joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43d83c
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004070dc
xor eax, eax
push ebp
push 0x43d939
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x43d923
xor eax, eax
push ebp
push 0x43d91c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.00407180
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_OpenServiceW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x43d8ac
call fcn.00406094
jmp 0x43d923
xor eax, eax
push ebp
push 0x43d8fe
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x65
lea eax, [ebp - 0x28]
push eax
push 1
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_ControlService
push 1
call sub.kernel32.dll_Sleep_2
cmp dword [ebp - 0x24], 1
je 0x43d8de
dec ebx
jne 0x43d8bf
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_DeleteService
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43d905
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43d940
lea eax, [ebp - 4]
call fcn.004070e4
ret

Function at 0x43d948
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
push esp
push 0
push 0
push ebx
push 0
call sub.shell32.dll_SHGetFolderLocation
test eax, eax
jne 0x43d98a
cmp dword [esp], 0
je 0x43d98a
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.004072dc
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x43da00
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
xor eax, eax
push ebp
push 0x43da8f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x43daa8
call fcn.0043d83c
push 0xa
call sub.kernel32.dll_Sleep_2
lea edx, [ebp - 8]
mov eax, 0x24
call fcn.0043d948
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0x43dacc
call fcn.004075a4
mov ebx, 0x64
mov eax, dword [ebp - 4]
call fcn.0043d994
test al, al
je 0x43da6d
mov eax, dword [ebp - 4]
call fcn.00407180
push eax
call sub.kernel32.dll_DeleteFileW
push 0xa
call sub.kernel32.dll_Sleep_2
dec ebx
jne 0x43da49
push 0xa
call sub.kernel32.dll_Sleep_2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43da96
lea eax, [ebp - 8]
mov edx, 2
call fcn.004070ec
ret
Function at 0x43daf8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffbe4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x141c], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004070dc
xor eax, eax
push ebp
push 0x43dc3a
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 8]
lea eax, [ebp - 0x1018]
mov edx, 0x1000
call fcn.0043d780
test eax, eax
je 0x43dc19
shr dword [ebp - 8], 2
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x43dc19
inc eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1018]
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x43dc02
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
push eax
push 0
push 0x411
call sub.kernel32.dll_OpenProcess
mov ebx, eax
test ebx, ebx
je 0x43dbf8
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0xc]
mov ecx, 4
mov eax, ebx
call fcn.0043d7a4
test eax, eax
je 0x43dbf8
lea eax, [ebp - 0x1418]
xor ecx, ecx
mov edx, 0x400
call fcn.00404ae0
push 0x200
lea ecx, [ebp - 0x1418]
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.0043d7d4
lea eax, [ebp - 0x141c]
lea edx, [ebp - 0x1418]
mov ecx, 0x200
call fcn.004072dc
mov edx, dword [ebp - 0x141c]
mov eax, dword [ebp - 4]
call fcn.00407aec
test eax, eax
jle 0x43dbf8
push 0
push ebx
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43dc0c
add dword [ebp - 0x18], 4
dec dword [ebp - 0x14]
jne 0x43db64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43dc41
lea eax, [ebp - 0x141c]
call fcn.004070e4
lea eax, [ebp - 4]
call fcn.004070e4
ret

Function at 0x43e308
Capabilities:
Create process on windows
Manipulate boot configuration

Disassembly:
push ecx
push esp
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.Kernel32.dll_IsWow64Process
test eax, eax
je 0x43e353
cmp dword [esp], 0
je 0x43e353
push 5
push 0
push 0x43e358
push 0x43e3b0
push 0x43e3c8
push 0
call sub.shell32.dll_ShellExecuteW
push 5
push 0
push 0x43e3d4
push 0x43e3b0
push 0x43e3c8
push 0
call sub.shell32.dll_ShellExecuteW
