joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48c850
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x48c87e
mov eax, ebx
call fcn.0048d304
cmp dword [ebx + 0x40], 0
je 0x48c877
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x48c8ef
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x48c8e1
cmp dword [ebx + 8], 0
je 0x48c8a0
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x48c8b2
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x48c8e1
cmp dword [ebx + 8], 0
je 0x48c893
cmp eax, 3
je 0x48c8c5
dec eax
jne 0x48c893
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x48c893
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x48c893
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x48c90d
cmp dword [ebx + 0x14], 0xcc
je 0x48c90d
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0048c918
pop ebx
ret

Function at 0x4c54cc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d74
xor eax, eax
push ebp
push 0x4c5593
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, 0x4c55ac
call fcn.00404ec8
test eax, eax
jne 0x4c5517
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, 0x4c55b8
call fcn.00404bd0
test bl, bl
je 0x4c5557
lea edx, [ebp - 8]
mov eax, 0x4c55c8
call fcn.004c5f94
cmp dword [ebp - 8], 0
je 0x4c5557
push esi
push 0
mov eax, dword [ebp - 4]
call fcn.00404d84
push eax
mov eax, dword [ebp - 8]
call fcn.00404d84
push eax
push 0x4c55d0
call sub.user32.dll_GetDesktopWindow
push eax
call sub.shell32.dll_ShellExecuteA
mov ebx, eax
jmp 0x4c5578
push 1
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404d84
push eax
push 0x4c55d0
call sub.user32.dll_GetDesktopWindow
push eax
call sub.shell32.dll_ShellExecuteA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c559a
lea eax, [ebp - 8]
mov edx, 2
call fcn.004048e8
ret
Function at 0x4c55d8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d74
xor eax, eax
push ebp
push 0x4c5694
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x4c5621
push 0x4c56ac
push ebx
push 0x4c56bc
push dword [ebp - 4]
push 0x4c56c8
lea eax, [ebp - 4]
mov edx, 5
call fcn.00404c44
jmp 0x4c5631
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, 0x4c56ac
call fcn.00404bd0
push dword [ebp - 4]
push 0x4c56d4
push esi
push 0x4c56e8
push dword [ebp + 0x10]
push 0x4c56f8
push dword [ebp + 0xc]
push 0x4c5708
push dword [ebp + 8]
lea eax, [ebp - 4]
mov edx, 9
call fcn.00404c44
push 1
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404d84
push eax
push 0x4c5710
call sub.user32.dll_GetDesktopWindow
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c569b
lea eax, [ebp - 4]
call fcn.004048c4
ret

Function at 0x4c5718
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff5c
push ebx
xor eax, eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x9c], eax
xor eax, eax
push ebp
push 0x4c5872
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x94]
mov edx, 0x94
call fcn.004c62d8
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
xor ebx, ebx
cmp dword [ebp - 0x84], 2
jne 0x4c57b9
mov eax, dword [ebp - 0x90]
sub eax, 3
je 0x4c5787
dec eax
je 0x4c578e
dec eax
je 0x4c5795
jmp 0x4c5854
mov bl, 5
jmp 0x4c5854
mov bl, 6
jmp 0x4c5854
mov eax, dword [ebp - 0x8c]
test eax, eax
jne 0x4c57a6
mov bl, 7
jmp 0x4c5854
cmp eax, 1
jne 0x4c57b2
mov bl, 9
jmp 0x4c5854
mov bl, 0xa
jmp 0x4c5854
cmp dword [ebp - 0x90], 4
jne 0x4c5854
mov eax, dword [ebp - 0x8c]
test eax, eax
jne 0x4c580c
mov bl, 1
lea eax, [ebp - 0x9c]
lea edx, [ebp - 0x80]
mov ecx, 0x80
call fcn.00404b34
mov eax, dword [ebp - 0x9c]
lea edx, [ebp - 0x98]
call fcn.00409450
mov eax, dword [ebp - 0x98]
mov edx, 0x4c5888
call fcn.00404cd0
jne 0x4c5854
mov bl, 2
jmp 0x4c5854
cmp eax, 0xa
jne 0x4c584d
mov bl, 3
lea eax, [ebp - 0xa4]
lea edx, [ebp - 0x80]
mov ecx, 0x80
call fcn.00404b34
mov eax, dword [ebp - 0xa4]
lea edx, [ebp - 0xa0]
call fcn.00409450
mov eax, dword [ebp - 0xa0]
mov edx, 0x4c5894
call fcn.00404cd0
jne 0x4c5854
mov bl, 4
jmp 0x4c5854
cmp eax, 0x5a
jne 0x4c5854
mov bl, 8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c5879
lea eax, [ebp - 0xa4]
mov edx, 4
call fcn.004048e8
ret

