joyce8/EMBER2024-capa huggingface dataset:
Function at 0x611a50
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7059b8
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x82f084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x228], ecx
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x21c]
xor bl, bl
mov dword [ebp - 0x21c], 0
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push ecx
cmovae eax, dword [ebp + 8]
push eax
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x224], 0
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
push 0x208
mov edi, eax
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00690480
add esp, 0xc
test edi, edi
je 0x611bad
push edi
call fcn.0067db39
add esp, 4
mov esi, eax
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push esi
push edi
push dword [ebp - 0x21c]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x611ba4
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x224]
push eax
push 0x7625f8
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x611ba4
cmp dword [ebp - 0x220], 0
je 0x611ba4
mov edx, dword [ebp - 0x224]
cmp dword [edx], 0xfeef04bd
jne 0x611ba4
mov ecx, dword [edx + 0xc]
mov edx, dword [edx + 8]
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
movzx eax, dx
push eax
shr edx, 0x10
lea eax, [ebp - 0x218]
push edx
push str._d._d._d._d
push 0x104
push eax
call fcn.004306c0
lea edx, [ebp - 0x218]
add esp, 0x1c
lea edi, [edx + 2]
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x611b80
mov ecx, dword [ebp - 0x228]
lea eax, [ebp - 0x218]
sub edx, edi
sar edx, 1
push edx
push eax
call fcn.0042fe00
mov bl, 1
push esi
call fcn.0067d944
add esp, 4
lea ecx, [ebp + 8]
call fcn.0042fd70
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0067d681
mov esp, ebp
pop ebp
ret
Function at 0x6122b0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, ecx
mov eax, edx
mov dword [ebp - 4], eax
test edi, edi
je 0x61248c
mov esi, dword [ebp + 8]
test esi, esi
je 0x61248c
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x61248c
mov ecx, eax
call fcn.00612220
cmp dword [ebx], eax
jl 0x61248c
mov eax, 0x55555556
xor ebx, ebx
imul dword [ebp - 4]
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x14], eax
lea ecx, [eax*4]
mov eax, 0x6bca1af3
imul ecx
xor eax, eax
sar edx, 5
mov ecx, edx
mov dword [ebp - 8], eax
shr ecx, 0x1f
add ecx, edx
mov edx, 0x13
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
test ecx, ecx
js 0x6123f8
cmp eax, ecx
jne 0x612358
mov edx, dword [ebp - 0x14]
imul eax, ecx, 0x4c
lea ecx, [edx*4]
sub ecx, eax
mov eax, ecx
mov ecx, dword [ebp - 0x10]
cdq
and edx, 3
add edx, eax
mov eax, dword [ebp - 8]
sar edx, 2
mov dword [ebp - 0xc], edx
test edx, edx
jle 0x6123ce
mov dword [ebp - 0x18], edx
nop
movzx ecx, byte [edi]
movzx eax, byte [edi + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 2]
shl ecx, 8
add edi, 3
or ecx, eax
shl ecx, 8
mov eax, ecx
shl ecx, 6
shr eax, 0x1a
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_S]
mov byte [esi], al
mov eax, ecx
shr eax, 0x1a
shl ecx, 6
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_S]
mov byte [esi + 1], al
mov eax, ecx
shr eax, 0x1a
shr ecx, 0x14
and ecx, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_S]
mov byte [esi + 2], al
movzx eax, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_S]
mov byte [esi + 3], al
add esi, 4
sub edx, 1
jne 0x612360
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
lea ebx, [ebx + edx*4]
mov dword [ebp - 0x18], esi
inc eax
mov dword [ebp - 0x1c], ebx
mov word [esi], 0xa0d
add ebx, 2
add esi, 2
mov dword [ebp - 8], eax
cmp eax, ecx
jle 0x612333
test ebx, ebx
je 0x6123f8
mov esi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
lea eax, [eax + eax*2]
sub ecx, eax
mov edx, ecx
mov dword [ebp - 4], ecx
neg edx
lea eax, [ecx + 1]
sbb edx, edx
and edx, eax
mov dword [ebp - 0x1c], edx
je 0x61247b
mov eax, dword [ebp - 4]
xor ecx, ecx
test eax, eax
jle 0x612423
movzx ecx, byte [edi]
inc edi
shl ecx, 8
cmp eax, 1
jle 0x612434
movzx eax, byte [edi]
or ecx, eax
mov eax, dword [ebp - 4]
inc edi
shl ecx, 8
cmp eax, 2
jle 0x612441
movzx eax, byte [edi]
or ecx, eax
shl ecx, 8
test edx, edx
jle 0x612461
mov eax, ecx
shl ecx, 6
shr eax, 0x1a
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_S]
mov byte [esi], al
inc esi
sub edx, 1
jne 0x612448
mov edx, dword [ebp - 0x1c]
mov eax, 4
sub eax, edx
test eax, eax
jle 0x612478
push eax
push 0x3d
push esi
call fcn.00690480
add esp, 0xc
add ebx, 4
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6185d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x705df8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x82f084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea ebx, [edi + 4]
mov dword [edi], 0
mov dword [ebx], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [ebp - 0x18], 0x104
mov dword [ebp - 0x1c], 0
call fcn.00618220