pop edx
ret
Function at 0x4422e4
Capabilities:
Copy file
Create process on windows
Delete file
Set console window title

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4422ec
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4446f0]
mov byte [eax], 1
mov eax, 0x43e44c
call fcn.0040a9e4
xor eax, eax
push ebp
push 0x4425b4
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x442520
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x4425c4
call sub.kernel32.dll_SetConsoleTitleW
push 0xc
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_SetConsoleTextAttribute
call sub.Kernel32.dll_GetConsoleWindow
mov ebx, eax
test ebx, ebx
jle 0x442399
push 0xfffffffffffffff0
push ebx
call sub.user32.dll_GetWindowLongW
and eax, 0xfff4ffff
push eax
push 0xfffffffffffffff0
push ebx
call sub.user32.dll_SetWindowLongW
push 0x37
push 0
push 0
push 0
push 0
push 0
push ebx
call sub.user32.dll_SetWindowPos
push 0
push ebx
call sub.user32.dll_GetSystemMenu
mov ebx, eax
push 1
push 0xf060
push 0xf060
call sub.user32.dll_RemoveMenu
push 1
push 0xf060
push ebx
call sub.user32.dll_EnableMenuItem
call fcn.0043e308
mov eax, 0x442634
call fcn.00415d34
mov byte [0x44a038], al
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00404598
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.004101ec
mov eax, dword [ebp - 0x14]
call fcn.0041037c
xor edx, edx
mov eax, 0x44264c
call fcn.00439fd8
mov ecx, 0x442674
mov edx, 0x44269c
mov eax, 0x4426d4
call fcn.0043e124
xor edx, edx
mov eax, 0x4426e8
call fcn.00439fd8
call fcn.0043e040
call fcn.0043dc6c
xor edx, edx
mov eax, 0x442710
call fcn.00439fd8
push 0
push 0
push 0
push 0x44a03c
call sub.cfgmgr32.dll_CM_Locate_DevNode_ExW
test eax, eax
jne 0x44242f
push 0
push 0
mov eax, dword [0x44a03c]
push eax
call sub.cfgmgr32.dll_CM_Reenumerate_DevNode_Ex
mov ecx, 0x442744
mov edx, 0x442768
mov eax, 0x4427a0
call fcn.0043e124
mov ecx, 0x442744
mov edx, 0x4427b4
mov eax, 0x4427a0
call fcn.0043e124
mov ecx, 0x442744
mov edx, 0x4427ec
mov eax, 0x4427a0
call fcn.0043e124
call fcn.0043da00
mov eax, 0x442824
call fcn.0043daf8
mov eax, 0x442848
call fcn.0043daf8
lea eax, [ebp - 0x1c]
call fcn.0043dc48
lea eax, [ebp - 0x1c]
mov edx, 0x44286c
call fcn.004074e4
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], ebx
mov eax, dword [ebp - 0x20]
call fcn.00407180
push eax
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb eax, eax
inc eax
push 0
lea eax, [ebp - 0x24]
call fcn.0043dc48
lea eax, [ebp - 0x24]
mov edx, 0x44286c
call fcn.004074e4
mov eax, dword [ebp - 0x24]
call fcn.00407180
push eax
push 0x44289c
call sub.kernel32.dll_CopyFileW
push 0x64
call sub.kernel32.dll_Sleep_1
push 0
push 0
push 0
lea eax, [ebp - 0x28]
call fcn.0043dc48
lea eax, [ebp - 0x28]
mov edx, 0x44286c
call fcn.004074e4
mov eax, dword [ebp - 0x28]
call fcn.00407180
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteW
call fcn.0043cf74
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x44258c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4425bb
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.004070ec
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.004070ec
ret
Function at 0x48001123
Capabilities:
Persist via appinit_dlls registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
xor esi, esi
push esi
push 0x2001f
push esi
push esi
push str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
push 0x80000002
xor edi, edi
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
call fcn.48002187
test eax, eax
jne 0x4800128a
mov ebx, str.AppInit_DLLs
push ebx
lea eax, [ebp - 4]
mov dword [ebp - 8], esi
push eax
lea esi, [ebp - 8]
call fcn.4800212a
mov eax, dword [ebp - 8]
test eax, eax
jbe 0x4800128a
lea eax, [eax + eax + 2]
push eax
call fcn.48006340
mov edi, eax
test edi, edi
pop ecx
mov dword [ebp - 0x10], edi
jne 0x480011a8
push eax
call fcn.4800606e
cmp dword [ebp - 4], edi
pop ecx
je 0x4800119e
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x8007000e
jmp 0x4800129b
push ebx
