joyce8/EMBER2024-capa huggingface dataset:
Function at 0x448c80
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
call fcn.0048d383
mov ecx, esi
call fcn.00448d10
lea ecx, [esi + 0x4f8]
call fcn.0047e710
mov ecx, dword [0x6fb014]
mov eax, dword [ecx + 0x15c]
mov dword [esi + 0x45c], eax
mov eax, dword [ecx + 0x16c]
mov dword [esi + 0x458], eax
lea eax, [esi + 0x468]
push eax
push dword [esi + 0x404]
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
push 4
push 0
push 0
push esi
push 0x448ee0
call fcn.0048babd
mov dword [esi + 0x94], eax
mov dword [eax + 0x28], 0
mov eax, dword [esi + 0x94]
push dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
pop esi
ret

Function at 0x449e10
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d3e78
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x65a000]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 3
xor eax, eax
push 0x60e1b0
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
call fcn.004058d0
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0
mov ecx, dword [0x6fb010]
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ecx + 0x1c]
call fcn.00406e30
cmp dword [ebp - 0x2c], 8
jb 0x449e8a
push dword [ebp - 0x40]
call fcn.0048166b
add esp, 4
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push 0
push 0x6211c0
push str.USB_LAN_SETUP
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
test esi, esi
mov eax, 0xa
cmove esi, eax
cmp dword [ebp - 0x14], 8
jb 0x449ec5
push dword [ebp - 0x28]
call fcn.0048166b
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005a4646
mov esp, ebp
pop ebp
ret

Function at 0x44b330
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
call fcn.0048d383
mov ecx, esi
call fcn.0044b3b0
mov edx, dword [0x6fb014]
mov eax, dword [edx + 0x15c]
mov dword [esi + 0x46c], eax
mov eax, dword [edx + 0x16c]
mov dword [esi + 0x468], eax
lea eax, [esi + 0x478]
push eax
push dword [esi + 0x414]
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
push 4
push 0
push 0
push esi
push 0x44b810
call fcn.0048babd
mov dword [esi + 0x94], eax
mov dword [eax + 0x28], 0
mov eax, dword [esi + 0x94]
push dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
pop esi
ret
Function at 0x44b3b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5d1010
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x65a000]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [0x6fb018]
push 0
mov dword [eax], 0x6cdd20
mov dword [eax + 4], 7
lea eax, [edi + 0x3f4]
push eax
call fcn.0046b200
push 1
lea eax, [edi + 0x490]
push eax
call fcn.0046b200
mov ebx, dword [0x6fb018]
push 4
xor eax, eax
push str.LANG
lea ecx, [esp + 0x1c]
lea esi, [edi + 0xb4]
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
call fcn.004058d0
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x54], 0
mov ecx, dword [0x6fb010]
lea eax, [esp + 0x30]
push eax
add ecx, 0xc
call fcn.00406e30
push 6
push str.Arabic
mov byte [esp + 0x58], 1
push dword [eax + 0x10]
push ecx
mov ecx, eax
call fcn.00406530
test eax, eax
sete byte [esp + 0x13]
cmp dword [esp + 0x40], 8
jb 0x44b490
push dword [esp + 0x2c]
call fcn.0048166b
add esp, 4
xor eax, eax
mov dword [esp + 0x50], 0xffffffff
cmp dword [esp + 0x28], 8
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], 0
mov word [esp + 0x2c], ax
jb 0x44b4c2
push dword [esp + 0x14]
call fcn.0048166b
add esp, 4
xor eax, eax
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
mov word [esp + 0x14], ax
cmp byte [esp + 0x13], al
je 0x44b4ea
lea eax, [ebx + 0x2c]
push eax
push str.HEADER3_RTL.bmp
jmp 0x44b4f3
lea eax, [ebx + 0x1c]
push eax
push str.HEADER3.bmp
push esi
call fcn.0046ae50
mov esi, dword [0x6fb018]
cmp dword [esi + 0x34], 0
jne 0x44b512
push str.FOOTER.bmp
call fcn.00457520
mov dword [esi + 0x34], eax
push dword [esi + 0x34]
push 0
push 0x172
push dword [edi + 0x148]
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, dword [0x6f3f44]
mov eax, dword [0x6f3f4c]
mov edx, dword [0x6f3f40]
