joyce8/EMBER2024-capa huggingface dataset:
Function at 0x455290
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x18]
call fcn.00403728
xor eax, eax
push ebp
push 0x455375
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp + 0x18], 0
jne 0x4552d7
lea edx, [ebp + 0x18]
mov eax, edi
call fcn.0042c8a4
cmp dword [ebp + 0x18], 0
jne 0x4552d7
lea eax, [ebp + 0x18]
call fcn.0042d8c4
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x3c
call fcn.00402934
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x540
test ebx, ebx
je 0x455302
mov eax, ebx
call fcn.00403738
mov dword [ebp - 0x34], eax
mov eax, edi
call fcn.00403738
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
call fcn.00403738
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x18]
call fcn.00403738
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
push eax
call sub.shell32.dll_ShellExecuteExA
mov ebx, eax
neg ebx
sbb ebx, ebx
neg ebx
test bl, bl
jne 0x455346
call sub.kernel32.dll_GetLastError_1
mov dword [esi], eax
jmp 0x45535f
mov dword [esi], 0x103
mov eax, dword [ebp - 8]
test eax, eax
je 0x45535f
push esi
mov ecx, dword [ebp + 0xc]
mov dl, byte [ebp + 0x14]
call fcn.00454f7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45537c
lea eax, [ebp + 0x18]
call fcn.00403400
ret

Function at 0x455560
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffec
mov ebx, eax
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x45558e
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x10
call fcn.0040355c
jmp 0x455595
mov eax, ebx
call fcn.00403400
add esp, 0x14
pop ebx
ret

Function at 0x45559c
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
mov dword [esp], 0x101
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x4555cd
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x101
call fcn.0040355c
jmp 0x4555d4
mov eax, ebx
call fcn.00403400
add esp, 0x108
pop ebx
ret

Function at 0x4555e4
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffec
cmp dword [0x4990dc], 2
jne 0x45564b
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x455606
xor eax, eax
jmp 0x45565a
lea eax, [esp + 8]
push eax
push 0x455660
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError_1
test eax, eax
je 0x45564b
xor eax, eax
jmp 0x45565a
push 0
push 2
call sub.user32.dll_ExitWindowsEx
neg eax
sbb eax, eax
neg eax
add esp, 0x14
ret
Function at 0x455674
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x4556ce
inc esi
xor edi, edi
cmp edi, 1
jne 0x45569a
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep
jmp 0x4556a8
cmp edi, 1
jle 0x4556a8
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00452908
test eax, eax
jne 0x4556ce
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
je 0x4556ce
call sub.kernel32.dll_GetLastError_1
cmp eax, 3
je 0x4556ce
inc edi
dec esi
jne 0x45568a
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x455d9c
Capabilities:
Delete registry value

Disassembly:
push ebx
push esi
push ecx
mov ebx, edx
mov esi, eax
push 0
push 2
lea eax, [esp + 8]
push eax
call fcn.0042dbf4
and eax, 0x7f
mov ecx, dword [eax*4 + 0x499a5c]
mov edx, 0x80000002
xor eax, eax
call fcn.0042de1c
test eax, eax
jne 0x455de6
mov eax, esi
call fcn.00403738
push eax
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey
mov eax, ebx
call fcn.00403738
push eax
call sub.gdi32.dll_RemoveFontResourceA
test eax, eax
je 0x455e07
push 0
push 0
push 0x1d
push 0xffff
call sub.user32.dll_SendNotifyMessageA
pop edx
pop esi
pop ebx
ret
Function at 0x474f88
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x148], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4750f2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x144]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0042c3fc
lea eax, [ebp - 0x148]
mov edx, 0x475108
call fcn.0040357c
mov eax, dword [ebp - 0x148]
call fcn.00403738
push eax
call sub.kernel32.dll_FindFirstFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4750d1
lea eax, [ebp - 4]
lea edx, [ebp - 0x118]
mov ecx, 0x104
call fcn.0040355c
mov eax, dword [ebp - 4]
call fcn.00403574
cmp eax, 9
jl 0x4750b6
lea eax, [ebp - 0x148]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00403778
mov eax, dword [ebp - 0x148]
mov edx, 0x47511c
call fcn.00406ac4
test eax, eax
jne 0x4750b6
mov edx, 0x475124
mov eax, dword [ebp - 4]
mov al, byte [eax + 5]
call fcn.0042ea9c
test al, al
je 0x4750b6
mov edx, 0x475124
mov eax, dword [ebp - 4]
mov al, byte [eax + 6]
call fcn.0042ea9c
test al, al
je 0x4750b6
mov edx, 0x475124
mov eax, dword [ebp - 4]
mov al, byte [eax + 7]
call fcn.0042ea9c
test al, al
je 0x4750b6
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0x2e
jne 0x4750b6
lea eax, [ebp - 0x148]
push eax
mov ecx, 3
mov edx, 6
mov eax, dword [ebp - 4]
call fcn.00403778
mov eax, dword [ebp - 0x148]
call fcn.00406d98
mov edx, dword [ebp + 8]
mov byte [edx + eax - 0x3ec], 1
lea eax, [ebp - 0x144]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x474ff1
push ebx
call sub.kernel32.dll_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4750f9
lea eax, [ebp - 0x148]
call fcn.00403400
lea eax, [ebp - 4]
call fcn.00403400
ret
Function at 0x477c6c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov dword [ebp - 0x14], eax
mov eax, dword [esi]
call fcn.0040ca4c
mov dword [ebp - 0x10], eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
call fcn.00477b94
lea eax, [ebp - 0x14]
push eax
push 0
push 0x4a
mov eax, dword [0x49c0e4]
push eax
call sub.user32.dll_SendMessageA
mov ebx, eax
mov eax, esi
call fcn.0042e384
cmp ebx, 0x6c840001
jne 0x477cbc
call fcn.00408c00
mov eax, ebx
and eax, 0xffff0000
cmp eax, 0x6c830000
je 0x477ce0
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x477d90
call fcn.004533a0
mov word [ebp - 6], bx
xor esi, esi
call sub.kernel32.dll_GetTickCount
mov ebx, eax
call dword [ebp - 4]
call sub.kernel32.dll_GetTickCount
mov edx, eax
sub edx, ebx
cmp edx, 0xa
jb 0x477d38
mov ebx, eax
mov edx, 1
mov ax, word [ebp - 6]
call fcn.00477bf0
mov esi, eax
mov eax, esi
sub ax, 2
je 0x477d38
dec eax
sub ax, 2
jb 0x477d4c
movzx eax, si
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x477dc4
call fcn.004533a0
push 0xff
push 0xa
push 0
push 0
push 0
call sub.user32.dll_MsgWaitForMultipleObjects
jmp 0x477ced
mov edx, 2
mov ax, word [ebp - 6]
call fcn.00477bf0
movzx ebx, ax
mov edx, 3
mov ax, word [ebp - 6]
call fcn.00477bf0
movzx eax, ax
shl eax, 0x10
or ebx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
cmp si, 3
sete al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x478370
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff004
push eax
mov edi, edx
mov esi, eax
push 0x47841c
push 0x478438
call sub.kernel32.dll_GetModuleHandleA_1
push eax
call sub.kernel32.dll_GetProcAddress
mov ebx, eax
test ebx, ebx
je 0x478406
mov eax, esi
call fcn.00403738
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x478406
test al, 0x10
je 0x4783b7
mov ebp, 0x2000000
jmp 0x4783b9
xor ebp, ebp
push 0
push ebp
push 3
push 0
push 7
push 0
mov eax, esi
call fcn.00403738
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebp, eax
cmp ebp, 0xffffffff
je 0x478406
push 0
push 0x1000
lea eax, [esp + 8]
push eax
push ebp
call ebx
mov ebx, eax
push ebp
call sub.kernel32.dll_CloseHandle_1
test ebx, ebx
jle 0x478406
cmp ebx, 0xff0
jge 0x478406
mov edx, edi
mov eax, esp
call fcn.00478298
jmp 0x47840f
mov eax, edi
mov edx, esi
call fcn.00403494
add esp, 0x1000
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4786ec
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4787b7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, 0x478080
call fcn.004787d8
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x478790
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x4787d0
call fcn.004078f4
mov edx, dword [ebp - 8]
mov eax, dword [0x49b628]
call fcn.004242c4
call fcn.00478090
call sub.user32.dll_GetFocus
mov edx, dword [0x49b628]
cmp eax, dword [edx + 0x20]
jne 0x478773
push 0x7a
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x47877a
call sub.user32.dll_WaitMessage
jmp 0x478752
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x478797
mov eax, dword [ebp - 4]
call fcn.00402b58
ret

Function at 0x47cb94
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x47cb9c
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x47ccea
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.00453a24
mov edx, dword [ebp - 0x10]
mov eax, 0x49c18c
call fcn.00403450
mov edx, 0x47cd00
lea eax, [ebp - 0x10]
call fcn.00403494
lea eax, [ebp - 0x10]
mov edx, dword [0x49c18c]
call fcn.0040357c
mov eax, dword [ebp - 0x10]
call fcn.00457d10
cmp byte [0x49c00c], 0
je 0x47cbff
mov eax, dword [0x49c18c]
call fcn.00457508
lea edx, [ebp - 0x10]
mov eax, dword [0x49c18c]
call fcn.0042c3fc
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
mov ecx, 0x47cd28
call fcn.004035c0
push 0
mov eax, dword [ebp - 4]
call fcn.00403738
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x47cc91
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x20]
mov edx, dword [ebp - 4]
mov al, 0x36
call fcn.00451458
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
lea edx, [ebp - 0x24]
mov eax, ebx
call fcn.00406d68
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
lea edx, [ebp - 0x28]
mov eax, ebx
call fcn.0042e8c8
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1c]
mov ecx, 2
mov al, 0x68
call fcn.00451428
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, 0x406400
call fcn.00408c0c
call fcn.0040311c
lea eax, [ebp - 8]
call fcn.00458410
cmp dword [ebp - 8], 0
je 0x47ccc2
lea eax, [ebp - 0xc]
mov ecx, 0x47cd38
mov edx, dword [ebp - 4]
call fcn.004035c0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0047cb3c
mov eax, dword [ebp - 0xc]
call fcn.00458450
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47ccf1
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.00403420
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00403420
ret
Function at 0x47f0c4
Capabilities:
Hide graphical window

Disassembly:
mov byte [0x49c481], 1
call fcn.004555e4
test al, al
jne 0x47f106
push 5
mov eax, dword [0x49b628]
mov eax, dword [eax + 0x20]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x49b628]
mov eax, dword [eax + 0x20]
push eax
call sub.user32.dll_SetForegroundWindow
push 0
push 1
push 1
mov cl, 2
xor edx, edx
mov eax, dword [0x49bd74]
call fcn.0047efd0
ret

Function at 0x483450
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
call sub.kernel32.dll_GetTickCount
mov ebx, eax
jmp 0x48347c
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jae 0x483485
call fcn.004824a8
mov eax, 0xa
call fcn.0042ec74
call fcn.004824a8
call fcn.0048341c
test al, al
jne 0x48345a
pop ebx
ret

Function at 0x48393c
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
cmp dword [0x49c0a8], 0
je 0x4839d3
mov eax, dword [0x49c0a8]
call fcn.00418378
test al, al
je 0x4839d3
mov eax, dword [0x49c0a8]
cmp byte [eax + 0xc7], 0
je 0x483983
cmp byte [ebx + 0x1b9], 0
jne 0x483983
mov eax, dword [0x49b628]
mov eax, dword [eax + 0x20]
push eax
call sub.user32.dll_IsIconic
test eax, eax
je 0x483987
xor eax, eax
jmp 0x483989
mov al, 1
mov ebx, eax
push 0xfffffffffffffff0
mov eax, dword [0x49c0a8]
call fcn.004181e0
push eax
call sub.user32.dll_GetWindowLongA
test eax, 0x10000000
setne al
cmp bl, al
je 0x4839d3
test bl, bl
je 0x4839c1
push 5
mov eax, dword [0x49c0a8]
call fcn.004181e0
push eax
call sub.user32.dll_ShowWindow
jmp 0x4839d3
push 0
mov eax, dword [0x49c0a8]
call fcn.004181e0
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret

Function at 0x483a7c
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
add esp, 0xffffffd8
mov byte [0x49c43a], 0
push 0x483b54
call sub.kernel32.dll_GetModuleHandleA_1
mov ebx, eax
push 0x483b64
push ebx
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x483b08
lea edx, [esp + 4]
push edx
call eax
push 0x483b78
push ebx
call sub.kernel32.dll_GetProcAddress
mov esi, eax
test esi, esi
je 0x483b12
push esp
call sub.kernel32.dll_GetCurrentProcess
push eax
call esi
test eax, eax
je 0x483b12
cmp dword [esp], 0
je 0x483b12
call fcn.0045271c
test al, al
je 0x483b12
push 0x483b88
push ebx
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x483b12
push 0x483ba4
push 0x483bb4
call sub.kernel32.dll_GetModuleHandleA_1
push eax
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x483b12
mov byte [0x49c43a], 1
jmp 0x483b12
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ax, word [esp + 4]
sub ax, 1
jb 0x483b2b
sub ax, 5
je 0x483b34
sub ax, 3
je 0x483b3d
jmp 0x483b46
mov byte [0x499c80], 1
jmp 0x483b4d
mov byte [0x499c80], 3
jmp 0x483b4d
mov byte [0x499c80], 2
jmp 0x483b4d
mov byte [0x499c80], 0
add esp, 0x28
pop esi
pop ebx
ret
Function at 0x496c50
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x496e21
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.0042da18
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.004538bc
test al, al
jne 0x496cb7
xor eax, eax
push ebp
push 0x496cad
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
xor eax, eax
call fcn.00453d30
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496cb7
push 0
mov eax, dword [ebp - 4]
call fcn.00403738
push eax
mov eax, dword [0x49c534]
call fcn.00403738
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
jne 0x496ce0
mov eax, dword [0x49bdf4]
call fcn.004962f8
push 0x80
mov eax, dword [ebp - 4]
call fcn.00403738
push eax
call sub.kernel32.dll_SetFileAttributesA
push 0
mov eax, dword [0x49b014]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x496e30
push 0x496e34
push 0
call sub.user32.dll_CreateWindowExA
mov dword [ebp - 8], eax
push 0x4964a8
push 0xfffffffffffffffc
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_SetWindowLongA
mov dword [0x49c560], eax
xor eax, eax
push ebp
push 0x496df4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x97
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x49b628]
mov eax, dword [eax + 0x20]
push eax
call sub.user32.dll_SetWindowPos
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x24]
xor eax, eax
call fcn.0042d44c
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
lea edx, [ebp - 0x20]
mov ecx, 1
mov eax, 0x496e44
call fcn.004078f4
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x24]
call fcn.0042d32c
mov edx, dword [ebp - 0x24]
pop eax
call fcn.0040357c
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004963a0
mov dword [ebp - 0xc], eax
call fcn.0049646c
test al, al
jne 0x496dd4
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xc]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x496db4
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x496dfb
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_DestroyWindow
ret
Function at 0x497d5c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x497fc1
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x497fd8
mov eax, dword [0x49b628]
call fcn.004242c4
push 5
mov eax, dword [0x49b628]
mov eax, dword [eax + 0x20]
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
push ebp
push 0x497f8d
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.0047f30c
lea eax, [ebp - 0x10]
call fcn.0042d8c4
mov eax, dword [ebp - 0x10]
call fcn.004072a8
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.0042d44c
mov edx, dword [ebp - 0x10]
mov eax, 0x49c534
call fcn.00403450
call fcn.00496648
lea ecx, [ebp - 0x10]
mov edx, 0x497fec
mov eax, dword [0x49c534]
call fcn.0042c4f8
mov edx, dword [ebp - 0x10]
mov eax, 0x49c538
call fcn.00403450
lea ecx, [ebp - 0x10]
mov edx, 0x497ffc
mov eax, dword [0x49c534]
call fcn.0042c4f8
mov edx, dword [ebp - 0x10]
mov eax, 0x49c53c
call fcn.00403450
push 2
push 0
push 1
mov ecx, dword [0x49c534]
mov dl, 1
mov eax, 0x4504d0
call fcn.0045072c
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x497ea4
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 4]
mov edx, dword [ebp - 0x18]
sub edx, 8
mov eax, dword [ebp - 4]
call fcn.004506f0
lea edx, [ebp - 0xc]
mov ecx, 8
mov eax, dword [ebp - 4]
call fcn.004506c8
cmp dword [ebp - 0xc], 0x67734d49
je 0x497e7f
mov cl, 1
xor edx, edx
mov eax, dword [0x49c53c]
call fcn.004515b0
jmp 0x497e8e
mov cl, 1
mov edx, dword [ebp - 8]
mov eax, dword [0x49c534]
call fcn.004515b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x497eab
mov eax, dword [ebp - 4]
call fcn.00402b58
ret
Function at 0x498210
Capabilities:
Check if file exists
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x498306
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00403400
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0042c954
xor edi, edi
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x49831c
call fcn.004078f4
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.004035c0
mov eax, dword [ebp - 0x10]
call fcn.00403738
push eax
call sub.kernel32.dll_GetFileAttributesA
mov esi, eax
cmp esi, 0xffffffff
je 0x4982ae
test esi, 0x10
jne 0x4982de
test esi, 1
je 0x4982ae
and esi, 0xfffffffe
push esi
mov eax, dword [ebp - 0x10]
call fcn.00403738
push eax
call sub.kernel32.dll_SetFileAttributesA
push 1
mov eax, dword [ebp - 0x10]
call fcn.00403738
push eax
mov eax, dword [ebp - 4]
call fcn.00403738
push eax
call sub.kernel32.dll_MoveFileExA
test eax, eax
je 0x4982d8
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.00403494
jmp 0x4982eb
inc edi
cmp edi, 0xa
je 0x4982eb
inc ebx
cmp ebx, 0x3e8
jne 0x49824f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49830d
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00403420
ret
Function at 0x10001030
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x100200b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
xor esi, esi
push esi
mov dword [ebp - 0x21c], eax
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x10001137
lea eax, [ebp - 0x210]
push eax
push 0x10018268
push 1
push esi
push 0x10018278
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x10001131
mov eax, dword [ebp - 0x210]
mov ecx, dword [eax]
lea edx, [ebp - 0x214]
push edx
push 0x10018288
push eax
call dword [ecx]
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x210]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x50]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x100010c2
mov eax, dword [ebp - 0x210]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x2c]
cmp dword [ebp - 0x218], esi
jl 0x10001125
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push esi
push eax
call fcn.1000cce0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x21c]
push 1
push esi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x214]
mov ecx, dword [eax]
push esi
lea edx, [ebp - 0x20c]
push edx
push eax
call dword [ecx + 0x18]
mov eax, dword [ebp - 0x214]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x210]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1000ad41
leave
ret
Function at 0x10001772
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100200b0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1000179d
xor al, al
jmp 0x100017f2
lea eax, [ebp - 0x20]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x100017bd
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10001799
mov eax, dword [ebp - 0x20]
push 0
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
push 0
push 0x10
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 0x18]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x100017b2
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000ad41
leave
ret

Function at 0x100017fe
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x100200b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push edi
xor ebx, ebx
push ebx
push 2
mov dword [ebp - 0x234], eax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
push 0x22c
mov edi, eax
lea eax, [ebp - 0x230]
push ebx
push eax
call fcn.1000cce0
add esp, 0xc
lea eax, [ebp - 0x230]
push eax
push edi
mov dword [ebp - 0x230], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x1000187d
push dword [ebp - 0x234]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x10001883
lea eax, [ebp - 0x230]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x10001858
jmp 0x10001889
mov ebx, dword [ebp - 0x228]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.1000ad41
leave
ret