joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47b334
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
mov esi, edx
mov ebx, eax
mov ebp, 0x526d80
test esi, esi
jne 0x47b34e
xor eax, eax
jmp 0x47b450
cmp dword [ebp], 0
jne 0x47b359
call fcn.0047b2c4
xor ebx, 0xffffffff
cmp edi, 8
jb 0x47b429
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
sub edi, 8
cmp edi, 8
jae 0x47b365
test edi, edi
jbe 0x47b44b
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
dec edi
test edi, edi
ja 0x47b42d
mov eax, ebx
xor eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x491300
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc10
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3f0], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4913ba
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404e00
mov eax, dword [0x524ff8]
cmp dword [eax], 2
jne 0x49136f
push esi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.00405078
mov eax, dword [ebx]
call fcn.00404f9c
push eax
mov eax, dword [ebx]
call fcn.00404f8c
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
call fcn.00404f9c
mov edx, eax
dec edx
mov eax, ebx
call fcn.00405078
jmp 0x4913a1
lea eax, [ebp - 0x3e9]
push eax
push 0x3e8
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea edx, [ebp - 0x3f0]
lea eax, [ebp - 0x3e9]
call fcn.00409c84
mov edx, dword [ebp - 0x3f0]
mov eax, ebx
call fcn.00404f7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4913c1
lea eax, [ebp - 0x3f0]
call fcn.004046f4
ret
Function at 0x49b398
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffdc
mov ebp, edx
mov ebx, eax
cmp dword [ebx + 0x68], 0
jne 0x49b3b0
mov eax, ebx
call fcn.0049b130
cmp dword [ebx + 0x60], 0
jne 0x49b3bd
mov eax, ebx
call fcn.0049b088
mov esi, dword [ebx + 0x68]
test esi, esi
je 0x49b561
cmp dword [ebx + 0x60], 0
je 0x49b561
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [esp], eax
mov eax, dword [ebx + 0x68]
mov edx, dword [eax]
call dword [edx + 0x20]
mov dword [esp + 4], eax
lea edx, [esp + 0x14]
mov eax, ebx
call fcn.0049b00c
mov edx, dword [esp + 0x1c]
mov ecx, edx
mov esi, dword [esp + 0x14]
sub ecx, esi
mov eax, dword [esp]
cmp ecx, eax
je 0x49b430
mov ecx, dword [esp + 4]
sub ecx, dword [esp + 0x20]
add ecx, dword [esp + 0x18]
sar ecx, 1
jns 0x49b419
adc ecx, 0
push ecx
sub eax, edx
add eax, esi
sar eax, 1
jns 0x49b425
adc eax, 0
push eax
lea eax, [esp + 0x1c]
push eax
call sub.user32.dll_InflateRect
mov eax, dword [ebx + 0x4c]
mov eax, dword [eax + 0xd8]
test eax, eax
je 0x49b446
call fcn.00449990
mov esi, eax
jmp 0x49b449
mov esi, dword [ebx + 0x48]
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
and eax, 8
cmp eax, 8
jne 0x49b45e
or esi, 0xffffffff
jmp 0x49b468
push 3
push esi
call sub.user32.dll_GetWindow
mov esi, eax
mov edi, 0x610
mov edx, dword [esp + 0x14]
mov eax, dword [ebx + 0x60]
call fcn.004428e0
mov edx, dword [esp + 0x18]
mov eax, dword [ebx + 0x60]
call fcn.00442904
mov edx, dword [esp]
mov eax, dword [ebx + 0x60]
call fcn.0044292c
mov edx, dword [esp + 4]
mov eax, dword [ebx + 0x60]
call fcn.00442950
lea ecx, [esp + 8]
xor edx, edx
xor eax, eax
call fcn.00406b98
mov eax, ebp
mov byte [esp + 0x12], al
mov byte [esp + 0x10], 0
mov byte [esp + 0x11], 0
mov byte [esp + 0x13], 1
or edi, 2
or edi, 1
push edi
push 0
push 0
push 0
push 0
push esi
mov eax, dword [ebx + 0x60]
call fcn.00449990
push eax
call sub.user32.dll_SetWindowPos
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x60]
call fcn.00449990
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80000
or eax, 0x8000000
or eax, 0x20
push eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x60]
call fcn.00449990
push eax
call sub.user32.dll_SetWindowLongA
push 2
lea eax, [esp + 0x14]
push eax
push 0x1fffffff
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx + 0x68]
call fcn.004288b0
call fcn.004242a0
push eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
mov eax, dword [ebx + 0x60]
call fcn.00449990
push eax
call dword [0x526e3c]
push 4
mov eax, dword [ebx + 0x60]
call fcn.00449990
push eax
call sub.user32.dll_ShowWindow
push esi
push 0
call sub.user32.dll_ReleaseDC
add esp, 0x24
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4b8798
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, ecx
mov edi, edx
mov ebx, eax
mov eax, ebx
call fcn.004b8784
test eax, eax
jne 0x4b87b9
mov eax, esi
call fcn.004046f4
jmp 0x4b884a
mov eax, ebx
call fcn.004b88e8
test al, al
je 0x4b87ff
push 0
push 0
push 0xe
mov eax, dword [ebx + 0x54]
push eax
call sub.user32.dll_SendMessageA
mov edi, eax
mov eax, esi
mov ecx, edi
xor edx, edx
call fcn.004047e4
test edi, edi
je 0x4b87f6
mov eax, dword [esi]
push eax
inc edi
push edi
push 0xd
mov eax, dword [ebx + 0x54]
push eax
call sub.user32.dll_SendMessageA
jmp 0x4b884a
mov eax, esi
call fcn.004046f4
jmp 0x4b884a
mov ebp, dword [ebx + 0x78]
test ebp, ebp
je 0x4b8843
mov eax, dword [ebp + 0x208]
call fcn.00419f70
test eax, eax
jle 0x4b8831
mov eax, dword [ebx + 0x78]
mov eax, dword [eax + 0x208]
mov edx, edi
call fcn.004695f8
mov edx, dword [eax + 0xc]
mov eax, esi
call fcn.00404748
jmp 0x4b884a
mov eax, esi
mov edx, dword [ebx + 0x78]
mov edx, dword [edx + 0x210]
call fcn.00404748
jmp 0x4b884a
mov eax, esi
call fcn.004046f4
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4ba538
Capabilities:
Capture webcam image