push 0
sub eax, esi
push eax
mov eax, dword [0x6f3f48]
sub eax, edx
push eax
push esi
push edx
lea ecx, [edi + 0x128]
call fcn.00488b7f
push 2
lea eax, [edi + 0x2f8]
push eax
call fcn.0046b200
push 3
lea eax, [edi + 0x370]
push eax
call fcn.0046b200
push 4
lea eax, [edi + 0x19c]
push eax
call fcn.0046b200
push 5
lea eax, [edi + 0x210]
push eax
call fcn.0046b200
push 6
lea eax, [edi + 0x284]
push eax
call fcn.0046b200
mov eax, dword [0x6fb018]
mov dword [eax], 0
mov dword [eax + 4], 0
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x454290
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x65a000]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0x40
lea eax, [ebp - 0x50]
xorps xmm0, xmm0
push 0
push eax
mov dword [ebp - 0x64], 0
movq qword [ebp - 0x60], xmm0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
call fcn.005a7690
add esp, 0xc
push esi
push str.CFuncMgr::ExecuteCommand_Install_Command:_s
push 0xffffffffffffffff
push 0x1000
push 0x6fb428
call fcn.005a4e29
add esp, 0x14
push 0x6fb428
call fcn.00415fc0
mov eax, 1
mov word [ebp - 0x24], ax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0x220
push 0
push 0
push 0
push esi
push 0
mov dword [ebp - 0x54], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
test esi, esi
je 0x454364
mov ecx, dword [ebp - 0x64]
test ecx, ecx
je 0x454364
cmp dword [ebp + 0x10], 0
je 0x454390
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test edi, edi
je 0x454390
push edi
push dword [ebp - 0x64]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [edi]
push str.CFuncMgr::ExecuteCommand_CreateProcess___ExitCode:0x_08x
call fcn.00416140
jmp 0x454390
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CFuncMgr::ExecuteCommand_CreateProcess___Failed_:0x_08x
push 0xffffffffffffffff
push 0x1000
push 0x6fb428
call fcn.005a4e29
add esp, 0x14
push 0x6fb428
call fcn.00415fc0
mov eax, dword [ebp - 0x60]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4543a0
push eax
call edi
mov ecx, dword [ebp - 0x64]
test ecx, ecx
je 0x4543aa
push ecx
call edi
mov ecx, dword [ebp - 8]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.005a4646
mov esp, ebp
pop ebp
ret 0xc
Function at 0x455ba0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d52b6
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x65a000]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 3
xor eax, eax
xor esi, esi
push 0x61218c
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x234], 7
mov dword [ebp - 0x238], esi
mov word [ebp - 0x248], ax
call fcn.004058d0
lea eax, [ebp - 0x248]
push eax
mov dword [ebp - 4], esi
mov ecx, dword [0x6fb010]
lea eax, [ebp - 0x230]
push eax
add ecx, 0x1c
call fcn.00406e30
mov byte [ebp - 4], 2
cmp dword [ebp - 0x234], 8
jb 0x455c35
push dword [ebp - 0x248]
call fcn.0048166b
add esp, 4
push 0x5c
xor eax, eax
push ecx
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x234], 7
mov dword [ebp - 0x238], 0
mov word [ebp - 0x248], ax
call fcn.004119a0
push 0x13
push str.FirewallSetting.dll
lea ecx, [ebp - 0x230]
call fcn.004057a0
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x455d7e
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
jne 0x455ce5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CFuncMgr::FirewallUnBlock_LoadLibrary___Failed:0x_08x
push 0xffffffffffffffff
push 0x1000
push 0x6fb428
call fcn.005a4e29
add esp, 0x14
push 0x6fb428
call fcn.00415fc0
jmp 0x455d7e
push str.AddFireawllSetting
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
jne 0x455d23
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CFuncMgr::FirewallUnBlock_GetProcAddress___Failed:0x_08x
push 0xffffffffffffffff
push 0x1000
push 0x6fb428
call fcn.005a4e29
add esp, 0x14
push 0x6fb428
call fcn.00415fc0
jmp 0x455d77
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.005a7690
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x60ec18
push 0x624144
push 0x62414c
lea eax, [ebp - 0x218]
push eax
call ebx
mov ecx, 1
test eax, eax
