joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ca040
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53712d
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x59a0a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x21c]
mov edi, dword [ebp + 0xc]
push 0x20a
push 0
push eax
mov dword [ebp - 0x22c], esi
mov dword [ebp - 0x224], 0
call fcn.0049e130
mov dword [esi + 0x10], 0
add esp, 0xc
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
cmp dword [esi + 0x14], 8
jb 0x4ca0bf
mov eax, dword [esi]
jmp 0x4ca0c1
mov eax, esi
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x220]
mov dword [ebp - 4], ecx
push eax
push 0x20019
push ecx
push edi
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x224], 1
mov dword [ebp - 0x220], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4ca16a
lea eax, [ebp - 0x228]
mov dword [ebp - 0x228], 0x104
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push 0x554958
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4ca15e
cmp word [ebp - 0x21c], ax
jne 0x4ca134
xor ecx, ecx
jmp 0x4ca14f
lea ecx, [ebp - 0x21c]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4ca140
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x21c]
mov ecx, esi
push eax
call fcn.00405040
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049aa22
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4cbbf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, ecx
mov dword [ebp - 4], edx
mov ecx, dword [edx + 0x20]
test ecx, ecx
je 0x4cbc0e
mov eax, dword [ecx]
cmp eax, vtable.CLibUrlDownloadCallbackImp.0
je 0x4cbc0e
jmp 0x4cbc7e
mov edx, dword [ebp - 4]
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
imul esi, dword [ebp + 0x10]
test esi, esi
je 0x4cbc74
push edi
mov edi, dword [ebp + 8]
mov ecx, bind
nop word [eax + eax]
push 0
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0
push eax
cmp esi, 0x7fffffff
mov eax, esi
cmova eax, ecx
push eax
push edi
push dword [edx + 0x18]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4cbc5c
call fcn.004054a0
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x4cbc73
mov edx, dword [ebp - 4]
add ebx, ecx
add edi, ecx
sub esi, ecx
mov ecx, bind
jne 0x4cbc30
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
call dword [eax]
test eax, eax
je 0x4cbc0b
mov eax, 0x10000000
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4cc0a0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x537360
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x59a0a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
lea ecx, [ebp - 0x40]
call fcn.004cc3b0
push 0xa
push str.Netsh.exe
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0
call fcn.004043f0
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
push 0
cmovae eax, dword [ebp - 0x40]
push eax
call fcn.004a6b99
add esp, 8
cmp eax, 0xffffffff
jne 0x4cc10e
xor esi, esi
jmp 0x4cc204
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetVersion]
lea ecx, [ebp - 0x28]
cmp al, 5
jbe 0x4cc172
push 0x27
push 0x5550c8
call fcn.00405040
cmp word [edi], 0
jne 0x4cc149
xor ecx, ecx
jmp 0x4cc15f
mov ecx, edi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4cc150
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x28]
call fcn.004043f0
push 1
push 0x5550c4
jmp 0x4cc1b0
push 0x28
push str.firewall_delete_allowedprogram_program_
call fcn.00405040
cmp word [esi], 0
jne 0x4cc188
xor ecx, ecx
jmp 0x4cc19f
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4cc190
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.004043f0
push 0xd
push str.__profileALL
lea ecx, [ebp - 0x28]
call fcn.004043f0
cmp dword [ebp - 0x14], 8
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x40]
cmovae edx, dword [ebp - 0x28]
cmp dword [ebp - 0x2c], 8
cmovae ecx, dword [ebp - 0x40]
sub esp, 0xc
call fcn.004cc240
mov ecx, dword [ebp - 0x14]
add esp, 0xc
mov esi, eax
cmp ecx, 8
jb 0x4cc1f0
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.00403010
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x4cc219
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00403010
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049aa22
mov esp, ebp
pop ebp
ret
Function at 0x4cc240
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53738d
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x59a0a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
push 0x40
lea eax, [ebp - 0x78]
push 0
push eax
call fcn.0049e130
add esp, 0xc
mov dword [ebp - 0x7c], 0x44
xorps xmm0, xmm0
mov dword [ebp - 0x50], 0x181
xor eax, eax
mov dword [ebp - 0x14], 7
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
push 1
push 0x554f60
movups xmmword [ebp - 0x38], xmm0
mov word [ebp - 0x28], ax
call fcn.00405040
mov dword [ebp - 4], 0