mov dword [ebp - 0x14], eax
test eax, eax
je 0x618783
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x74835c]
mov ecx, dword [ebp - 0x14]
call esi
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftInternet_Explorer
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x618732
mov edx, dword [ebp - 0x18]
test edx, edx
js 0x618779
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x6186a2
push edx
lea ecx, [ebp - 0x14]
call fcn.00619160
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push eax
push esi
push 0
push 0
push str.svcVersion
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x618700
mov ecx, dword [ebp - 0x18]
test ecx, ecx
js 0x618779
mov eax, dword [esi - 8]
mov edx, 1
sub edx, dword [esi - 4]
sub eax, ecx
or eax, edx
jge 0x6186e5
push ecx
lea ecx, [ebp - 0x14]
call fcn.00619160
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push eax
push esi
push 0
push 0
push str.Version
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x618729
cmp dword [ebp - 0x18], 0
jbe 0x618729
lea eax, [edi + 0xc]
push eax
lea eax, [edi + 8]
push eax
push ebx
push edi
push str._d._d._d._d
push esi
call fcn.0050c430
add esp, 0x18
cmp eax, 4
je 0x618729
mov dword [edi], 0
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x61875d
mov edi, dword [esi]
push esi
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x74835c]
mov ecx, edi
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0067d681
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.004307f0
push 0x80004005
call fcn.004307f0
int3
Function at 0x618790
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x705e36
mov eax, dword fs:[0]
push eax
sub esp, 0x250
mov eax, dword [0x82f084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x21c], ecx
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
xor eax, eax
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 7
mov word [ebp - 0x238], ax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x24c], eax
lea edx, [ecx + 2]
mov dword [ebp - 0x248], 7
mov word [ebp - 0x25c], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x618817
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x25c]
call fcn.0042fe00
mov byte [ebp - 4], 1
lea eax, [ebp - 0x25c]
cmp dword [ebp - 0x248], 8
cmovae eax, dword [ebp - 0x25c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov edx, eax
lea esi, [edx + 2]
nop dword [eax]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x618860
sub edx, esi
lea ecx, [ebp - 0x238]
sar edx, 1
push edx
push eax
call fcn.0042fe00
lea ecx, [ebp - 0x25c]
call fcn.0042fd70
push 0
lea eax, [ebp - 0x244]
mov dword [ebp - 0x244], 0
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push 0x7d36e0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x6189b5
cmp dword [ebp - 0x224], 8
lea ecx, [ebp - 0x23c]
push ecx
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x220], eax
push ecx
lea ecx, [ebp - 0x240]
mov dword [ebp - 0x23c], 4
push ecx
lea eax, [ebp - 0x238]
mov dword [ebp - 0x240], 4
cmovae eax, dword [ebp - 0x238]
push 0
push eax
push dword [ebp - 0x244]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
jne 0x618961
cmp dword [ebp - 0x224], 8
lea ecx, [ebp - 0x21c]
push 4
push ecx
push 4
lea eax, [ebp - 0x238]
cmovae eax, dword [ebp - 0x238]
push 0
push eax
push dword [ebp - 0x244]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x6189a5
push dword [ebp - 0x244]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x238]
call fcn.0042fd70
jmp 0x6189c4
test eax, eax
jne 0x618948
mov eax, dword [ebp - 0x220]
cmp eax, dword [ebp - 0x21c]
je 0x6189b1
cmp dword [ebp - 0x224], 8
lea ecx, [ebp - 0x21c]
push 4
push ecx
push 4
lea eax, [ebp - 0x238]
cmovae eax, dword [ebp - 0x238]
push 0
push eax
push dword [ebp - 0x244]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x6189b1
push dword [ebp - 0x244]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov bl, 1
jmp 0x6189b7
xor bl, bl
lea ecx, [ebp - 0x238]
call fcn.0042fd70
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0067d681
mov esp, ebp
pop ebp
ret
Function at 0x61b220
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6e36e8
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x82f084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
xor eax, eax
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov word [edi], ax
lea esi, [edi + 0x18]
mov dword [ebp - 4], eax
push 0x40
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
call fcn.0067d692
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
xor eax, eax
mov word [edi + 0x20], ax
mov eax, edi
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x61b300
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [0x82f084]
xor eax, esp
mov dword [esp + 8], eax
push ebx
mov ebx, ecx
push esi
push edi
mov edi, dword [ebp + 8]
cmp dword [ebx + 0x8c], 1
jne 0x61b3a2
xor eax, eax
cmp dword [ebx + 0x60], 8