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
push 1
push esi
mov ecx, 1
xor edx, edx
xor eax, eax
call fcn.00406b7c
push esi
push 0
push 0x419
mov eax, dword [ebx + 0x54]
push eax
call sub.user32.dll_SendMessageA
pop esi
pop ebx
ret
Function at 0x4fd114
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffdc
mov ebp, edx
mov ebx, eax
cmp dword [ebx + 0x6c], 0
jne 0x4fd12c
mov eax, ebx
call fcn.004fc9a8
cmp dword [ebx + 0x68], 0
jne 0x4fd139
mov eax, ebx
call fcn.004fc904
mov esi, dword [ebx + 0x6c]
test esi, esi
je 0x4fd2e9
cmp dword [ebx + 0x68], 0
je 0x4fd2e9
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [esp], eax
mov eax, dword [ebx + 0x6c]
mov edx, dword [eax]
call dword [edx + 0x20]
mov dword [esp + 4], eax
lea edx, [esp + 0x14]
mov eax, ebx
call fcn.004fc774
lea eax, [esp + 0x14]
xor edx, edx
call fcn.004fffc4
cmp eax, dword [esp]
je 0x4fd1bb
lea eax, [esp + 0x14]
xor edx, edx
call fcn.004fffd8
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x4fd197
adc edx, 0
push edx
lea eax, [esp + 0x18]
xor edx, edx
call fcn.004fffc4
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x4fd1b0
adc edx, 0
push edx
lea eax, [esp + 0x1c]
push eax
call sub.user32.dll_InflateRect
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x4fd1ce
mov eax, dword [eax + 0x18]
call fcn.00449990
mov esi, eax
jmp 0x4fd1d1
mov esi, dword [ebx + 0x50]
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
and eax, 8
cmp eax, 8
jne 0x4fd1e6
or esi, 0xffffffff
jmp 0x4fd1f0
push 3
push esi
call sub.user32.dll_GetWindow
mov esi, eax
mov edi, 0x610
mov edx, dword [esp + 0x14]
mov eax, dword [ebx + 0x68]
call fcn.004428e0
mov edx, dword [esp + 0x18]
mov eax, dword [ebx + 0x68]
call fcn.00442904
mov edx, dword [esp]
mov eax, dword [ebx + 0x68]
call fcn.0044292c
mov edx, dword [esp + 4]
mov eax, dword [ebx + 0x68]
call fcn.00442950
lea ecx, [esp + 8]
xor edx, edx
xor eax, eax
call fcn.00406b98
mov eax, ebp
mov byte [esp + 0x12], al
mov byte [esp + 0x10], 0
mov byte [esp + 0x11], 0
mov byte [esp + 0x13], 1
or edi, 2
or edi, 1
push edi
push 0
push 0
push 0
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.00449990
push eax
call sub.user32.dll_SetWindowPos
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.00449990
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80000
or eax, 0x8000000
or eax, 0x20
push eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.00449990
push eax
call sub.user32.dll_SetWindowLongA
push 2
lea eax, [esp + 0x14]
push eax
push 0x1fffffff
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx + 0x6c]
call fcn.004288b0
call fcn.004242a0
push eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.00449990
push eax
call dword [0x526e3c]
push 4
mov eax, dword [ebx + 0x68]
call fcn.00449990
push eax
call sub.user32.dll_ShowWindow
push esi
push 0
call sub.user32.dll_ReleaseDC
add esp, 0x24
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4fd550
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa4
mov dword [esp], eax
