joyce8/EMBER2024-capa huggingface dataset:
Function at 0x724154
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff2c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xd4], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x7242ea
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xd0]
mov eax, esi
call fcn.00724864
mov eax, ebx
call fcn.005057ec
dec al
je 0x724198
dec al
je 0x7241a1
jmp 0x7241aa
mov byte [ebp - 0xb7], 2
jmp 0x7241b1
mov byte [ebp - 0xb7], 1
jmp 0x7241b1
mov byte [ebp - 0xb7], 0
mov eax, dword [ebp - 0xcc]
or eax, 0x80000000
or eax, 1
or eax, 2
or eax, 4
or eax, 8
or eax, 0x20000000
or eax, 0x40000000
mov dword [ebp - 0xcc], eax
mov eax, ebx
call fcn.00505758
shl eax, 2
lea eax, [eax + eax*4]
mov dword [ebp - 0xc4], eax
mov edi, dword [ebx + 0x18]
cmp edi, 0xff000008
je 0x7241fe
cmp edi, 0x20000000
jne 0x72420a
or dword [ebp - 0xc8], 0x40000000
jmp 0x724217
mov eax, edi
call fcn.00504c80
mov dword [ebp - 0xbc], eax
mov eax, ebx
call fcn.005057a0
test al, 1
je 0x724229
or dword [ebp - 0xc8], 1
mov eax, ebx
call fcn.005057a0
test al, 2
je 0x72423b
or dword [ebp - 0xc8], 2
mov eax, ebx
call fcn.005057a0
test al, 4
je 0x72424d
or dword [ebp - 0xc8], 4
mov eax, ebx
call fcn.005057a0
test al, 8
je 0x72425f
or dword [ebp - 0xc8], 8
lea edx, [ebp - 0xd4]
mov eax, ebx
call fcn.005056e4
mov edx, dword [ebp - 0xd4]
lea eax, [ebp - 0xb6]
mov ecx, 0x40
call fcn.00431688
or dword [ebp - 0xcc], 0x8000000
mov eax, ebx
call fcn.00505874
mov byte [ebp - 0xb8], al
lea eax, [ebp - 0x5c]
push eax
push 0x5c
mov eax, ebx
call fcn.00505450
push eax
call sub.gdi32.dll_GetObjectW
test eax, eax
je 0x7242c2
or dword [ebp - 0xcc], 0x400000
movzx eax, word [ebp - 0x4c]
mov word [ebp - 0x76], ax
lea edx, [ebp - 0xd0]
mov eax, esi
call fcn.007248c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7242f1
lea eax, [ebp - 0xd4]
call fcn.0040b8b4
pop eax
jmp eax
Function at 0x725aac
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
mov ebx, 0x8d68bc
xor eax, eax
push ebp
push 0x725c60
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x9781b4], 1
mov edx, 0x8000
mov eax, 0x725c7c
call fcn.0043bde8
mov dword [ebx], eax
cmp dword [ebx], 0
jbe 0x725af7
cmp dword [ebx], 0x20
jae 0x725af7
xor eax, eax
mov dword [ebx], eax
jmp 0x725b01
mov dword [0x9781b4], 4
cmp dword [ebx], 0
jne 0x725b31
mov edx, 0x8000
mov eax, 0x725ca4
call fcn.0043bde8
mov dword [ebx], eax
cmp dword [ebx], 0
jbe 0x725b27
cmp dword [ebx], 0x20
jae 0x725b27
xor eax, eax
mov dword [ebx], eax
jmp 0x725b31
mov dword [0x9781b4], 2
cmp dword [ebx], 0
jne 0x725b6c
mov dword [0x9781b4], 1
mov edx, 0x8000
mov eax, 0x725ccc
call fcn.0043bde8
mov dword [ebx], eax
cmp dword [ebx], 0
jbe 0x725c48
cmp dword [ebx], 0x20
jae 0x725c48
xor eax, eax
mov dword [ebx], eax
jmp 0x725c48
lea edx, [ebp - 4]
mov eax, dword [ebx]
call fcn.0043b1f4
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040c824
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x725c48
mov eax, ebx
call fcn.00407160
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x725c41
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x725c29
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x725ce8
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x725c29
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
mov eax, ecx
and eax, 0xffff0000
cmp eax, 0x50000
jne 0x725c05
and ecx, 0xffff
mov eax, 0xcccccccd
mul ecx
shr edx, 3
mov dword [0x9781b4], edx
jmp 0x725c16
cmp eax, 0xc0000
jne 0x725c16
mov dword [0x9781b4], 6
cmp dword [0x9781b4], 0
jne 0x725c29
mov dword [0x9781b4], 2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x725c48
mov eax, dword [ebp - 0xc]
call fcn.0040717c
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x725c67
lea eax, [ebp - 4]
call fcn.0040b8b4
pop eax
jmp eax
Function at 0x730550
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov byte [ebp - 1], 0
xor edx, edx
push ebp