mov word [esp + 0xc], ax
mov dword [esp + 0x10], eax
lea eax, [ebx + 0x4c]
jb 0x61b33b
mov eax, dword [eax]
push str.rb__ccsUTF_8
push eax
lea eax, [esp + 0x18]
push eax
call fcn.0069763c
mov eax, dword [esp + 0x1c]
add esp, 0xc
test eax, eax
je 0x61b3a2
push eax
push 2
lea eax, [esp + 0x14]
push 1
push eax
call fcn.00698a47
push dword [esp + 0x20]
call fcn.0069771c
mov ax, word [esp + 0x20]
add esp, 0x14
cmp al, 0xff
jne 0x61b37f
cmp ah, 0xfe
je 0x61b3a2
cmp ah, 0xff
jne 0x61b388
cmp al, 0xfe
je 0x61b3a2
mov eax, dword [edi]
test eax, eax
je 0x61b39b
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [edi], 0
mov ecx, ebx
call fcn.0061d040
lea esi, [ebx + 0x4c]
mov dl, 1
push 1
mov ecx, esi
call fcn.0061f720
add esp, 4
test eax, eax
je 0x61b3d3
cmp eax, 1
jne 0x61b425
push ecx
mov dl, al
mov ecx, esi
call fcn.00611290
add esp, 4
test al, al
je 0x61b425
mov dword [edi], 0xffffffff
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x61b3dd
mov eax, dword [esi]
push 0
push 0x200080
push 3
push 0
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov dword [edi], eax
cmp eax, 0xffffffff
jne 0x61b47c
cmp dword [esi + 0x14], 8
jb 0x61b405
mov esi, dword [esi]
push 0
push 0x200080
push 1
push 0
push 3
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov dword [edi], eax
cmp eax, 0xffffffff
jne 0x61b43b
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0067d681
mov esp, ebp
pop ebp
ret 4
cmp dword [ebx + 0x8c], 1
push 0
jne 0x61b45d
mov ecx, 0xfeff
mov word [esp + 0x10], cx
lea ecx, [esp + 0x14]
push ecx
push 2
lea ecx, [esp + 0x18]
jmp 0x61b474
lea ecx, [esp + 0x14]
mov word [esp + 0x10], 0xbbef
push ecx
mov byte [esp + 0x16], 0xbf
lea ecx, [esp + 0x14]
push 3
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov ecx, dword [esp + 0x14]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0067d681
mov esp, ebp
pop ebp
ret 4
Function at 0x61b8e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x82f084]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
mov esi, edi
lea ecx, [esi + 2]
nop dword [eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x61b900
push 2
push 0
push 0
push dword [ebx + 0x68]
sub esi, ecx
sar esi, 1
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
add esi, esi
push esi
push edi
push dword [ebx + 0x68]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 4
push 0x78135c
push dword [ebx + 0x68]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0067d681
mov esp, ebp
pop ebp
ret 4

Function at 0x61b970
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x82f084]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ebx
push edi
mov edi, ecx
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x61b990
push 2
push 0
push 0
push dword [edi + 0x68]
sub esi, ecx
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push esi
push ebx
push dword [edi + 0x68]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 2
push 0x7d3854
push dword [edi + 0x68]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0067d681
mov esp, ebp
pop ebp
ret 4
Function at 0x61d040
Capabilities:
Check if file exists
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7063f0
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x82f084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea esi, [edi + 0x4c]
push esi
lea ecx, [ebp - 0x28]
call fcn.0042fc50
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.00519940
xor eax, eax
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
call fcn.006470f0
lea eax, [ebp - 0x58]
mov edx, 0x75c170
push eax
lea ecx, [ebp - 0x70]
call fcn.00439e80
add esp, 4
mov byte [ebp - 4], 2
mov ecx, eax
cmp dword [eax + 0x14], 8
jb 0x61d0ca
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x28]
call fcn.0042ff20
lea ecx, [ebp - 0x70]
call fcn.0042fd70
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
lea edx, [ebp - 0x40]
mov byte [ebp - 4], 3
mov ecx, esi
call fcn.00647290
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.005199c0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
je 0x61d181
push 0
mov dl, 1
mov ecx, esi
call fcn.0061f720
add esp, 4
test eax, eax
jne 0x61d181
cmp dword [esi + 0x10], eax
je 0x61d181
cmp dword [ebp - 0x18], eax
je 0x61d181
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
cmp dword [esi + 0x14], 8
jb 0x61d151
mov esi, dword [esi]
push eax
push esi
call fcn.006a67c0
add esp, 8
test eax, eax
jne 0x61d181
lea ecx, [edi + 0xd4]
lea eax, [ebp - 0x28]
cmp ecx, eax
je 0x61d17d
cmp dword [ebp - 0x14], 8
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.0042fe00
mov bl, 1
jmp 0x61d183
xor bl, bl
lea ecx, [ebp - 0x40]
call fcn.0042fd70
lea ecx, [ebp - 0x58]
call fcn.0042fd70
lea ecx, [ebp - 0x28]
call fcn.0042fd70
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0067d681
mov esp, ebp
pop ebp
ret
Function at 0x61f720
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7065f0
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x82f084]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov bl, dl
mov esi, ecx
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x61f759
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x61f776
test eax, 0x400
je 0x61f776
mov eax, 1
jmp 0x61f843
cmp byte [ebp + 8], 0
je 0x61f7c9
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x61f786
mov eax, dword [esi]
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x61f7c9
lea eax, [ebp - 0x78]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileInformationByHandle]
test eax, eax
je 0x61f7c9
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [ebp - 0x50], 1
jbe 0x61f7c9
mov eax, 3
jmp 0x61f843
test bl, bl
je 0x61f841
push esi
lea ecx, [ebp - 0x2c]
call fcn.0042fc50
push esi
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 0
call fcn.0042fc50
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.0060f900
test al, al
je 0x61f831
mov edi, dword [ebp - 0x18]
lea eax, [ebp - 0x2c]
mov ebx, dword [ebp - 0x2c]
lea esi, [ebp - 0x44]
mov edx, dword [ebp - 0x34]
cmp edi, 8
cmovae eax, ebx
cmp dword [ebp - 0x30], 8
cmovae esi, dword [ebp - 0x44]
cmp edx, dword [ebp - 0x1c]
jne 0x61f85f
test edx, edx
je 0x61f831
sub esi, eax
nop
mov cx, word [esi + eax]
cmp cx, word [eax]
jne 0x61f85f
add eax, 2
sub edx, 1
jne 0x61f820
lea ecx, [ebp - 0x44]
call fcn.0042fd70
lea ecx, [ebp - 0x2c]
call fcn.0042fd70
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0067d681
mov esp, ebp
pop ebp
ret
cmp edi, 8
lea eax, [ebp - 0x2c]
cmovae eax, ebx
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x61f87b
test eax, 0x400
jne 0x61f8a4
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
push dword [ebp - 0x1c]
cmovae eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x44]
push eax
call fcn.0042fe00
lea ecx, [ebp - 0x2c]
call fcn.0060f900
test al, al
jne 0x61f7f6
jmp 0x61f831
lea ecx, [ebp - 0x44]
call fcn.0042fd70
lea ecx, [ebp - 0x2c]
call fcn.0042fd70
mov eax, 2
jmp 0x61f843
Function at 0x626390
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x82f084]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ebx
mov word [ebp - 8], 0x500
push esi
test ecx, ecx
jne 0x6263cf
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
mov esi, eax
mov dword [ebp - 0x1c], esi
jmp 0x6263e2
push ecx
push 0
push 0x400
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov esi, eax
mov dword [ebp - 0x1c], eax
test esi, esi
jne 0x626404
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
jne 0x626404
lea eax, [esi + 1]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0067d681
mov esp, ebp
pop ebp
ret
push edi
lea eax, [ebp - 0x14]
xor edi, edi
push eax
push 8
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x6264b4
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push edi
push 2
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x62643e
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x7a
jne 0x6264b4
push dword [ebp - 0x10]
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push ebx
push 2
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x6264b4
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x6264b4
xor edi, edi
cmp dword [ebx], edi
jbe 0x6264b2
lea esi, [ebx + 8]
push dword [esi - 4]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x6264a7
test byte [esi], 4
jne 0x6264f9
inc edi
add esi, 8
cmp edi, dword [ebx]
jb 0x626492
mov esi, dword [ebp - 0x1c]
xor edi, edi
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x6264c2
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
test ebx, ebx
je 0x6264cd
push ebx
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x6264db
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
test esi, esi
je 0x6264e6
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0067d681
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x1c]
mov edi, 1
jmp 0x6264b4
Function at 0x628020
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x82f084]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
lea eax, [esp + 8]
mov dword [esp + 8], 0
push eax
push 0x20
mov bl, cl
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x628077
lea eax, [esp + 0xc]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x628089
push dword [esp + 8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor al, al
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0067d681
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0xc]
mov ecx, 2
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
xor eax, eax
push 0
test bl, bl
mov dword [esp + 0x18], 1
push 0
cmovne eax, ecx
push 0
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x20]
push eax
push 0
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [esp + 8]
test eax, eax
je 0x628071
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [esp + 0x24]
mov al, 1
pop ebx
xor ecx, esp
call fcn.0067d681
mov esp, ebp
pop ebp
ret