mov eax, dword [esp]
xor ecx, ecx
mov edx, 0x10
call fcn.004032c8
lea eax, [esp + 0x38]
push eax
call sub.kernel32.dll_GetSystemInfo
call sub.user32.dll_GetDesktopWindow
test eax, eax
je 0x4fd73c
push 0
push 0x4fd744
push 0
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x4fd73c
push 0
push 0x4fd754
push 0
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x4fd73c
push 0
push 0x4fd764
push 0
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x4fd73c
push 0
push 0x4fd774
push 0
push eax
call sub.user32.dll_FindWindowExA
mov ebp, eax
test ebp, ebp
je 0x4fd73c
push 0
push 0
push 0x418
push ebp
call sub.user32.dll_SendMessageA
mov dword [esp + 4], eax
cmp dword [esp + 4], 1
jl 0x4fd73c
xor eax, eax
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push ebp
call sub.user32.dll_GetWindowThreadProcessId
cmp dword [esp + 8], 0
je 0x4fd73c
mov eax, dword [esp + 8]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov edi, eax
test edi, edi
je 0x4fd73c
push 0x40
push 0x1000
push 0x1000
push 0
push edi
call sub.kernel32.dll_VirtualAllocEx
mov esi, eax
test esi, esi
je 0x4fd73c
or ebx, 0xffffffff
cmp ebx, dword [esp + 4]
jge 0x4fd728
inc ebx
push esi
push ebx
push 0x417
push ebp
call sub.user32.dll_SendMessageA
test eax, eax
je 0x4fd71e
lea eax, [esp + 0xc]
push eax
push 0x18
lea eax, [esp + 0x1c]
push eax
push esi
push edi
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x4fd71e
test byte [esp + 0x1d], 0xd
jne 0x4fd71e
mov al, byte [esp + 0x1c]
and al, 8
cmp al, 8
je 0x4fd71e
lea eax, [esp + 0xc]
push eax
push 4
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x2c]
push eax
push edi
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x4fd71e
cmp dword [esp + 0xc], 0
je 0x4fd71e
mov eax, dword [0x524e58]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
cmp eax, dword [esp + 0x10]
jne 0x4fd71e
push esi
push ebx
push 0x41d
push ebp
call sub.user32.dll_SendMessageA
test eax, eax
je 0x4fd6fa
lea eax, [esp + 0xc]
push eax
push 0x10
mov eax, dword [esp + 8]
push eax
push esi
push edi
call sub.kernel32.dll_ReadProcessMemory
cmp dword [esp + 0xc], 0
je 0x4fd728
lea eax, [esp + 0x28]
push eax
push ebp
call sub.user32.dll_GetWindowRect
mov eax, dword [esp]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
call fcn.00406bdc
jmp 0x4fd728
cmp ebx, dword [esp + 4]
jl 0x4fd65e
push 0x8000
push 0
push esi
push edi
call sub.kernel32.dll_VirtualFreeEx
push edi
call sub.kernel32.dll_CloseHandle
add esp, 0x5c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4fee6c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4feedd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x5243e4]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x4feec7
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.004fee5c
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4fec34]
call fcn.004fef04
mov dword [0x524448], eax
mov eax, dword [ebp - 4]
call fcn.004fee0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4feee4
lea eax, [ebp - 8]
call fcn.0040636c
ret