push 0x730644
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 8]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
mov ebx, eax
test ebx, ebx
jne 0x7305a3
call sub.kernel32.dll_GetLastError
cmp eax, 0x3f0
jne 0x7305a3
lea eax, [ebp - 8]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov ebx, eax
test ebx, ebx
je 0x73063a
mov eax, 0x400
call fcn.00407160
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x400
push esi
push 2
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_GetTokenInformation
mov ebx, eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
test ebx, ebx
je 0x730633
mov dword [ebp - 0x14], 0x8d68d4
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_AllocateAndInitializeSid
mov ebx, dword [esi]
dec ebx
test ebx, ebx
jl 0x73062a
inc ebx
xor edi, edi
mov eax, dword [esi + edi*8 + 4]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x730626
mov byte [ebp - 1], 1
jmp 0x73062a
inc edi
dec ebx
jne 0x73060e
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_FreeSid
mov eax, esi
call fcn.0040717c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x730652
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x730668
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
xor edx, edx
push ebp
push 0x730771
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x58]
push eax
call sub.kernel32.dll_GetStartupInfoW
lea eax, [ebp - 4]
push eax
call sub.kernel32.dll_WTSGetActiveConsoleSessionId
push eax
call sub.WTSAPI32.DLL_WTSQueryUserToken
test eax, eax
je 0x730767
xor edx, edx
push ebp
push 0x73075b
push dword fs:[edx]
mov dword fs:[edx], esp
or esi, 0xffffffff
test esi, esi
je 0x730751
mov eax, 0x400
call fcn.00407160
mov edi, eax
lea eax, [ebp - 8]
push eax
push 0x400
push edi
push 2
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_GetTokenInformation
mov esi, eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle
test esi, esi
je 0x73074a
mov dword [ebp - 0x14], 0x8d68d4
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_AllocateAndInitializeSid
mov esi, dword [edi]
dec esi
test esi, esi
jl 0x730741
inc esi
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [edi + eax*8 + 4]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x73073b
mov bl, 1
jmp 0x730741
inc dword [ebp - 0x10]
dec esi
jne 0x730722
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_FreeSid
mov eax, edi
call fcn.0040717c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x730767
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x73077d
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x730a58
Capabilities:
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x730a60
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x730d32
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.0040b8d8
xor edx, edx
push ebp
push 0x730b64
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 1
push 0
push 0
call sub.WTSAPI32.DLL_WTSEnumerateSessionsW
test eax, eax
jne 0x730aae
call fcn.0043b224
xor edx, edx
push ebp
push 0x730b53
push dword fs:[edx]
mov dword fs:[edx], esp
cmp dword [ebp - 0x14], 0
jbe 0x730b3a
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
dec esi
test esi, esi
jb 0x730b3a
inc esi
cmp byte [ebx + 8], 0
jne 0x730b34
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push 5
mov eax, dword [ebx]
push eax
push 0
call sub.WTSAPI32.DLL_WTSQuerySessionInformationW
test eax, eax
je 0x730b34
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x730b34
cmp word [eax], 0
je 0x730b34
cmp dword [ebp - 4], 0
je 0x730b0c
lea eax, [ebp - 4]
mov edx, 0x730d4c
call fcn.0040c0e8
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
mov ecx, 0
call fcn.0040c038
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 4]
call fcn.0040c0e8
lea eax, [ebp - 8]
mov edx, 0x730d5c
call fcn.0040bd94
add ebx, 0xc
dec esi
jne 0x730ace
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x730b5a
mov eax, dword [ebp - 0x10]
push eax
call sub.WTSAPI32.DLL_WTSFreeMemory
pop eax
jmp eax

Function at 0x7313ac
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x7313d9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, dword [ebp - 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x7313e8
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x744a9c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf4
mov ebx, edx
push esp
push 0
push 0
push eax
push 0
call sub.shell32.dll_SHGetFolderPathW
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.0040c8d8
add esp, 0x20c
pop ebx
ret

Function at 0x7450dc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov ebx, ecx
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x7451d3
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x7451b1
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 4]
mov edx, edi
call fcn.0040bcec
lea eax, [ebp - 0x4c]
push eax
call sub.kernel32.dll_GetStartupInfoW
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_WTSGetActiveConsoleSessionId
push eax
call sub.WTSAPI32.DLL_WTSQueryUserToken
test eax, eax
je 0x7451a7
test esi, esi
je 0x745165
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0x10
push 0
push 0
push 0
mov eax, esi
call fcn.0040c824
push eax
push 0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CreateProcessAsUserW
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x745193
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0x10
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040c824
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CreateProcessAsUserW
cmp eax, 1
sbb eax, eax
inc eax
cmp bl, 1
jne 0x7451a7
test al, al
je 0x7451a7
push 0xffffffffffffffff
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_WaitForSingleObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x7451bb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7451da
lea eax, [ebp - 4]
call fcn.0040b8b4
pop eax
jmp eax

Function at 0x7451e4
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf4
mov ebx, edx
push esp
push 0
push 0
push eax
push 0
call sub.shell32.dll_SHGetFolderPathW
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.0040c8d8
add esp, 0x20c
pop ebx
ret
Function at 0x745b00
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
xor ecx, ecx
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040b9a8
mov eax, dword [ebp - 8]
call fcn.0040b9a8
xor eax, eax
push ebp
push 0x745d2a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
push 0x745d3c
push 0x745d5c
call sub.user32.dll_FindWindowW
test eax, eax
jne 0x745b53
call sub.kernel32.dll_GetLastError
jmp 0x745d00
lea edx, [ebp - 0x10]
push edx
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [ebp - 0x10]
push eax
push 0
push 0x400
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x745b80
call sub.kernel32.dll_GetLastError
jmp 0x745d00
xor edx, edx
push ebp
push 0x745cf9
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x18]
push eax
push 0xf01ff
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x745bb3
call sub.kernel32.dll_GetLastError
call fcn.0040b014
jmp 0x745d00
lea eax, [ebp - 0x60]
xor ecx, ecx
mov edx, 0x44
call fcn.00408280
mov dword [ebp - 0x60], 0x44
mov dword [ebp - 0x34], 1
mov word [ebp - 0x30], 1
mov eax, 0x745d6c
mov dword [ebp - 0x58], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
push 0
mov eax, dword [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
call sub.Userenv.dll_CreateEnvironmentBlock
xor edx, edx
push ebp
push 0x745cd9
push dword fs:[edx]
mov dword fs:[edx], esp
cmp dword [ebp - 8], 0
je 0x745c65
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
mov eax, dword [ebp - 0x1c]
push eax
push 0x400
push 0
push 0
push 0
push 0x745d98
push dword [ebp - 4]
push 0x745d98
push 0x745da8
push dword [ebp - 8]
push 0x745d98
lea eax, [ebp - 0x74]
mov edx, 6
call fcn.0040cb14
mov eax, dword [ebp - 0x74]
call fcn.0040c824
push eax
push 0
