joyce8/EMBER2024-capa huggingface dataset:
Function at 0x470100
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4e8be4]
cmp dword [eax + 0x30], 0
je 0x4701aa
cmp dword [ebx + 0x94], 0
jne 0x4701a4
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x470090
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4701a4
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x47016a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4701a4
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041bd6c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x470179
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x470d08
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x470d3d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404e4c
jmp 0x470d4a
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404db0
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x471f14
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x471f55
mov eax, esi
call fcn.00457ebc
test al, al
je 0x471f55
mov eax, dword [ebx + 0x84]
call fcn.00457bb8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x471f55
push 0
mov eax, dword [ebx + 0x84]
call fcn.00457bb8
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x48823c
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x488244
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x488436
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x48844c
mov eax, esi
call fcn.0047bed4
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.00404db0
lea ecx, [ebp - 0x10]
mov edx, 0x488460
mov eax, esi
call fcn.0047bed4
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.00404db0
lea ecx, [ebp - 0x14]
mov edx, 0x488478
mov eax, esi
call fcn.0047bed4
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.00404db0
lea ecx, [ebp - 0x18]
mov edx, 0x488494
mov eax, esi
call fcn.0047bed4
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.00404db0
lea ecx, [ebp - 0x1c]
mov edx, 0x4884b0
mov eax, esi
call fcn.0047bed4
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.00404db0
lea ecx, [ebp - 0x24]
mov edx, 0x4884c8
mov eax, esi
call fcn.0047bed4
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.004097f4
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.00409df8
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x4884e0
mov eax, esi
call fcn.0047bed4
mov eax, dword [ebp - 0x28]
call fcn.00478474
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x4884f0
mov eax, esi
call fcn.0047bed4
mov eax, dword [ebp - 0x2c]
call fcn.00478474
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x488508
mov eax, esi
call fcn.0047bed4
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.00409df8
inc eax
je 0x4883d9
lea ecx, [ebp - 0x34]
mov edx, 0x488508
mov eax, esi
call fcn.0047bed4
mov eax, dword [ebp - 0x34]
call fcn.00409dbc
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040b904
fstp qword [ebp - 0x3c]
wait
call fcn.0040bd24
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x4883f4
lea ecx, [ebp - 0x40]
mov edx, 0x488508
mov eax, esi
call fcn.0047bed4
mov eax, dword [ebp - 0x40]
call fcn.00478474
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x488518
mov eax, esi
call fcn.0047bed4
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.00404db0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48843d
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00404d80
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00404d80
ret
Function at 0x48cd78
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x418ac4]
call fcn.0040597c
xor eax, eax
push ebp
push 0x48cebc
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4e5758], 0
jne 0x48cdcb
mov ecx, dword [0x4e75c8]
mov dl, 1
mov eax, dword [0x40884c]
call fcn.0040dc3c
call fcn.004046b0
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.004035e4
mov eax, ebx
call fcn.00405638
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x48cecc
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00406c50
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00405648
test eax, eax
jle 0x48ce63
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x48ce5c
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404fe4
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404fcc
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00409784
test eax, eax
jne 0x48ce5c
mov ebx, 0x15
jmp 0x48ce68
mov ebx, 0x10
jmp 0x48ce68
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x4e5758]
call fcn.0048cc74
mov eax, dword [ebp - 8]
call fcn.0048cc74
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00406c68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48cec3
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404d80
lea eax, [ebp - 0x10]
mov edx, dword [0x418ac4]
call fcn.00405a4c
ret