Function at 0x4c58b0
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov eax, esp
mov edx, 0x94
call fcn.004c62d8
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 0x10], 2
jne 0x4c58e4
cmp dword [esp + 4], 5
ja 0x4c58e8
cmp dword [esp + 4], 5
jne 0x4c58e4
cmp dword [esp + 8], 1
jae 0x4c58e8
xor eax, eax
jmp 0x4c58ea
mov al, 1
add esp, 0x94
ret
Function at 0x4c58f4
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_GetPriorityClass
mov esi, eax
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_GetThreadPriority
mov ebx, eax
push pe_nt_image_headers32
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_SetPriorityClass
push 0xf
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_SetThreadPriority
push 0xa
call sub.kernel32.dll_Sleep_1
rdtsc
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
push 0x28
call sub.kernel32.dll_Sleep_1
rdtsc
sub eax, dword [ebp - 4]
sbb edx, dword [ebp - 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
push ebx
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_SetThreadPriority
push esi
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_SetPriorityClass
mov eax, dword [ebp - 4]
mov ecx, 0x9c40
xor edx, edx
div ecx
mov ecx, 0xa
xor edx, edx
div ecx
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0xc], eax
fild qword [ebp - 0x10]
call fcn.00402c60
add eax, eax
lea eax, [eax + eax*4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4c59a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4c5a0a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x106]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 0x10c]
lea eax, [ebp - 0x106]
call fcn.0040a2e8
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.0040e530
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c5a11
lea eax, [ebp - 0x10c]
call fcn.004048c4
ret

Function at 0x4c5a18
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4c5a82
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x106]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 0x10c]
lea eax, [ebp - 0x106]
call fcn.0040a2e8
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.0040e530
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c5a89
lea eax, [ebp - 0x10c]
call fcn.004048c4
ret

Function at 0x4c5a90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4c5afa
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x106]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea edx, [ebp - 0x10c]
lea eax, [ebp - 0x106]
call fcn.0040a2e8
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.0040e530
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c5b01
lea eax, [ebp - 0x10c]
call fcn.004048c4
ret
Function at 0x4c5e3c
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4c5f62
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, dword [eax]
call dword [edx + 0x44]
push 0x20019
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, ebx
call fcn.004c5b50
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x4c5f4c
xor eax, eax
push ebp
push 0x4c5f45
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
jne 0x4c5f2e
cmp dword [ebp - 0xc], 0
je 0x4c5f2e
mov eax, dword [0x50ef78]
cmp byte [eax + 0xc], 0
je 0x4c5ed7
mov eax, dword [0x50ef58]
cmp dword [eax], 2
jne 0x4c5ed7
inc dword [ebp - 0x10]
inc dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
dec ebx
test ebx, ebx
jl 0x4c5f2e
inc ebx
xor esi, esi
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x10]
call fcn.00404f10
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
call fcn.00404d84
push eax
push esi
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegEnumValueA
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x14]
call fcn.00404f10
mov edx, dword [ebp - 0x18]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x4c5ee5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c5f4c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c5f69
lea eax, [ebp - 0x18]
call fcn.004048c4
ret