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_CreateProcessAsUserW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
jmp 0x745cb5
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
mov eax, dword [ebp - 0x1c]
push eax
push 0x400
push 0
push 0
push 0
push 0x745d98
push dword [ebp - 4]
push 0x745d98
lea eax, [ebp - 0x78]
mov edx, 3
call fcn.0040cb14
mov eax, dword [ebp - 0x78]
call fcn.0040c824
push eax
push 0
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_CreateProcessAsUserW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x745cc0
call sub.kernel32.dll_GetLastError
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x745ce0
mov eax, dword [ebp - 0x1c]
push eax
call sub.Userenv.dll_DestroyEnvironmentBlock
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x745d31
lea eax, [ebp - 0x78]
mov edx, 2
call fcn.0040b914
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040b914
pop eax
jmp eax
Function at 0x753368
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], eax
xor eax, eax
push ebp
push 0x75342c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x753405
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x3c], 0x3c
xor eax, eax
mov dword [ebp - 0x38], eax
call sub.user32.dll_GetForegroundWindow
mov dword [ebp - 0x34], eax
mov eax, 0x75343c
mov dword [ebp - 0x30], eax
lea edx, [ebp - 0x44]
mov eax, dword [0x8dd49c]
mov eax, dword [eax]
call fcn.005e982c
mov eax, dword [ebp - 0x44]
lea edx, [ebp - 0x40]
call fcn.00431214
mov eax, dword [ebp - 0x40]
call fcn.0040c824
mov dword [ebp - 0x2c], eax
mov eax, 0x753448
mov dword [ebp - 0x28], eax
mov eax, 0x753468
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 1
xor eax, eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x3c]
push eax
call sub.shell32.dll_ShellExecuteExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x75340f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x753433
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.0040b914
pop eax
jmp eax

Function at 0x75346c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], eax
xor eax, eax
push ebp
push 0x753528
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x753501
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x3c], 0x3c
xor eax, eax
mov dword [ebp - 0x38], eax
call sub.user32.dll_GetForegroundWindow
mov dword [ebp - 0x34], eax
lea edx, [ebp - 0x44]
mov eax, dword [0x8dd49c]
mov eax, dword [eax]
call fcn.005e982c
mov eax, dword [ebp - 0x44]
lea edx, [ebp - 0x40]
call fcn.00431214
mov eax, dword [ebp - 0x40]
call fcn.0040c824
mov dword [ebp - 0x2c], eax
mov eax, 0x753538
mov dword [ebp - 0x28], eax
mov eax, 0x753558
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 1
xor eax, eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x3c]
push eax
call sub.shell32.dll_ShellExecuteExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x75350b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x75352f
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.0040b914
pop eax
jmp eax
Function at 0x753898
Capabilities:
Query service status
Start service

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe0
xor ebx, ebx
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov ebp, eax
test ebp, ebp
je 0x75391f
push 0xf01ff
push 0x75392c
push ebp
call sub.advapi32.dll_OpenServiceW
mov esi, eax
test esi, esi
je 0x753919
push esp
push 0
push esi
call sub.advapi32.dll_StartServiceW
xor edi, edi
jmp 0x7538fb
mov eax, dword [0x8dd49c]
mov eax, dword [eax]
call fcn.005e8ba0
cmp dword [esp + 8], 2
jne 0x75390a
push 0x3e8
call sub.kernel32.dll_Sleep
inc edi
cmp edi, 0xa
jg 0x75390a
lea eax, [esp + 4]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
jne 0x7538d8
cmp dword [esp + 8], 4
jne 0x753913
mov bl, 1
push esi
call sub.advapi32.dll_CloseServiceHandle
push ebp
call sub.advapi32.dll_CloseServiceHandle
mov eax, ebx
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x75394c
Capabilities:
Query service status
Stop service

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe4
push 1
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov ebx, eax
test ebx, ebx
jbe 0x7539c2
push 0x24
push 0x7539d4
push ebx
call sub.advapi32.dll_OpenServiceW
mov esi, eax
test esi, esi
jbe 0x7539c2
push esp
push 1
push esi
call sub.advapi32.dll_ControlService
test eax, eax
je 0x7539bc
push esp
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x7539b6
jmp 0x7539af
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
push eax
call sub.kernel32.dll_Sleep
push esp
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x7539b6
cmp edi, dword [esp + 0x14]
ja 0x7539b6
cmp dword [esp + 4], 1
jne 0x753990
push esi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
cmp dword [esp + 4], 1
sete al
add esp, 0x1c
pop edi
pop esi
pop ebx
ret
Function at 0x7539f4
Capabilities:
Compare security identifiers

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov byte [esp], 0
lea eax, [esp + 4]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
mov ebx, eax
test ebx, ebx
jne 0x753a38
call sub.kernel32.dll_GetLastError
cmp eax, 0x3f0
jne 0x753a38
lea eax, [esp + 4]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov ebx, eax
test ebx, ebx
je 0x753ad8
mov eax, 0x400
call fcn.00407160
mov esi, eax
lea eax, [esp + 8]
push eax
push 0x400
push esi
push 2
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_GetTokenInformation
mov ebx, eax
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_CloseHandle
test ebx, ebx
je 0x753ad1
mov eax, 0x8d6940
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
mov eax, dword [esp + 0x38]
push eax
call sub.advapi32.dll_AllocateAndInitializeSid
mov ebx, dword [esi]
dec ebx
test ebx, ebx
jl 0x753ac7
inc ebx
xor edi, edi
mov eax, dword [esi + edi*8 + 4]
push eax
mov eax, dword [esp + 0x10]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x753ac3
mov byte [esp], 1
jmp 0x753ac7
inc edi
dec ebx
jne 0x753aaa
mov eax, dword [esp + 0xc]
push eax
call sub.advapi32.dll_FreeSid
mov eax, esi
call fcn.0040717c
movzx eax, byte [esp]
add esp, 0x14
pop edi
pop esi
pop ebx
ret

Function at 0x753ae4
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffeec
mov dword [esp], 0x114
push esp
call sub.kernel32.dll_GetVersionExW
xor eax, eax
mov edx, dword [esp + 0x10]
sub edx, 2
jne 0x753b0b
cmp dword [esp + 4], 6
jb 0x753b0b
mov al, 1
add esp, 0x114
ret
Function at 0x759418
Capabilities:
Connect to http server
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbec
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
lea ebx, [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
call fcn.004baef4
xor eax, eax
push ebp
push 0x759573
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov byte [eax], 0
push 0
push 0
push 0
push 0
push 0x759590
call sub.wininet.dll_InternetOpenW
mov dword [ebp - 0xc], eax
push 0
push 0
push 3
push 0x759590
push 0x759590
push 0x1bb
mov eax, esi
call fcn.0040c824
mov edi, eax
push edi
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetConnectW
xor eax, eax
push ebp
push 0x759562
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80000000
push 0
push 0
push edi
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetOpenUrlW
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x759542
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x759522
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
push 0x400
lea eax, [ebp - 0x414]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetReadFile
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
mov cx, 2
xor edx, edx
mov esi, dword [eax]
call dword [esi + 0x30]
mov ecx, dword [ebx]
lea edx, [ebp - 0x414]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
mov esi, dword [eax]
call dword [esi + 0x1c]
cmp dword [ebx], 0
jne 0x7594cd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x759529
mov eax, dword [ebp - 8]
mov byte [eax], 1
pop eax
jmp eax