cmp word [esi], 0
jne 0x4cc2c7
xor ecx, ecx
jmp 0x4cc2df
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4cc2d0
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.004043f0
push 2
push 0x554f64
lea ecx, [ebp - 0x28]
call fcn.004043f0
cmp word [edi], 0
jne 0x4cc302
xor ecx, ecx
jmp 0x4cc316
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4cc307
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x28]
call fcn.004043f0
lea ecx, [ebp - 0x38]
xor eax, eax
cmp dword [ebp - 0x14], 8
push ecx
lea ecx, [ebp - 0x7c]
mov word [ebp - 0x4c], ax
push ecx
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [ebp - 0x14]
mov esi, eax
neg esi
sbb esi, esi
neg esi
cmp ecx, 8
jb 0x4cc36b
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.00403010
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049aa22
mov esp, ebp
pop ebp
ret

Function at 0x4cc3b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x59a0a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x20a
lea eax, [ebp - 0x210]
mov dword [ebp - 0x218], 0
mov esi, ecx
push 0
push eax
mov dword [ebp - 0x214], esi
call fcn.0049e130
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
cmp word [ebp - 0x210], ax
jne 0x4cc41e
xor ecx, ecx
jmp 0x4cc436
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4cc427
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x210]
mov ecx, esi
push eax
call fcn.00405040
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0049aa22
mov esp, ebp
pop ebp
ret
Function at 0x4ccae0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5373cb
mov eax, dword fs:[0]
push eax
sub esp, 0x270
mov eax, dword [0x59a0a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x278], esi
xor eax, eax
mov dword [ebp - 0x27c], 0
mov dword [ebp - 0x25c], 7
mov dword [ebp - 0x260], 0
mov word [ebp - 0x270], ax
mov dword [ebp - 4], eax
push 0x208
push eax
mov dword [ebp - 0x278], eax
mov dword [ebp - 0x274], eax
lea eax, [ebp - 0x258]
push eax
call fcn.0049e130
add esp, 0xc
lea eax, [ebp - 0x258]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
test eax, eax
je 0x4ccc98
push 0
lea eax, [ebp - 0x258]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
test ebx, ebx
je 0x4ccc68
push ebx
call fcn.004a51f0
mov edi, eax
add esp, 4
test edi, edi
je 0x4ccc68
push ebx
push 0
push edi
call fcn.0049e130
add esp, 0xc
lea eax, [ebp - 0x258]
push edi
push ebx
push 0
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x4ccc5f
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x274]
push eax
push 0x5558d8
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x4ccc5f
push 0x40
lea eax, [ebp - 0x50]
push 0
push eax
call fcn.0049e130
mov ecx, dword [ebp - 0x274]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push 0x5558dc
lea eax, [ebp - 0x50]
push 0x20
push eax
call fcn.00404fc0
add esp, 0x28
cmp word [ebp - 0x50], 0
jne 0x4ccc38
xor ecx, ecx
jmp 0x4ccc4f
lea ecx, [ebp - 0x50]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4ccc40
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x270]
call fcn.00405040
push edi
call fcn.004a51fb
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov ecx, esi
mov word [esi], ax
lea eax, [ebp - 0x270]
push eax
call fcn.004042c0
mov ecx, dword [ebp - 0x25c]
cmp ecx, 8
jb 0x4cccd7
inc ecx
push ecx
jmp 0x4cccc6
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov ecx, esi
mov word [esi], ax
lea eax, [ebp - 0x270]
push eax
call fcn.004042c0
mov eax, dword [ebp - 0x25c]
cmp eax, 8
jb 0x4cccd7
inc eax
push eax
push dword [ebp - 0x270]
lea ecx, [ebp - 0x270]
call fcn.00403010
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049aa22
mov esp, ebp
pop ebp
ret
Function at 0x4ccd50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x537415
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x59a0a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x228], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x22c], esi
jb 0x4ccdbd
mov eax, dword [esi]
jmp 0x4ccdbf
mov eax, esi
xor ecx, ecx
mov word [eax], cx
push 0x20a
push ecx
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], ecx
push eax
mov dword [ebp - 0x228], 1
call fcn.0049e130
add esp, 0xc
mov dword [ebp - 0x220], 0
lea eax, [ebp - 0x220]
push eax
push 0x20019
push 0
push edi
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4cce7f
lea eax, [ebp - 0x224]
mov dword [ebp - 0x224], 0x104
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push 0x555850
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4cce73
cmp word [ebp - 0x21c], ax
jne 0x4cce4c
xor ecx, ecx
jmp 0x4cce64
lea ecx, [ebp - 0x21c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4cce55
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x21c]
mov ecx, esi
push eax
call fcn.00405040