Function at 0x4a3cb8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x4a3d12
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.004a3ca8
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.00476ba8
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.004767a8
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a3d19
lea eax, [ebp - 4]
call fcn.00404d5c
ret
Function at 0x4ac618
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
mov ebx, 0x4e5e54
mov eax, dword [0x4e7e80]
cmp dword [eax], 2
jne 0x4ac7c4
push 0x4ac7dc
call sub.kernel32.dll_GetModuleHandleA_2
mov dword [ebx], eax
cmp dword [ebx], 0
sete byte [0x4e8fa0]
cmp dword [ebx], 0
jne 0x4ac653
push 0x4ac7dc
call sub.kernel32.dll_LoadLibraryA
mov dword [ebx], eax
cmp dword [ebx], 0
je 0x4ac7c4
push 0x4ac7e8
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e5e60], eax
push 0x4ac800
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e5e64], eax
push 0x4ac814
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e5e58], eax
push 0x4ac824
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e5e5c], eax
push 0x4ac82c
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e5e68], eax
push 0x4ac83c
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e5ea4], eax
push 0x4ac84c
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e5e6c], eax
push 0x4ac868
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e5e70], eax
push 0x4ac878
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e5e98], eax
push 0x4ac888
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e5e74], eax
push 0x4ac89c
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e5e78], eax
push 0x4ac8b4
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e5e80], eax
push 0x4ac8c0
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e5e7c], eax
push 0x4ac8d0
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e5e84], eax
push 0x4ac8e0
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e5e88], eax
push 0x4ac8fc
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e5e8c], eax
push 0x4ac918
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e5e90], eax
push 0x4ac930
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e5e94], eax
push 0x4ac944
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e5e9c], eax
push 0x4ac95c
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e5ea0], eax
cmp dword [ebx], 0
je 0x4ac7d2
cmp dword [0x4e5e84], 0
jne 0x4ac7d6
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x4afbbc
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
mov dword [esp], 0xff
mov eax, dword [esp]
call fcn.0040aaec
mov dword [esp + 4], eax
push esp
mov eax, dword [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x4afbf1
mov edx, ebx
mov eax, dword [esp + 4]
call fcn.0040aad8
jmp 0x4afbf8
mov eax, ebx
call fcn.00404d5c
mov eax, dword [esp + 4]
call fcn.0040ab48
pop ecx
pop edx
pop ebx
ret

Function at 0x4afff8
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b00a4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x44]
mov esi, 0x1000
call sub.kernel32.dll_GetEnvironmentStringsA
mov dword [ebp - 8], eax
xor edi, edi
lea eax, [ebp - 0xc]
call fcn.00404d5c
cmp esi, edi
jbe 0x4b0080
mov eax, dword [ebp - 8]
mov bl, byte [eax + edi]
test bl, bl
je 0x4b0060
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00404f44
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.00405024
jmp 0x4b007b
cmp dword [ebp - 0xc], 0
je 0x4b0080
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0xc]
call fcn.00404d5c
inc edi
cmp esi, edi
ja 0x4b003f
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeEnvironmentStringsA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b00ab
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404d80
ret

Function at 0x4b00b4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov ebx, ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4b014d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004054a4
mov eax, 0x104
call fcn.0040aaec
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push edi
push esi
call sub.shell32.dll_SHGetSpecialFolderLocation
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
test eax, eax
je 0x4b0110
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.004055bc
mov eax, dword [ebp - 8]
call fcn.0040ab48
lea eax, [ebp - 0xc]
push eax
call sub.shell32.dll_SHGetMalloc
call fcn.00418d10
test al, al
je 0x4b0137
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b0154
lea eax, [ebp - 0xc]
call fcn.00406c50
ret
Function at 0x4b015c
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040520c
xor eax, eax
push ebp
push 0x4b0254
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xff
call fcn.0040aaec
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x20]
mov ecx, 0x4b0270
mov edx, dword [ebp - 4]
call fcn.00405068
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc]
call fcn.0040a968
push 0x8001
call sub.kernel32.dll_SetErrorMode
mov word [ebp - 8], ax
xor eax, eax
push ebp
push 0x4b022f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4b0201
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b020f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b0236
mov eax, dword [ebp - 0xc]
call fcn.0040ab48
movzx eax, word [ebp - 8]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x4b0c78
Capabilities:
Compare security identifiers