cmove esi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x21c], 8
jb 0x455d95
push dword [ebp - 0x230]
call fcn.0048166b
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005a4646
mov esp, ebp
pop ebp
ret
Function at 0x455dc0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d52b6
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x65a000]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 3
xor eax, eax
xor esi, esi
push 0x61218c
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x234], 7
mov dword [ebp - 0x238], esi
mov word [ebp - 0x248], ax
call fcn.004058d0
lea eax, [ebp - 0x248]
push eax
mov dword [ebp - 4], esi
mov ecx, dword [0x6fb010]
lea eax, [ebp - 0x230]
push eax
add ecx, 0x1c
call fcn.00406e30
mov byte [ebp - 4], 2
cmp dword [ebp - 0x234], 8
jb 0x455e55
push dword [ebp - 0x248]
call fcn.0048166b
add esp, 4
push 0x5c
xor eax, eax
push ecx
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x234], 7
mov dword [ebp - 0x238], 0
mov word [ebp - 0x248], ax
call fcn.004119a0
push 0x13
push str.FirewallSetting.dll
lea ecx, [ebp - 0x230]
call fcn.004057a0
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x455f94
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
jne 0x455f05
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CFuncMgr::FirewallBlock_LoadLibrary___Failed:0x_08x
push 0xffffffffffffffff
push 0x1000
push 0x6fb428
call fcn.005a4e29
add esp, 0x14
push 0x6fb428
call fcn.00415fc0
jmp 0x455f94
push str.RemoveFirewallSetting
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
jne 0x455f43
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CFuncMgr::FirewallBlock_GetProcAddress___Failed:0x_08x
push 0xffffffffffffffff
push 0x1000
push 0x6fb428
call fcn.005a4e29
add esp, 0x14
push 0x6fb428
call fcn.00415fc0
jmp 0x455f8d
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.005a7690
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x62414c
lea eax, [ebp - 0x218]
push eax
call ebx
mov ecx, 1
test eax, eax
cmove esi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x21c], 8
jb 0x455fab
push dword [ebp - 0x230]
call fcn.0048166b
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005a4646
mov esp, ebp
pop ebp
ret
Function at 0x456190
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x65a000]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
cmp dword [eax + 0x14], 8
jb 0x4561b3
mov eax, dword [eax]
lea ecx, [ebp - 0x25c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4561f5
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov edi, edi
test byte [ebp - 0x25c], 0x10
je 0x4561e9
lea eax, [ebp - 0x25c]
push eax
push esi
call ebx
test eax, eax
jne 0x4561d0
jmp 0x4561ee
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 8]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005a4646
mov esp, ebp
pop ebp
ret 4
Function at 0x457520
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d52f8
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x65a000]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push 6
xor eax, eax
push str.BITMAP
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x48], 7
mov dword [ebp - 0x4c], 0
mov word [ebp - 0x5c], ax
call fcn.004058d0
lea eax, [ebp - 0x5c]
mov dword [ebp - 4], 0
mov ecx, dword [0x6fb010]
push eax
lea eax, [ebp - 0x44]
push eax
lea ecx, [ecx + 0x1c]
call fcn.00406e30
mov byte [ebp - 4], 2
cmp dword [ebp - 0x48], 8
jb 0x4575a1
push dword [ebp - 0x5c]
call fcn.0048166b
add esp, 4
xor eax, eax
push 0x618734
lea edx, [ebp - 0x44]
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x48], 7
mov dword [ebp - 0x4c], 0
mov word [ebp - 0x5c], ax
call fcn.004062a0
push esi
mov edx, eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.00406060
add esp, 8
cmp dword [ebp - 0x60], 8
jb 0x4575e8
push dword [ebp - 0x74]
call fcn.0048166b
add esp, 4
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x457602
xor esi, esi
jmp 0x457620
cmp dword [ebp - 0x18], 8
push 0x10
push 0
push 0