lea eax, [ebp - 4]
push eax
lea esi, [ebp - 8]
call fcn.4800212a
test eax, eax
je 0x480011df
call fcn.4800211b
push dword [ebp - 0x10]
mov esi, eax
call fcn.4800606e
cmp dword [ebp - 4], 0
pop ecx
je 0x480011d8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x4800129b
mov esi, dword [ebp - 0x10]
jmp 0x48001277
inc esi
inc esi
cmp word [esi], 0x20
je 0x480011e7
xor ecx, ecx
mov cx, word [esi]
cmp cx, 0x22
mov edi, esi
mov dword [ebp - 8], ecx
je 0x4800120e
cmp cx, 0x27
je 0x4800120e
and dword [ebp - 8], 0
mov ecx, dword [ebp - 8]
jmp 0x48001227
lea edi, [esi + 2]
mov esi, edi
jmp 0x48001227
test cx, cx
je 0x4800121f
cmp cx, ax
jmp 0x48001223
cmp ax, 0x20
je 0x4800122f
inc edi
inc edi
mov ax, word [edi]
test ax, ax
jne 0x48001215
mov ecx, edi
sub ecx, esi
sar ecx, 1
test ecx, ecx
jle 0x48001275
push esi
mov eax, 0x48024198
lea ebx, [ebp - 0xc]
call fcn.48001a99
call fcn.48001a00
call fcn.48001a44
mov esi, dword [ebp + 8]
mov eax, ebx
push eax
call fcn.4800cf47
cmp word [ebp - 8], 0
mov esi, edi
je 0x48001268
lea esi, [edi + 2]
mov eax, dword [ebp - 0xc]
add eax, 0xfffffff0
call fcn.48001fbe
jmp 0x48001277
inc esi
inc esi
cmp word [esi], 0
jne 0x480011e9
push dword [ebp - 0x10]
call fcn.4800606e
pop ecx
cmp dword [ebp - 4], 0
je 0x48001299
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x480012a2
Capabilities:
Persist via appinit_dlls registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
lea ecx, [ebp - 4]
mov edi, eax
call fcn.480017fe
xor esi, esi
xor ebx, ebx
cmp dword [edi + 4], esi
jle 0x4800132c
push 0x20
mov eax, ebx
mov ecx, edi
call fcn.48001978
mov ecx, eax
xor eax, eax
call fcn.48001886
cmp eax, 0xffffffff
je 0x48001304
push 0x22
lea eax, [ebp - 4]
call fcn.48001c39
mov eax, ebx
mov ecx, edi
call fcn.48001978
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
lea eax, [ebp - 4]
push eax
call fcn.48001d00
push 0x22
lea eax, [ebp - 4]
call fcn.48001c39
jmp 0x4800131c
mov eax, ebx
mov ecx, edi
call fcn.48001978
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
lea eax, [ebp - 4]
push eax
call fcn.48001d00
push 0x20
lea eax, [ebp - 4]
call fcn.48001c39
inc ebx
cmp ebx, dword [edi + 4]
jl 0x480012bd
lea ebx, [ebp - 4]
call fcn.48001a00
call fcn.48001a44
push esi
push 0x2001f
push esi
push esi
push str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
push 0x80000002
xor edi, edi
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
call fcn.48002187
cmp eax, esi
jne 0x4800136f
push 1
push dword [ebp - 4]
lea eax, [ebp - 8]
push str.AppInit_DLLs
push eax
call fcn.480020f0
call fcn.4800211b
cmp dword [ebp - 8], esi
mov edi, eax
je 0x48001384
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
mov esi, edi
call fcn.48001fbe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x4800212a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
shl eax, 1
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x48002183
cmp dword [ebp + 0xc], 1
je 0x48002161
cmp dword [ebp + 0xc], 2
jne 0x48002178
test edi, edi
mov eax, dword [ebp - 4]
je 0x4800217d
test al, 1
jne 0x48002178
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x4800217d
push 0xd
pop eax
jmp 0x48002183
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 8
Function at 0x480021e3
Capabilities:
Parse pe header

Disassembly:
mov dword [esi + 4], eax
mov dword [esi], edi
push ebp
xor ebp, ebp
mov dword [esi + 8], ebp
mov dword [esi + 0xc], ebp
cmp eax, 0x40
mov dword [esi + 0x10], ebp
mov dword [esi + 0x14], ebp
mov dword [esi + 0xc], eax
sbb eax, eax
not eax
and eax, edi
cmp eax, ebp
mov dword [esi + 8], eax
je 0x4800226b
cmp word [eax], 0x5a4d
jne 0x4800226b
push 0x40
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x4800226b
mov eax, dword [edi + 0x3c]
push ebx
mov ebx, 0xf8
push ebx
add eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x4800226a
mov ecx, dword [edi + 0x3c]
mov eax, dword [esi + 8]
add ecx, edi
sub eax, ecx
add eax, dword [esi + 4]
cmp eax, ebx
mov dword [esi + 0x14], eax
sbb eax, eax
not eax
and eax, ecx
cmp eax, ebp