Function at 0x4ca170
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebx
add esp, 0xfffffee8
mov ebx, eax
mov eax, ebx
call fcn.004048c4
push 0x104
lea eax, [esp + 0x14]
push eax
call sub.wsock32.dll_gethostname
test eax, eax
jne 0x4ca1be
lea eax, [esp + 0x10]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x4ca1be
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [esp + 4], eax
push dword [esp + 4]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, ebx
call fcn.00404abc
add esp, 0x118
pop ebx
ret
Function at 0x4deff4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4df175
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x50e180], 0
jne 0x4df152
push 0x510db0
call sub.kernel32.dll_EnterCriticalSection_1
xor eax, eax
push ebp
push 0x4df14b
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x50e180], 0
jne 0x4df133
mov dword [ebp - 4], pe_nt_image_headers32
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404f10
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
call fcn.00404d84
push eax
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.00409124
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea edx, [ebp - 0x14]
xor ecx, ecx
mov eax, 0x4df18c
call fcn.0040a7d8
mov eax, dword [ebp - 0xc]
call fcn.00404d84
push eax
push 0x80000000
call sub.advapi32.dll_RegQueryValueA
test eax, eax
jne 0x4df0b4
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404f10
jmp 0x4df0eb
lea eax, [ebp - 8]
mov edx, 0x4df1ac
call fcn.0040495c
xor eax, eax
push ebp
push 0x4df0e1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0047eecc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4df0eb
mov eax, dword [ebp - 8]
call fcn.00404d84
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [0x50e180], eax
cmp dword [0x50e180], 0
jne 0x4df11e
mov ecx, dword [0x50eab4]
mov dl, 1
mov eax, dword [0x4084a8]
call fcn.0040d8c8
call fcn.00404240
push 0x4df1b8
mov eax, dword [0x50e180]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x510dc8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4df152
push 0x510db0
call sub.kernel32.dll_LeaveCriticalSection_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4df17c
lea eax, [ebp - 0x18]
call fcn.004048c4
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004048e8
ret
Function at 0x4ea6dc
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, eax
cmp byte [ebx + 0x87], 0
je 0x4ea717
cmp dword [ebx + 0x5c], 0
je 0x4ea717
mov eax, dword [ebx + 0x5c]
push eax
mov esi, dword [ebx + 0x68]
mov eax, dword [esi + 0x1a8]
push eax
mov eax, dword [eax]
call dword [eax + 0xb8]
mov edx, eax
mov eax, esi
call fcn.004e2d5c
xor eax, eax
mov dword [ebx + 0x5c], eax
mov byte [ebx + 0x87], 0
cmp dword [ebx + 0x5c], 0
jne 0x4ea862
cmp dword [ebx + 0x7c], 0
jne 0x4ea73d
mov dl, 1
mov eax, dword [0x41c1e0]
call fcn.00403980
mov dword [ebx + 0x7c], eax
cmp dword [ebx + 0xc], 0
je 0x4ea83b
mov eax, dword [ebx + 0xc]
push eax
mov al, byte [0x4ea868]
push eax
mov al, byte [0x4ea86c]
push eax
push 0
mov eax, dword [ebx + 0x7c]
push eax
mov eax, dword [0x50eaf0]
push eax
mov ecx, dword [ebx + 0x68]
mov dl, 1
mov eax, dword [0x4daf64]
call fcn.004dcef4
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x4ea834
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebx + 0x5c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x58]
push eax
mov eax, dword [ebx + 0x64]
push eax
mov esi, dword [ebx + 0x68]
mov eax, dword [esi + 0x1a8]
push eax
mov eax, dword [eax]
call dword [eax + 0xb4]
mov edx, eax
mov eax, esi
call fcn.004e2d5c
lea eax, [ebx + 0x10]
push eax
mov eax, dword [ebx + 0x5c]
push eax
mov esi, dword [ebx + 0x68]
mov eax, dword [esi + 0x1a8]
push eax
mov eax, dword [eax]
call dword [eax + 0xc0]
mov edx, eax
mov eax, esi
call fcn.004e2d5c
mov eax, dword [ebx + 0x40]
push eax
lea eax, [ebx + 0x70]
mov ecx, 1
mov edx, dword [0x4e0618]
call fcn.00405ffc
add esp, 4
mov eax, dword [ebx + 0x30]
cmp eax, 0x1a
jge 0x4ea807
mov edx, dword [0x50ee10]
mov al, byte [edx + eax]
mov byte [ebx + 0x74], al
jmp 0x4ea818
cmp eax, 0x1007
jne 0x4ea814
mov byte [ebx + 0x74], 0x18
jmp 0x4ea818
mov byte [ebx + 0x74], 0
mov eax, dword [ebx + 0x40]
mov dword [ebx + 0x78], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ea862
mov eax, dword [ebp - 4]
call fcn.004039b0
ret
lea eax, [ebx + 0x5c]
push eax
push 0
push 0
mov eax, dword [ebx + 0x64]
push eax
mov esi, dword [ebx + 0x68]
mov eax, dword [esi + 0x1a8]
push eax
mov eax, dword [eax]
call dword [eax + 0xb4]
mov edx, eax
mov eax, esi
call fcn.004e2d5c
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4eb1a0
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 0x10], 2
jne 0x4eb1c5
cmp dword [esp + 4], 5
jb 0x4eb1c5
mov al, 1
jmp 0x4eb1c7
xor eax, eax
add esp, 0x94
ret
Function at 0x4fc2c4
Capabilities:
Find taskbar