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push 0
push eax
push 0
call dword [sym.imp.USER32.dll_LoadImageW]
mov esi, eax
cmp dword [ebp - 0x18], 8
jb 0x457631
push dword [ebp - 0x2c]
call fcn.0048166b
add esp, 4
xor eax, eax
cmp dword [ebp - 0x30], 8
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
jb 0x457656
push dword [ebp - 0x44]
call fcn.0048166b
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005a4646
mov esp, ebp
pop ebp
ret 4
Function at 0x457680
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d52f8
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x65a000]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push 9
xor eax, eax
push str.RES_MODEL
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x48], 7
mov dword [ebp - 0x4c], 0
mov word [ebp - 0x5c], ax
call fcn.004058d0
lea eax, [ebp - 0x5c]
mov dword [ebp - 4], 0
mov ecx, dword [0x6fb010]
push eax
lea eax, [ebp - 0x44]
push eax
lea ecx, [ecx + 0x1c]
call fcn.00406e30
mov byte [ebp - 4], 2
cmp dword [ebp - 0x48], 8
jb 0x457701
push dword [ebp - 0x5c]
call fcn.0048166b
add esp, 4
xor eax, eax
push 0x618734
lea edx, [ebp - 0x44]
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x48], 7
mov dword [ebp - 0x4c], 0
mov word [ebp - 0x5c], ax
call fcn.004062a0
add esp, 4
push esi
mov edx, eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.00406060
add esp, 4
cmp dword [ebp - 0x60], 8
jb 0x45774b
push dword [ebp - 0x74]
call fcn.0048166b
add esp, 4
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
lea eax, [ebp - 0x2c]
jne 0x457794
cmp dword [ebp - 0x18], 8
cmovae eax, dword [ebp - 0x2c]
push eax
push str.CFuncMgr::GetBmpHandleModel_PathFileExists___Failed___file_path:_s
push 0xffffffffffffffff
push 0x1000
push 0x6fb428
call fcn.005a4e29
add esp, 0x14
push 0x6fb428
call fcn.00415fc0
xor esi, esi
jmp 0x4577af
cmp dword [ebp - 0x18], 8
push 0x10
cmovae eax, dword [ebp - 0x2c]
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.USER32.dll_LoadImageW]
mov esi, eax
cmp dword [ebp - 0x18], 8
jb 0x4577c0
push dword [ebp - 0x2c]
call fcn.0048166b
add esp, 4
xor eax, eax
cmp dword [ebp - 0x30], 8
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
jb 0x4577e5
push dword [ebp - 0x44]
call fcn.0048166b
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005a4646
mov esp, ebp
pop ebp
ret 4
Function at 0x457f50
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x65a000]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
xorps xmm0, xmm0
push 0x28
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
movq qword [ebp - 0x10], xmm0
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea eax, [ebp - 0x10]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 0x18]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push SysReAllocString
push 1
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownExW]
test eax, eax
jne 0x457fe6
push eax
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x457ff4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005a4646
mov esp, ebp
pop ebp
ret

Function at 0x458170
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5d5490
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x65a000]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
mov eax, dword [0x65a000]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push 4
xor eax, eax
push str.LANG
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 7
mov dword [esp + 0x20], 0
mov word [esp + 0x10], ax
call fcn.004058d0
lea eax, [esp + 8]
push eax
mov dword [esp + 0x4c], 0
mov ecx, dword [0x6fb010]
lea eax, [esp + 0x24]
push eax
add ecx, 0xc
call fcn.00406e30
mov byte [esp + 0x48], 2
cmp dword [esp + 0x1c], 8
jb 0x458207
push dword [esp + 8]
call fcn.0048166b
add esp, 4
push 6
push str.Arabic
push dword [esp + 0x38]
xor eax, eax
push ecx
lea ecx, [esp + 0x30]
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], 0
mov word [esp + 0x18], ax
call fcn.00406530
push 0
mov ecx, esi
test eax, eax