Function at 0x4ff0bc
Capabilities:
Get file system object information

Disassembly:
add esp, 0xfffffea0
mov eax, esp
xor ecx, ecx
mov edx, 0x160
call fcn.004032c8
push 0x4001
push 0x160
lea eax, [esp + 8]
push eax
push 0
push 0x4ff154
call sub.shell32.dll_SHGetFileInfoA
mov dword [0x5243dc], eax
cmp dword [0x5243dc], 0
je 0x4ff14c
cmp dword [0x5243e0], 0
jne 0x4ff14c
xor ecx, ecx
mov dl, 1
mov eax, dword [0x484960]
call fcn.004851fc
mov dword [0x5243e0], eax
mov edx, dword [0x5243dc]
mov eax, dword [0x5243e0]
call fcn.004502c8
mov eax, dword [0x5243e0]
mov byte [eax + 0x42], 1
mov dl, 1
mov eax, dword [0x5243e0]
call fcn.004868c0
push 0xffffffffffffffff
mov eax, dword [0x5243e0]
call fcn.00450304
push eax
call sub.comctl32.dll_ImageList_SetBkColor
add esp, 0x160
ret

Function at 0x500944
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffe9c
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [esp], eax
mov eax, ebx
call fcn.00409708
test al, al
je 0x5009cb
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x160
call fcn.004032c8
or esi, 0x100
test esi, esi
jns 0x50097f
call fcn.00403818
push esi
push 0x160
lea eax, [esp + 0xc]
push eax
push 0
mov eax, ebx
call fcn.00404bb4
push eax
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x5009cb
mov dl, 1
mov eax, dword [0x42233c]
call fcn.00429e7c
mov dword [esp], eax
mov edx, dword [esp + 4]
mov eax, dword [esp]
call fcn.0042a288
mov eax, dword [esp]
mov edx, dword [eax]
call dword [edx + 0x1c]
test al, al
je 0x5009cb
mov eax, esp
call fcn.0040e83c
mov eax, dword [esp]
add esp, 0x164
pop esi
pop ebx
ret
Function at 0x518604
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404ba4
xor eax, eax
push ebp
push 0x51869a
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
mov eax, dword [ebp - 4]
call fcn.00404bb4
push eax
push 0
call sub.kernel32.dll_FindResourceA
mov ebx, eax
push ebx
push 0
call sub.kernel32.dll_LoadResource
mov esi, eax
push ebx
push 0
call sub.kernel32.dll_SizeofResource
mov ebx, eax
push esi
call sub.kernel32.dll_LockResource
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
mov ecx, ebx
mov edx, dword [ebp - 8]
call fcn.004047e4
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00404748
push esi
call sub.kernel32.dll_FreeResource
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5186a1
lea eax, [ebp - 0xc]
call fcn.004046f4
lea eax, [ebp - 4]
call fcn.004046f4
ret

Function at 0x5186b8
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, eax
mov dword [ebp - 8], 0x10
mov eax, dword [ebp - 8]
call fcn.00402a54
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x518712
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x5186fc
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.004048ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x518719
mov eax, dword [ebp - 4]
call fcn.00402a84
ret

Function at 0x518720
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
call fcn.004050c0
lea eax, [ebp - 8]
call fcn.004050c0
lea eax, [ebp + 0x10]
call fcn.004050c0
lea eax, [ebp + 0xc]
call fcn.004050c0
xor eax, eax
push ebp
push 0x5187c6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
call sub.kernel32.dll_Wow64DisableWow64FsRedirection
test eax, eax
je 0x518787
push esi
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push ebx
call sub.shell32.dll_ShellExecuteW
jmp 0x51879e
push esi
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push ebx
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5187cd
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404e18
lea eax, [ebp + 0xc]
mov edx, 2
call fcn.00404e18
ret
Function at 0x51add4
Capabilities:
Shutdown system

Disassembly:
push ebx
add esp, 0xffffffd8
mov ebx, eax
mov eax, dword [0x524ff8]
cmp dword [eax], 2
jne 0x51ae4e
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x51ae4e
lea eax, [esp + 0xc]
push eax
push 0x51ae64
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
cmp eax, 1
sbb eax, eax
inc eax
mov dword [esp + 8], 1
mov dword [esp + 0x14], 2
mov edx, 0x10
xor ecx, ecx
mov dword [esp + 4], ecx
test al, al
je 0x51ae4e
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x1c]
push eax
push edx
lea eax, [esp + 0x14]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
push 0
push ebx
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x28
pop ebx
ret

Function at 0x51ae78
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404ba4
xor eax, eax
push ebp
push 0x51aff9
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
xor edx, edx
mov eax, 2
call fcn.00516000
mov esi, eax
mov dword [ebp - 0x12c], 0x128
lea edx, [ebp - 0x12c]
mov eax, esi
call fcn.00516020
mov ebx, eax
jmp 0x51afc5
lea eax, [ebp - 0x138]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.00404964
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.0040990c
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00408bfc
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00408bfc
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.00404b00
je 0x51af9c
lea eax, [ebp - 0x144]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.00404964
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00408bfc
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00408bfc
mov edx, dword [ebp - 0x148]
pop eax
call fcn.00404b00
jne 0x51afb6
push 0
mov eax, dword [ebp - 0x124]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edi, eax
lea edx, [ebp - 0x12c]
mov eax, esi
call fcn.00516040
mov ebx, eax
test ebx, ebx
jne 0x51aef7
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51b000
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.00404718
lea eax, [ebp - 4]
call fcn.004046f4
ret

Function at 0x51b724
Capabilities:
Write file on windows

Disassembly:
push ebx
add esp, 0xfffffdfc
push 0
push 0
push 3
push 0
push 3
push 0x10000000
push 0x51b77c
call sub.kernel32.dll_CreateFileA
mov ebx, eax
lea eax, [esp + 4]
mov edx, 0x200
call fcn.004078e0
push 0
lea eax, [esp + 4]
push eax
push 0x200
lea eax, [esp + 0x10]
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
push ebx
call sub.kernel32.dll_CloseHandle
add esp, 0x204
pop ebx
ret
Function at 0x51bd90
Capabilities:
Check for sandbox and av modules

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x51bf6b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x51bf7c
call sub.kernel32.dll_GetModuleHandleA_2
cmp eax, 1
jbe 0x51bdc3
push 0
call sub.kernel32.dll_ExitProcess_1
push 0x51bf88
call sub.kernel32.dll_GetModuleHandleA_2
cmp eax, 1
jbe 0x51bdd9
push 0
call sub.kernel32.dll_ExitProcess_1
mov ecx, 0x56710c
mov edx, 0x567108
mov eax, 0x567104
call fcn.0051b500
lea eax, [ebp - 4]
mov edx, 0x51bf9c
call fcn.0040478c
xor esi, esi
mov edi, 8
mov ebx, 0x5246c8
lea eax, [ebp - 0x10]
mov ecx, dword [ebx]
mov edx, dword [ebp - 4]
call fcn.00404a00
mov eax, dword [ebp - 0x10]
call fcn.00409708
test al, al
je 0x51be23
xor eax, eax
mov esi, eax
add ebx, 4
dec edi
jne 0x51be06
test esi, esi
jne 0x51bebc
mov eax, dword [0x567104]
mov edx, 0x51bfc0
call fcn.00404b00
jne 0x51bebc
lea eax, [ebp - 0x14]
call fcn.005186b8
mov eax, dword [ebp - 0x14]
mov edx, 0x51bfd0
call fcn.00404b00
jne 0x51bebc
mov eax, dword [0x5670e0]
mov eax, dword [eax + 0x3bc]
mov eax, dword [eax + 0x220]
mov edx, 0x51bfe0
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [0x5670e0]
mov eax, dword [eax + 0x3bc]
mov eax, dword [eax + 0x220]
mov edx, 0x51c08c
mov ecx, dword [eax]
call dword [ecx + 0x74]
push 0
push 0
push 1
mov ecx, 0x51c0ac
mov edx, 0x51c0e8
xor eax, eax
call fcn.00518720
mov eax, 0x51c08c
call fcn.00409838
call fcn.00404578
push 0
call sub.kernel32.dll_ExitProcess_1
lea eax, [ebp - 8]
mov edx, 0x51c0fc
call fcn.0040478c
mov esi, 1
mov edi, 0x13
mov ebx, 0x5246e8
lea eax, [ebp - 0x18]
mov ecx, dword [ebx]
mov edx, dword [ebp - 8]
call fcn.00404a00
mov eax, dword [ebp - 0x18]
call fcn.00409708
test al, al
je 0x51bef5
xor eax, eax
mov esi, eax
add ebx, 4
dec edi
jne 0x51bed8
test esi, esi
jne 0x51bf06
push 0
call sub.kernel32.dll_ExitProcess_1
lea eax, [ebp - 0xc]
mov edx, 0x51c11c
call fcn.0040478c
mov esi, 1
mov edi, 4
mov ebx, 0x524734
mov ecx, dword [ebx]
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0xc]
call fcn.00404a00
mov eax, dword [ebp - 0x1c]
call fcn.00409708
test al, al
je 0x51bf3f
xor eax, eax
mov esi, eax
add ebx, 4
dec edi
jne 0x51bf22
test esi, esi
jne 0x51bf50
push 0
call sub.kernel32.dll_ExitProcess_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51bf72
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.00404718
ret