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov byte [esp], 0
lea eax, [esp + 4]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
mov ebx, eax
test ebx, ebx
jne 0x4b0cbc
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x3f0
jne 0x4b0cbc
lea eax, [esp + 4]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov ebx, eax
test ebx, ebx
je 0x4b0d67
lea eax, [esp + 8]
push eax
push 0
push 0
push 2
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_GetTokenInformation
mov eax, dword [esp + 8]
call fcn.00402b58
mov esi, eax
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
push esi
push 2
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_GetTokenInformation
mov ebx, eax
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_CloseHandle_1
test ebx, ebx
je 0x4b0d60
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
push 0x4e60a8
call sub.advapi32.dll_AllocateAndInitializeSid
mov ebx, dword [esi]
dec ebx
test ebx, ebx
jl 0x4b0d56
inc ebx
xor edi, edi
mov eax, dword [esi + edi*8 + 4]
push eax
mov eax, dword [esp + 0x10]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x4b0d52
mov byte [esp], 1
jmp 0x4b0d56
inc edi
dec ebx
jne 0x4b0d39
mov eax, dword [esp + 0xc]
push eax
call sub.advapi32.dll_FreeSid
mov eax, esi
call fcn.00402b88
mov al, byte [esp]
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x4b0e84
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040520c
mov eax, dword [ebp - 8]
call fcn.0040520c
xor eax, eax
push ebp
push 0x4b0f87
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00404d5c
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.0040521c
mov esi, eax
push esi
mov eax, dword [ebp - 4]
call fcn.0040521c
mov ebx, eax
push ebx
call sub.advapi32.dll_LookupAccountNameA
mov eax, dword [ebp - 0x14]
call fcn.0040aaec
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
call fcn.004094e8
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
push eax
push esi
push ebx
call sub.advapi32.dll_LookupAccountNameA
test eax, eax
je 0x4b0f54
mov edx, edi
mov eax, dword [ebp - 0xc]
call fcn.004b0d74
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_GetSidSubAuthorityCount
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_GetLengthSid
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0x10]
call fcn.0040aad8
mov eax, dword [ebp - 0x10]
call fcn.0040ab48
mov eax, dword [ebp - 0xc]
call fcn.00402b88
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b0f8e
lea eax, [ebp - 0x20]
call fcn.00404d5c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404d80
ret
Function at 0x4b1468
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe24
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1dc], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4b1539
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1d8]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, esi
call fcn.00404d5c
push 0x40
lea eax, [ebp - 0x48]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x48]
push eax
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4b1520
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [ebp - 8], eax
xor ebx, ebx
jmp 0x4b14fc
push dword [esi]
push dword [edi]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 0x1dc]
call fcn.00404f54
push dword [ebp - 0x1dc]
push 0x4b1550
mov eax, esi
mov edx, 3
call fcn.004050dc
inc ebx
mov eax, dword [ebp - 8]
mov edi, dword [eax + ebx*4]
test edi, edi
jne 0x4b14ce
mov eax, dword [esi]
call fcn.0040501c
mov edx, eax
mov eax, esi
mov ecx, 1
call fcn.004052bc
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b1540
lea eax, [ebp - 0x1dc]
call fcn.00404d5c
ret