jne 0x458243
push 0x400000
push eax
jmp 0x45824a
push 0
push 0x400000
call fcn.00488a5b
cmp dword [esp + 0x34], 8
jb 0x458262
push dword [esp + 0x20]
call fcn.0048166b
add esp, 4
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.005a4646
mov esp, ebp
pop ebp
ret 4
Function at 0x459980
Capabilities:
Access peb ldr_data
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d56e7
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x65a000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
lea ecx, [ebx + 0xc]
mov dword [ebx], vtable.CInfoMgr.0
call fcn.00406b50
lea ecx, [ebx + 0x1c]
mov dword [ebp - 4], 0
call fcn.00406b50
add ebx, 0x2c
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], ebx
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
call fcn.00413e20
mov dword [ebx + 4], eax
push 0
push 0
push 0
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push eax
mov dword [ebx], eax
call edi
mov eax, dword [ebx + 4]
push eax
push dword [eax]
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebx + 4]
call fcn.00412be0
push dword [ebx]
mov ebx, dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call ebx
mov esi, dword [ebp - 0x10]
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
push 0xffffffffffffffff
mov dword [esi + 4], 0
mov dword [esi + 8], 0
push dword [esi + 0x18]
call edi
mov eax, dword [esi + 0x10]
lea ecx, [esi + 0x10]
push dword [eax + 4]
call fcn.00408080
mov eax, dword [esi + 0x10]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x10]
mov dword [eax], eax
mov eax, dword [esi + 0x10]
mov dword [eax + 8], eax
mov dword [esi + 0x14], 0
push dword [esi + 0x18]
call ebx
push 0xffffffffffffffff
push dword [esi + 0x28]
call edi
mov eax, dword [esi + 0x20]
lea ecx, [esi + 0x20]
push dword [eax + 4]
call fcn.00408080
mov eax, dword [esi + 0x20]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x20]
mov dword [eax], eax
mov eax, dword [esi + 0x20]
mov dword [eax + 8], eax
mov dword [esi + 0x24], 0
push dword [esi + 0x28]
call ebx
push 0xffffffffffffffff
push dword [esi + 0x2c]
call edi
lea ecx, [esi + 0x30]
mov eax, dword [ecx]
push eax
push dword [eax]
lea eax, [ebp - 0x18]
push eax
call fcn.00412be0
push dword [esi + 0x2c]
call ebx
push dword [ebp - 0x18]
mov edx, dword [esi + 0x40]
push ecx
mov ecx, dword [esi + 0x3c]
call fcn.00414760
mov eax, dword [esi + 0x3c]
mov dword [esi + 0x40], eax
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x459b30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d573c
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x65a000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebx], vtable.CInfoMgr.0
mov dword [ebp - 4], 3
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x459b7e
push ecx
call fcn.00459c50
mov dword [ebx + 4], 0
mov ecx, dword [ebx + 0x3c]
test ecx, ecx
je 0x459bb1
push dword [ebp - 0x10]
mov edx, dword [ebx + 0x40]
push ecx
call fcn.00414760
push dword [ebx + 0x3c]
call fcn.0048166b
add esp, 0xc
mov dword [ebx + 0x3c], 0
mov dword [ebx + 0x40], 0
mov dword [ebx + 0x44], 0
mov byte [ebp - 4], 1
push dword [ebx + 0x2c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
mov eax, dword [ebx + 0x30]
push eax
push dword [eax]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebx + 0x30]
call fcn.00412be0
push dword [ebx + 0x30]
call fcn.0048166b
add esp, 4
mov byte [ebp - 4], 0
push dword [ebx + 0x28]
mov dword [ebx + 0x1c], vtable.CCDCMACRO.0
call edi
mov eax, dword [ebx + 0x20]
push eax
push dword [eax]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebx + 0x20]
call fcn.00407fc0
push dword [ebx + 0x20]
call fcn.0048166b
add esp, 4
mov dword [ebp - 4], 0xffffffff
push dword [ebx + 0x18]
mov dword [ebx + 0xc], vtable.CCDCMACRO.0
call edi
mov eax, dword [ebx + 0x10]
push eax
push dword [eax]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebx + 0x10]
call fcn.00407fc0
push dword [ebx + 0x10]
call fcn.0048166b
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret