x10
push edi
call sym.ProcessHacker.exe_PhShowMessage
add esp, 0x10
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4bd4e0
Capabilities:
Create process on windows
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5c
lea eax, [esp]
push ebx
push esi
push edi
push 0
push 0
push 0
push 0x5cb404
push 0xfffffffffffffff7
push 0x20006
push eax
call sym.ProcessHacker.exe_PhCreateKey
test eax, eax
js 0x4bd685
mov ecx, dword [ebp + 0xc]
call fcn.004bd3a0
mov edx, dword [0x5cb494]
mov edi, eax
mov word [esp + 0x10], dx
mov esi, dword [edi]
lea ecx, [edx + 2]
add esi, 2
mov word [esp + 0x12], cx
mov ecx, dword [str.LastKey]
mov dword [esp + 0x14], ecx
cmp edx, 0xfffe
ja 0x4bd55f
push esi
push dword [edi + 4]
lea eax, [esp + 0x18]
push 1
push 0
push eax
push dword [esp + 0x20]
call dword [sym.imp.ntdll.dll_NtSetValueKey]
push dword [esp + 0xc]
call dword [sym.imp.ntdll.dll_NtClose]
or ebx, 0xffffffff
lea ecx, [edi - 8]
mov eax, ebx
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4bd57e
call fcn.004c1f60
lea eax, [esp + 0x18]
push eax
call sym.ProcessHacker.exe_PhGetSystemRoot
mov esi, dword [0x5cb484]
mov edi, dword ds:[esp + 0x18]
add esi, edi
push dword [0x5cd4f8]
lea eax, [esi + 0xa]
push eax
call sym.ProcessHacker.exe_PhCreateObject
push edi
push dword [esp + 0x20]
xor edx, edx
mov dword [esp + 0x18], eax
lea ecx, [eax + 8]
mov dword [eax], esi
mov dword [eax + 4], ecx
mov word [ecx + esi], dx
push dword [eax + 4]
call fcn.00537fe0
mov esi, dword ds:[esp + 0x1c]
add esp, 0xc
push dword [0x5cb484]
mov eax, dword [esi + 4]
push dword [0x5cb488]
add eax, edi
push eax
call fcn.00537fe0
add esp, 0xc
lea eax, [esp + 0x18]
push eax
call sym.ProcessHacker.exe_PhGetOwnTokenAttributes
mov edi, dword [esi + 4]
mov eax, dword [eax + 4]
and eax, 1
je 0x4bd60a
push 0
push edi
push dword [ebp + 8]
call sym.ProcessHacker.exe_PhShellExecute
jmp 0x4bd673
push 0x38
lea eax, [esp + 0x34]
mov dword [esp + 0x30], 0x3c
push 0
push eax
call fcn.00536b00
mov eax, dword [ebp + 8]
add esp, 0xc
mov dword [esp + 0x34], eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], 0
push eax
mov dword [esp + 0x34], 0x440
mov dword [esp + 0x4c], 1
mov dword [esp + 0x3c], str.runas
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov edi, edi
test eax, eax
je 0x4bd673
mov eax, dword [esp + 0x64]
test eax, eax
je 0x4bd673
push eax
call dword [sym.imp.ntdll.dll_NtClose]
lea ecx, [esi - 8]
lock xadd dword [ecx + 4], ebx
dec ebx
jne 0x4bd685
mov edi, edi
call fcn.004c1f60
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4be880
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
cmp eax, 3
ja case.default.0x4be88e
jmp dword [eax*4 + 0x4be918]
push dword ds:[ebp + 0x10]
mov edx, dword [ebp + 0xc]
lea ecx, [edi + 4]
call fcn.00523740
pop edi
pop ebp
ret 0xc
push dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
lea ecx, [edi + 4]
call fcn.00525ac0
pop edi
pop ebp
ret 0xc
mov edx, dword [ebp + 0x10]
mov ecx, dword [edi + 4]
not ecx
push esi
mov esi, dword [ebp + 0xc]
test edx, edx
je 0x4be8ea
lea ecx, [ecx]
movsx eax, byte [esi]
lea esi, [esi + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x59a320]
sub edx, 1
jne 0x4be8d0
not ecx
pop esi
mov dword [edi + 4], ecx
pop edi
pop ebp
ret 0xc
push dword ds:[ebp + 0x10]
mov edx, dword [ebp + 0xc]
lea ecx, [edi + 4]
call fcn.005234e0
pop edi
pop ebp
ret 0xc
push 0xc000000d
call dword [sym.imp.ntdll.dll_RtlRaiseStatus]
lea ecx, [ecx]
xchg ebp, eax
call 3908430185
dec ebx
add byte [ebp - 0xaffb418], bh
call 0xcd17e975
int3
Function at 0x4bfdc0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x5c7004]
xor eax, ebp
mov dword [ebp - 4], eax
test byte [0x5cb414], 1
push ebx
push esi
push edi
jne 0x4bff7a
mov eax, 0x5cb414
lock bts dword [eax], 0x1f
jae 0x4bfe0d
test byte [0x5cb414], 1
jne 0x4bff7a
xor edx, edx
mov ecx, eax
call sym.ProcessHacker.exe_PhfWaitForEvent
jmp 0x4bff7a
push 2
push 0x5cb424
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ntdll.dll_RtlInitializeSid]
push 0
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ntdll.dll_RtlSubAuthoritySid]
push 1
mov dword [eax], 0x20
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ntdll.dll_RtlSubAuthoritySid]
mov dword [eax], 0x220
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ntdll.dll_RtlLengthSid]
push 0x5c7c28
mov esi, eax
call dword [sym.imp.ntdll.dll_RtlLengthSid]
push 0x5c7c04
add esi, eax
call dword [sym.imp.ntdll.dll_RtlLengthSid]
add eax, 0x40
add esi, eax
push esi
push 4
push dword [0x5cd55c]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ebx, eax
push 1
push ebx
lea edi, [ebx + 0x14]
call dword [sym.imp.ntdll.dll_RtlCreateSecurityDescriptor]
push 2
lea ecx, [esi - 0x14]
push ecx
push edi
call dword [sym.imp.ntdll.dll_RtlCreateAcl]
push 0x5c7c04
push 0xf000f
push 2
push edi
call dword [sym.imp.ntdll.dll_RtlAddAccessAllowedAce]
lea eax, [ebp - 0x14]
push eax
push 0xf000f
push 2
push edi
call dword [sym.imp.ntdll.dll_RtlAddAccessAllowedAce]
push 0x5c7c28
push 7
push 2
push edi
call dword [sym.imp.ntdll.dll_RtlAddAccessAllowedAce]
push 0
push edi
push 1
push ebx
call dword [sym.imp.ntdll.dll_RtlSetDaclSecurityDescriptor]
cmp dword [0x5c7aa8], 0x64
mov dword [ebp - 0x2c], 0x18
sbb eax, eax
mov dword [ebp - 0x28], 0
and eax, 0xfffff000
mov dword [ebp - 0x24], 0x5cb42c
add eax, 0x1080
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x2c]
push eax
push 0x2000000
push 0x5cf008
mov dword [ebp - 0x18], 0
call dword [sym.imp.ntdll.dll_NtCreateDirectoryObject]
push ebx
push 0
push dword [0x5cd55c]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov edi, 0x5cb414
lock bts dword [edi], 0
jb 0x4bff7a
mov esi, dword [0x5cb418]
test esi, esi
je 0x4bff4d
push 0
push esi
call dword [sym.imp.ntdll.dll_NtSetEvent]
mov eax, 0xfffffffe
lock xadd dword [edi], eax
shr eax, 1
and eax, 0x7fff
sub eax, 1
jne 0x4bff7a
test esi, esi
je 0x4bff7a
push esi
call dword [sym.imp.ntdll.dll_NtClose]
mov dword [0x5cb418], 0
mov ecx, dword [ebp - 4]
mov eax, dword [0x5cf008]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00534c91
mov esp, ebp
pop ebp
ret
Function at 0x4c03a0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword fs:[0x18]
push ebx
push esi
push edi
mov eax, dword [eax + 0x30]
mov ecx, dword [eax + 0xc]
add ecx, 0xc
mov dword [esp + 0xc], ecx
mov esi, dword [ecx]
cmp esi, ecx
je 0x4c045b
mov ebx, dword [ebp + 0xc]
lea esp, [esp]
cmp dword [ebp + 8], 0
movzx edi, word [esi + 0x2c]
movzx edx, word [esi + 0x24]
mov eax, dword [esi + 0x28]
mov dword [esp + 0x14], edi
mov edi, dword [esi + 0x30]
mov dword [esp + 0x10], edi
mov edi, dword [ebp + 0x10]
je 0x4c03fb
mov ecx, dword [ebp + 8]
cmp dword [esi + 0x18], ecx
mov ecx, dword [esp + 0xc]
jne 0x4c0451
test ebx, ebx
je 0x4c0424
mov dword [esp + 0x1c], eax
mov eax, dword [ebx]
mov dword [esp + 0x18], eax
cmp edx, eax
jb 0x4c0451
push 1
push ebx
lea eax, [esp + 0x20]
push eax
call sym.ProcessHacker.exe_PhEqualStringRef
mov ecx, dword ds:[esp + 0xc]
test al, al
je 0x4c0451
test edi, edi
je 0x4c0466
mov eax, dword [esp + 0x10]
mov dword [esp + 0x24], eax
mov eax, dword [edi]
mov dword [esp + 0x20], eax
cmp dword [esp + 0x14], eax
jb 0x4c0451
push 1
push edi
lea eax, [esp + 0x28]
push eax
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
jne 0x4c0466
mov ecx, dword [esp + 0xc]
mov esi, dword [esi]
cmp esi, ecx
jne 0x4c03d0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4c0480
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov eax, dword fs:[0x18]
push ebx
push esi
push edi
mov eax, dword [eax + 0x30]
push dword [eax + 0xa0]
call dword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov edx, dword [eax + 0xc]
mov eax, dword [edx + 0xc]
add edx, 0xc
cmp eax, edx
je 0x4c04cb
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x4c04f5
lea esp, [esp]
cmp dword [eax + 0x18], ecx
je 0x4c04f5
mov eax, dword [eax]
cmp eax, edx
jne 0x4c04b8
xor esi, esi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push dword [eax + 0xa0]
call dword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
test esi, esi
jne 0x4c054a
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test eax, eax
je 0x4c04cb
movzx ecx, word ds:[eax + 0x24]
test cx, cx
jne 0x4c050e
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov esi, eax
jmp 0x4c04cd
mov ebx, dword ds:[eax + 0x28]
mov edi, ecx
push dword [0x5cd4f8]
lea eax, [edi + 0xa]
push eax
call sym.ProcessHacker.exe_PhCreateObject
mov esi, eax
xor ecx, ecx
lea eax, [esi + 8]
mov dword [esi], edi
mov dword [esi + 4], eax
mov word [eax + edi], cx
test ebx, ebx
je 0x4c04cd
push edi
push ebx
push dword [esi + 4]
call fcn.00537fe0
add esp, 0xc
jmp 0x4c04cd
push esi
call sym.ProcessHacker.exe_PhGetFileName
lea ecx, ds:[esi - 8]
mov edi, eax
or esi, 0xffffffff
mov eax, esi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4c0568
call fcn.004c1f60
push 0
push dword [edi + 4]
call sym.ProcessHacker.exe_PhGetFullPath
test eax, eax
je 0x4c058e
mov ecx, edi
mov edi, eax
test ecx, ecx
je 0x4c058e
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], esi
dec esi
jne 0x4c058e
call fcn.004c1f60
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x4c05b7
push 0
push 0x5c
push edi
call sym.ProcessHacker.exe_PhFindLastCharInStringRef
nop
cmp eax, 0xffffffff
je 0x4c05b3
inc eax
mov dword [esi], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor eax, eax
mov dword [esi], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8