Function at 0x4b1674
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4b174a
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
mov ebx, 0x4e91c0
lea eax, [ebp - 4]
lea edx, [esi + 0x61]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 4]
lea eax, [ebp - 8]
call fcn.004034c8
mov edx, 0x4b1758
lea eax, [ebp - 8]
mov cl, 2
call fcn.00403498
lea edx, [ebp - 8]
mov eax, ebx
call fcn.00404fc0
lea eax, [ebx + 4]
mov edx, 0x7f
call fcn.004053a8
lea eax, [ebx + 4]
call fcn.00405274
mov edx, 0x7f
call fcn.00408200
push 0x7f
lea eax, [ebx + 4]
call fcn.00405274
push eax
mov eax, dword [ebx]
call fcn.0040521c
push eax
call sub.kernel32.dll_QueryDosDeviceA
mov eax, dword [ebx + 4]
call fcn.0040521c
mov edx, eax
lea eax, [ebp - 0xc]
call fcn.00404f54
mov eax, dword [ebp - 0xc]
call fcn.0040501c
mov edi, eax
mov dword [ebx + 8], edi
lea eax, [ebx + 4]
mov edx, edi
call fcn.004053a8
inc esi
add ebx, 0xc
cmp esi, 0x1a
jne 0x4b1697
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b1751
lea eax, [ebp - 0xc]
call fcn.00404d5c
ret
Function at 0x4c39d0
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4c3b08
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea eax, [ebp - 8]
mov edx, 0x104
call fcn.004053a8
push 0x104
lea eax, [ebp - 8]
call fcn.00405274
push eax
push 0x4c3b1c
call sub.kernel32.dll_GetEnvironmentVariableA
mov edx, eax
lea eax, [ebp - 8]
call fcn.004053a8
mov eax, dword [ebp - 8]
call fcn.0040501c
test eax, eax
jle 0x4c3aea
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.004035e4
mov dword [ebp - 0x4c], 0x44
mov dword [ebp - 0x20], 1
mov word [ebp - 0x1c], 0
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0x210
push 0
push 0
push 0
push dword [ebp - 8]
push 0x4c3b2c
push ebx
push 0x4c3b3c
push esi
lea eax, [ebp - 0x60]
mov edx, 5
call fcn.004050dc
mov eax, dword [ebp - 0x60]
call fcn.0040521c
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x4c3aea
xor eax, eax
push ebp
push 0x4c3ae3
push dword fs:[eax]
mov dword fs:[eax], esp
push edi
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
setne byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c3aea
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c3b0f
lea eax, [ebp - 0x60]
call fcn.00404d5c
lea eax, [ebp - 8]
call fcn.00404d5c
ret

Function at 0x4c3b40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040521c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4c3b5d
and eax, 0x10
cmp eax, 0x10
je 0x4c3b61
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x4c4200
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
test dl, dl
je 0x4c4214
add esp, 0xfffffff0
call fcn.00404184
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.004b2460
lea eax, [ebp - 0x24]
xor ecx, ecx
mov edx, 0x24
call fcn.004035e4
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x20]
mov dword [esi + 0xb8], eax
mov eax, esi
test bl, bl
je 0x4c4257
call fcn.004041dc
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d85e8
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe24
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1dc], ecx
mov esi, edx
xor eax, eax
push ebp
push 0x4d86b9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1d8]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, esi
call fcn.00404d5c
push 0x40
lea eax, [ebp - 0x48]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x48]
push eax
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4d86a0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [ebp - 8], eax
xor ebx, ebx
jmp 0x4d867c
push dword [esi]
push dword [edi]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 0x1dc]
call fcn.00404f54
push dword [ebp - 0x1dc]
push 0x4d86d0
mov eax, esi
mov edx, 3
call fcn.004050dc
inc ebx
mov eax, dword [ebp - 8]
mov edi, dword [eax + ebx*4]
test edi, edi
jne 0x4d864e
mov eax, dword [esi]
call fcn.0040501c
mov edx, eax
mov eax, esi
mov ecx, 1
call fcn.004052bc
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d86c0
lea eax, [ebp - 0x1dc]
call fcn.00404d5c
ret
Function at 0x4e1710
Capabilities:
Hide graphical window

Disassembly:
xor edx, edx
mov eax, dword [0x4e9400]
call fcn.00450a50
xor edx, edx
mov eax, dword [0x4e9400]
call fcn.00450a74
push 0
mov eax, dword [0x4e7b80]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
ret