Disassembly:
push ebx
push esi
push edi
mov ebx, 0x510e60
push 0
push 0x4fc380
call sub.user32.dll_FindWindowA
mov dword [ebx], eax
push 0
push 0x4fc380
call sub.user32.dll_FindWindowA
mov esi, eax
mov dword [ebx + 4], esi
push 0
push 0x4fc390
push 0
push esi
call sub.user32.dll_FindWindowExA
mov dword [ebx + 4], eax
push 0
push 0x4fc380
call sub.user32.dll_FindWindowA
mov esi, eax
mov dword [ebx + 8], esi
push 0
push 0x4fc398
push 0
push esi
call sub.user32.dll_FindWindowExA
mov dword [ebx + 8], eax
push 0
push 0x4fc380
call sub.user32.dll_FindWindowA
mov esi, eax
mov dword [ebx + 0xc], esi
push 0
push 0x4fc3a8
push 0
push esi
call sub.user32.dll_FindWindowExA
mov dword [ebx + 0xc], eax
push 0
push 0x4fc380
call sub.user32.dll_FindWindowA
mov esi, eax
mov dword [ebx + 0x10], esi
push 0
push 0x4fc3a8
push 0
push esi
call sub.user32.dll_FindWindowExA
mov edi, eax
mov dword [ebx + 0x10], edi
push 0
push 0x4fc3b8
push 0
push edi
call sub.user32.dll_FindWindowExA
mov dword [ebx + 0x10], eax
pop edi
pop esi
pop ebx
ret

Function at 0x4fc418
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
call fcn.004fc2c4
test bl, bl
je 0x4fc467
push 5
mov eax, dword [0x510e60]
push eax
call sub.user32.dll_ShowWindow
push 5
mov eax, dword [0x510e64]
push eax
call sub.user32.dll_ShowWindow
push 5
mov eax, dword [0x510e68]
push eax
call sub.user32.dll_ShowWindow
push 5
mov eax, dword [0x510e6c]
push eax
call sub.user32.dll_ShowWindow
push 5
mov eax, dword [0x510e70]
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret
push 0
mov eax, dword [0x510e60]
push eax
call sub.user32.dll_ShowWindow
push 0
mov eax, dword [0x510e64]
push eax
call sub.user32.dll_ShowWindow
push 0
mov eax, dword [0x510e68]
push eax
call sub.user32.dll_ShowWindow
push 0
mov eax, dword [0x510e6c]
push eax
call sub.user32.dll_ShowWindow
push 0
mov eax, dword [0x510e70]
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret

Function at 0x4fc614
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor ebx, ebx
push 0x20019
lea eax, [esp + 4]
push eax
mov eax, dword [0x50e664]
mov eax, dword [eax]
call eax
mov esi, eax
test esi, esi
je 0x4fc65c
push 0
push 0
push 0
push 0
push 0x4fc668
push esi
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
sete bl
push esi
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x4fe9a8
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
lea eax, [ebp - 4]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x4fea69
xor ecx, ecx
push ebp
push 0x4fea62
push dword fs:[ecx]
mov dword fs:[ecx], esp
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 3
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_GetTokenInformation
cmp dword [ebp - 8], 0
je 0x4fea4b
mov eax, dword [ebp - 8]
add eax, eax
call fcn.00402830
mov ebx, eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
add eax, eax
push eax
push ebx
push 3
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
je 0x4fea44
mov eax, dword [ebx]
dec eax
test eax, eax
jl 0x4fea30
inc eax
xor edx, edx
lea ecx, [edx + edx*2]
or dword [ebx + ecx*4 + 0xc], 2
inc edx
dec eax
jne 0x4fea24
push 0
push 0
mov eax, dword [ebp - 8]
push eax
push ebx
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
mov eax, ebx
call fcn.00402850
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fea69
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4fecf4
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, eax
mov dword [ebp - 8], 0x15
mov eax, ebx
call fcn.004048c4
mov eax, dword [ebp - 8]
call fcn.00402830
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4fed55
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x4fed3f
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00404abc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fed5c
mov eax, dword [ebp - 4]
call fcn.00402850
ret

Function at 0x4feee9
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x128]
xor edx, edx
mov eax, 2
call fcn.004be404
mov ebx, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, ebx
call fcn.004be424
jmp 0x4fef2f
xor edx, edx
push ebp
push 0x4fef13
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [edi + 8]
cmp esi, eax
jne 0x4fef09
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
push 0
push eax
call sub.kernel32.dll_TerminateProcess
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4fef35
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4fef26
mov edx, edi
mov eax, ebx
call fcn.004be444
test eax, eax
jne 0x4feed3
xor ebx, ebx
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4ff064
Capabilities:
Shutdown system

Disassembly:
mov eax, dword [0x50ef58]
cmp dword [eax], 1
jne 0x4ff077
push 0x20
push 0xe
call sub.user32.dll_ExitWindowsEx
mov eax, dword [0x50ef58]
cmp dword [eax], 2
jne 0x4ff08b
mov eax, 6
call fcn.004ff00c
ret
Function at 0x4ff08c
Capabilities:
Shutdown system

Disassembly:
mov eax, dword [0x50ef58]
cmp dword [eax], 1
jne 0x4ff09f
push 0x20
push 0xd
call sub.user32.dll_ExitWindowsEx
mov eax, dword [0x50ef58]
cmp dword [eax], 2
jne 0x4ff0b3
mov eax, 0xd
call fcn.004ff00c
ret

Function at 0x4ff170
Capabilities:
Hide graphical window

Disassembly:
push 0
push 0
push 0x4ff1a8
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
push 0
push 0
push 0x4ff1a8
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_EnableWindow
xor eax, eax
call fcn.004fc418
xor eax, eax
call fcn.004fc3c8
ret

Function at 0x4ff1d8
Capabilities:
Hide graphical window

Disassembly:
push 5
push 0
push 0x4ff210
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
push 0xffffffffffffffff
push 0
push 0x4ff210
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_EnableWindow
mov al, 1
call fcn.004fc418
mov al, 1
call fcn.004fc3c8
ret

Function at 0x4ff218
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d74
xor eax, eax
push ebp
push 0x4ff2c4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x22]
xor ecx, ecx
mov edx, 0x1e
call fcn.004031e0
xor eax, eax
mov dword [ebp - 0x22], eax
mov dword [ebp - 0x1e], 3
lea eax, [ebp - 0x28]
mov ecx, 0x4ff2dc
mov edx, dword [ebp - 4]
call fcn.00404bd0
mov eax, dword [ebp - 0x28]
call fcn.00404d84
mov dword [ebp - 0x1a], eax
mov word [ebp - 0x12], 0x454
xor eax, eax
push ebp
push 0x4ff29c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x22]
push eax
call sub.shell32.dll_SHFileOperationA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ff2a6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ff2cb
lea eax, [ebp - 0x28]
call fcn.004048c4
lea eax, [ebp - 4]
call fcn.004048c4
ret