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049aa22
mov esp, ebp
pop ebp
ret

Function at 0x4cd380
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x59a0a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4cd453
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x4cd453
xorps xmm0, xmm0
mov dword [ebp - 0x214], 0
mov eax, 0x414
movq qword [ebp - 0x21c], xmm0
push 0x208
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x20c]
movups xmmword [ebp - 0x22c], xmm0
push 0
push eax
mov word [ebp - 0x210], 0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x228], 3
call fcn.0049e130
push 0x103
push esi
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004a0ef4
add esp, 0x1c
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
neg eax
pop esi
sbb eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049aa22
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.0049aa22
mov esp, ebp
pop ebp
ret
Function at 0x4cd720
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x59a0a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
xor eax, eax
push edi
xor edi, edi
mov dword [ebp - 0x238], esi
mov dword [ebp - 0x23c], eax
test esi, esi
jne 0x4cd75b
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049aa22
mov esp, ebp
pop ebp
ret
call fcn.004cd980
test eax, eax
jne 0x4cd769
call fcn.004cd8e0
push ebx
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
mov dword [ebp - 0x234], ebx
cmp ebx, 0xffffffff
je 0x4cd7a4
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x4cd7c0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049aa22
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x228], 0
jbe 0x4cd897
mov ecx, dword [esi]
xor ebx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4cd7d4
sub ecx, edx
sar ecx, 1
je 0x4cd891
mov edx, esi
nop dword [eax + eax]
mov edx, dword [edx]
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4cd7f7
sub ecx, esi
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push edx
push eax
call fcn.004a6c71
add esp, 0xc
test eax, eax
jne 0x4cd867
mov eax, dword [ebp - 0x228]
push eax
push 0
push 0x100001
mov dword [ebp - 0x23c], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4cd867
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, eax
test edi, edi
jne 0x4cd860
push 0x1388
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
mov eax, 1
cmove edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x238]
inc ebx
lea edx, [eax + ebx*4]
mov eax, dword [edx]
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4cd876
sub eax, esi
sar eax, 1
jne 0x4cd7f0
mov esi, dword [ebp - 0x238]
mov ebx, dword [ebp - 0x234]
lea eax, [ebp - 0x230]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4cd7c0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x23c]
test eax, eax
mov ecx, dword [ebp - 4]
mov eax, 1
cmove edi, eax
xor ecx, ebp
pop ebx
mov eax, edi
pop edi
pop esi
call fcn.0049aa22
mov esp, ebp
pop ebp
ret
Function at 0x4cd8e0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x59a0a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x18]
xor esi, esi
push eax
push 0x20
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4cd952
lea eax, [ebp - 0x10]
push eax
push str.SeDebugPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x4cd952
push esi
push esi
push 0x10
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
push esi
push dword [ebp - 0x18]
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x4cd952
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
neg esi
sbb esi, esi
inc esi
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4cd960
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0049aa22
mov esp, ebp
pop ebp
ret

Function at 0x4cd980
Capabilities:
Acquire debug privileges
Get token privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x59a0a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x214]
xor esi, esi
push eax
push 0x20008
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x210], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4cdab2
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x210]
push eax
push esi
push esi
push 3
push dword [ebp - 0x214]
call edi
test eax, eax
jne 0x4cdab1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4cdab1
push ebx
push dword [ebp - 0x210]
call fcn.0049aa41
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4cdab0
push dword [ebp - 0x210]
push esi
push ebx
call fcn.0049e130
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x210]
push ebx
push 3
push dword [ebp - 0x214]
call edi
test eax, eax
je 0x4cdaa7
xor edi, edi
cmp dword [ebx], esi
jbe 0x4cdaa7
lea esi, [ebx + 0xc]
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0049e130
add esp, 0xc
mov dword [ebp - 0x210], 0x104