mov dword [esi + 0x10], eax
je 0x4800226a
cmp dword [eax], 0x4550
jne 0x48002264
cmp word [eax + 0x18], 0x10b
je 0x4800226a
mov dword [esi + 0x14], ebp
mov dword [esi + 0x10], ebp
pop ebx
cmp dword [esi + 0x10], ebp
jne 0x48002278
mov dword [esi + 0xc], ebp
mov dword [esi + 8], ebp
mov dword [esi], ebp
mov eax, esi
pop ebp
ret
Function at 0x480056c2
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
mov esi, eax
mov eax, dword [esi]
push edi
sub eax, 0x10
mov ebx, ecx
call fcn.48001ca6
add eax, 0x10
push 0x5f
mov dword [ebp - 8], eax
push 0x5c
lea eax, [ebp - 8]
push eax
call fcn.48004d8d
push str.MUTEX
lea eax, [ebp - 8]
lea edi, [ebp - 0xc]
call fcn.480058f7
mov eax, dword [eax]
pop ecx
push 1
push eax
mov edi, ebx
call fcn.48008212
neg al
sbb al, al
inc al
mov byte [ebp - 1], al
mov eax, dword [ebp - 0xc]
add eax, 0xfffffff0
call fcn.48001fbe
cmp byte [ebp - 1], 0
je 0x4800572a
xor bl, bl
jmp 0x48005842
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
cmp byte [ebp + 8], 0
mov byte [ebp - 0x1c], al
mov byte [ebx + 0x14], 0
je 0x48005774
mov eax, dword [esi]
xor esi, esi
push esi
push esi
push 4
push esi
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebx + 8], eax
je 0x48005817
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4800577a
mov byte [ebx + 0x14], 1
jmp 0x4800577a
or dword [ebx + 8], 0xffffffff
xor esi, esi
xor eax, eax
mov dword [ebp - 0x18], esi
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 1
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push esi
push esi
push 1
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push dword [ebp - 8]
mov edi, 0x2528
push edi
push esi
lea eax, [ebp - 0x38]
mov dword [ebp - 0x14], eax
push 4
lea eax, [ebp - 0x18]
push eax
push dword [ebx + 8]
mov dword [ebp - 0x18], 0xc
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
cmp eax, esi
mov dword [ebx + 0xc], eax
je 0x48005817
cmp dword [ebx + 8], 0xffffffff
jne 0x480057e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x480057e5
mov byte [ebx + 0x14], 1
push edi
push esi
push esi
push 6
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, esi
mov dword [ebx + 0x10], eax
jne 0x4800582d
push dword [ebx + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
mov eax, dword [ebx + 8]
cmp eax, 0xffffffff
mov dword [ebx + 0xc], esi
je 0x48005817
push eax
call edi
or dword [ebx + 8], 0xffffffff
cmp byte [ebp - 0x1c], 0
je 0x48005723
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 8]
jmp 0x48005723
cmp byte [ebx + 0x14], 0
jne 0x48005851
cmp byte [ebp - 0x1c], 0
je 0x48005840
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 8]
mov bl, 1
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.48001fbe
mov al, bl
jmp 0x480058a1
push dword [ebp - 8]
call fcn.4800e248
lea eax, [ebp - 8]
lea edi, [ebp + 8]
mov dword [esp], str.MUTEX
call fcn.480058f7
push dword [eax]
call fcn.4800e248
mov eax, dword [ebp + 8]
pop ecx
pop ecx
add eax, 0xfffffff0
call fcn.48001fbe
mov esi, dword [ebx + 0x10]
call fcn.480026ce
cmp byte [ebp - 0x1c], 0
je 0x48005894
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 8]
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.48001fbe
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x48005ed3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x48005eea
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x48005efc
xor eax, eax
jmp 0x48005f2d
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x48005f1f
cmp edi, eax
jae 0x48005ef8
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x48005f11
cmp edi, eax
jae 0x48005ef8
mov ax, word [edi]
neg ax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret

Function at 0x48006787
Capabilities:
Create directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push dword [ebp + 0xc]
and dword [ebp - 8], 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4800684f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x480067bd
mov dword [ebp - 8], 1
jmp 0x4800684f
push ebx
push esi
push edi
push dword [ebp + 8]
lea esi, [ebp - 4]
mov dword [ebp - 8], 0x80004005
call fcn.48004c5c
mov ebx, dword [ebp - 4]
mov eax, dword [ebx - 0xc]
lea esi, [eax - 1]
lea edi, [ebp - 4]
call fcn.48007c0d
push 0x5c
pop edi
cmp ax, di
jne 0x480067fb
mov eax, dword [ebx - 0xc]
dec eax
push eax
lea eax, [ebp - 4]
call fcn.48001c6b
mov ebx, dword [ebp - 4]
mov esi, ebx
call fcn.480020af
test eax, eax
je 0x4800683e
sub eax, ebx
sar eax, 1
cmp eax, 0xffffffff
je 0x4800683e
push eax
lea eax, [ebp - 4]
call fcn.48001c6b
push dword [ebp + 0xc]
mov ebx, dword [ebp - 4]
push ebx
call fcn.48006787
test eax, eax
pop ecx
pop ecx
jl 0x4800683e
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4800683e
and dword [ebp - 8], 0
lea eax, [ebx - 0x10]
call fcn.48001fbe
cmp dword [ebp - 8], 0
pop edi
pop esi
pop ebx
jl 0x4800685d
push 0x2000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [ebp - 8]
leave
ret

Function at 0x480072ef
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 0xc]
push ebx
push esi
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 8]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [ebp + 0xc]
mov esi, eax
call fcn.480017fe
push esi
lea eax, [ebp + 0xc]
call fcn.480018b0
push esi
push ebx
push eax
call fcn.4800b7a9
add esp, 0xc
mov eax, esi
lea ecx, [ebp + 0xc]
call fcn.480018d3
mov esi, dword [ebp + 0xc]
add esi, 0xfffffff0
mov eax, esi
call fcn.48001ca6
add eax, 0x10
mov dword [edi], eax
mov eax, esi
call fcn.48001fbe
pop esi
mov eax, edi
pop ebx
pop ebp
ret
Function at 0x4800751a
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
push ebx
push esi
push edi
lea ebx, [ebp - 4]
call fcn.480074ad
xor eax, eax
push 0x10
mov dword [ebp - 0x78], 0x44
pop ecx
lea edi, [ebp - 0x74]
rep stosd dword es:[edi], eax
xor ebx, ebx
mov dword [ebp - 0x34], ebx
lea edi, [ebp - 0x30]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor esi, esi
cmp dword [eax - 0xc], ebx
je 0x48007555
mov esi, eax
cmp dword [ebp + 0xc], ebx
jne 0x4800757f
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x78]
push eax
push esi
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x48007685
jmp 0x48007691
xor eax, eax
mov dword [ebp - 0x24], ebx
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
lea eax, [ebp - 8]
push eax
mov edi, 0x2000000
push edi
mov dword [ebp - 8], ebx
mov dword [ebp + 8], ebx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x48007691
mov eax, dword [ebp - 8]
lea ecx, [ebp + 8]
push ecx
push 1
push 2
push ebx
push edi
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x480075df
mov dword [ebp - 0x14], 0x4801bd4c
lea esi, [ebp - 0x14]
call fcn.48007e36
jmp 0x48007691
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_ConvertStringSidToSidW]
test eax, eax
je 0x4800764c
mov eax, dword [ebp - 0xc]
push eax
mov edi, eax
mov dword [ebp - 0x20], 0x20
mov dword [ebp - 0x24], eax
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
add eax, 8
push eax
lea eax, [ebp - 0x24]
push eax
push 0x19
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
jne 0x48007626
push edi
jmp 0x48007646
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x78]
push eax
push esi
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 4]
push ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
push edi
jne 0x48007664
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, 0x4801bd4c
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x1c], edi
call fcn.48007e36
mov dword [ebp - 0x14], edi
jmp 0x480075d2
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, 0x4801bd4c
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x1c], edi
call fcn.48007e36
lea esi, [ebp - 0x14]
mov dword [ebp - 0x14], edi
call fcn.48007e36
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0x34]
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.48001fbe
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x48007ada
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0xa
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor ecx, ecx
cmp ecx, eax
sbb eax, eax
neg eax
leave
ret