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [esi - 8]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeNameW]
test eax, eax
je 0x4cda9d
lea eax, [ebp - 0x20c]
push 0x555640
push eax
call fcn.004a689d
add esp, 8
test eax, eax
jne 0x4cda9d
test byte [esi], 3
jne 0x4cdad4
inc edi
add esi, 0xc
cmp edi, dword [ebx]
jb 0x4cda42
xor esi, esi
push ebx
call fcn.0049aa3c
add esp, 4
pop ebx
pop edi
mov ecx, dword [ebp - 0x214]
test ecx, ecx
je 0x4cdac3
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0049aa22
mov esp, ebp
pop ebp
ret
mov esi, 1
jmp 0x4cdaa7
Function at 0x4cdae0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x59a0a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov ebx, ecx
xor edi, edi
test ebx, ebx
jne 0x4cdb0f
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049aa22
mov esp, ebp
pop ebp
ret
push esi
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 0x234], esi
cmp esi, 0xffffffff
jne 0x4cdb3a
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049aa22
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x4cdbef
nop word [eax + eax]
cmp dword [ebp - 0x228], 0
jbe 0x4cdbd7
mov ecx, dword [ebx]
xor edi, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4cdb70
sub ecx, edx
sar ecx, 1
je 0x4cdbd7
mov edx, ebx
mov edx, dword [edx]
mov ecx, edx
lea esi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4cdb90
sub ecx, esi
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push edx
push eax
call fcn.004a6c71
add esp, 0xc
test eax, eax
je 0x4cdc0d
inc edi
mov eax, dword [ebx + edi*4]
lea edx, [ebx + edi*4]
lea esi, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4cdbc0
sub eax, esi
sar eax, 1
jne 0x4cdb83
mov esi, dword [ebp - 0x234]
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4cdb60
xor edi, edi
test esi, esi
je 0x4cdbfa
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop esi
pop edi
xor ecx, ebp
pop ebx
call fcn.0049aa22
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x234]
mov edi, 1
jmp 0x4cdbef
Function at 0x4cdc50
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7c
mov eax, dword [0x59a0a0]
xor eax, esp
mov dword [esp + 0x78], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [esp + 0x1c]
push esi
push edi
push 0x40
xor edi, edi
mov esi, ecx
push edi
push eax
call fcn.0049e130
add esp, 0xc
mov dword [esp + 0x20], 0x44
mov eax, 6
mov dword [esp + 0x4c], 1
mov word [esp + 0x50], ax
lea ecx, [esp + 0x6c]
xor eax, eax
mov dword [esp + 0x80], 7
push 0xffffffffffffffff
push eax
xorps xmm0, xmm0
mov dword [esp + 0x84], edi
push esi
movups xmmword [esp + 0x1c], xmm0
mov word [esp + 0x78], ax
call fcn.004026e0
cmp dword [esp + 0x80], 8
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x24]
push ecx
push edi
push edi
push edi
push edi
push edi
lea eax, [esp + 0x88]
cmovae eax, dword [esp + 0x88]
push edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4cdd03
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx], eax
jmp 0x4cdd11
push dword [esp + 0x14]
mov edi, dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x80]
cmp ecx, 8
jb 0x4cdd2c
inc ecx
push ecx
push dword [esp + 0x70]
lea ecx, [esp + 0x74]
call fcn.00403010
mov ecx, dword [esp + 0x84]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0049aa22
mov esp, ebp
pop ebp
ret

Function at 0x4cdd50
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push edi
push 0x38
lea eax, [ebp - 0x38]
mov esi, edx
push 0
push eax
mov edi, ecx
call fcn.0049e130
add esp, 0xc
mov dword [ebp - 0x3c], 0x3c
cmp dword [edi + 0x14], 8
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0x555194
jb 0x4cdd89
mov edi, dword [edi]
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x2c], edi
jb 0x4cdd94
mov esi, dword [esi]
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x28], esi
push eax
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x38], 0x400
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
pop edi
pop esi
test eax, eax
jne 0x4cddbf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4cddd0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push esi
push edi
push 0x38
lea eax, [ebp - 0x3c]
mov dword [ebp - 4], 0
push 0
push eax
mov esi, edx
mov edi, ecx
call fcn.0049e130
add esp, 0xc
mov dword [ebp - 0x40], 0x3c
cmp dword [edi + 0x14], 8
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0x555188
jb 0x4cde10
mov edi, dword [edi]
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x30], edi
jb 0x4cde1b
mov esi, dword [esi]
xor eax, eax
mov dword [ebp - 0x2c], esi
cmp byte [ebp + 8], al
mov dword [ebp - 0x3c], 0x440
sete al
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
pop edi
pop esi
test eax, eax
jne 0x4cde4a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret