joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a830
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.0041a56c
dec esi
jne 0x41a852
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret

Function at 0x41c520
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.004059b0
mov eax, dword [ebp - 8]
call fcn.004059b0
xor eax, eax
push ebp
push 0x41c685
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x41c660
push dword fs:[edx]
mov dword fs:[edx], esp
mov byte [ebp - 0x11], 1
xor eax, eax
mov dword [ebx], eax
lea eax, [ebp - 0x24]
xor ecx, ecx
mov edx, 0x10
call fcn.00403a68
lea eax, [ebp - 0x68]
xor ecx, ecx
mov edx, 0x44
call fcn.00403a68
mov dword [ebp - 0x68], 0x44
mov dword [ebp - 0x3c], 1
mov word [ebp - 0x38], si
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004098d0
push 0x41c6a4
push dword [ebp - 4]
push 0x41c6a4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004058c4
cmp dword [ebp - 8], 0
je 0x41c5e3
push dword [ebp - 0xc]
push 0x41c6b0
push dword [ebp - 8]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004058c4
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
push 0
push 0
push 0x30
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.004059c0
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x41c61b
mov eax, dword [ebp - 0x1c]
mov dword [ebx], eax
cmp byte [ebp - 0x11], 0
je 0x41c630
cmp dword [ebp - 0x24], 0xffffffff
je 0x41c630
mov eax, dword [ebp - 0x24]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x41c63e
push eax
call sub.kernel32.dll_CloseHandle_1
cmp byte [ebp - 0x11], 0
jne 0x41c656
mov eax, dword [ebp - 0x24]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41c66a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41c68c
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00405538
ret
Function at 0x41cbfc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.004059c0
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x41cc54
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x473b20]
mov dl, 1
mov eax, dword [0x41c804]
call fcn.0040d758
call fcn.00404e88
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0041c90c
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x41cd00
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x41cd70
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xff
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00405bf4
mov eax, ebx
call fcn.00405514
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
call fcn.00405a20
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x41cd5a
lea eax, [ebp - 4]
call fcn.00405a20
mov edx, ebx
call fcn.00409d18
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41cd77
lea eax, [ebp - 4]
call fcn.00405514
ret

Function at 0x41cd7c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x41cdec
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xff
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00405bf4
mov eax, ebx
call fcn.00405514
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
call fcn.00405a20
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x41cdd6
lea eax, [ebp - 4]
call fcn.00405a20
mov edx, ebx
call fcn.00409d18
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41cdf3
lea eax, [ebp - 4]
call fcn.00405514
ret

Function at 0x41cf50
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x104], edx
mov edi, eax
xor eax, eax
push ebp
push 0x41cfd0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00405514
lea eax, [ebp - 0xff]
push eax
push 0xfe
call sub.kernel32.dll_GetTempPathA
mov esi, eax
test esi, esi
jle 0x41cfb7
lea ebx, [ebp - 0xff]
lea eax, [ebp - 0x104]
movzx edx, byte [ebx]
call fcn.004056fc
mov edx, dword [ebp - 0x104]
mov eax, edi
call fcn.004057fc
inc ebx
dec esi
jne 0x41cf98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41cfd7
lea eax, [ebp - 0x104]
call fcn.00405514
ret
Function at 0x41d2dc
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059b0
xor eax, eax
push ebp
push 0x41d343
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
lea eax, [ebp - 0x103]
push eax
mov eax, dword [ebp - 4]
call fcn.004059c0
push eax
call sub.kernel32.dll_GetEnvironmentVariableA
mov eax, ebx
lea edx, [ebp - 0x103]
mov ecx, 0xff
call fcn.00405784
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41d34a
lea eax, [ebp - 4]
call fcn.00405514
ret

Function at 0x41e9b4
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push 0x105
lea eax, [esp + 4]
push eax
push 0x1f
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.00405784
add esp, 0x108
pop ebx
ret

Function at 0x41e9ec
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push 0x105
lea eax, [esp + 4]
push eax
push 0x1003
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.00405784
add esp, 0x108
pop ebx
ret

Function at 0x42042c
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x420559
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x478a53], 0
jne 0x420461
cmp byte [0x478a52], 0
jne 0x420461
cmp byte [0x478a51], 0
je 0x420495
lea eax, [ebp - 4]
mov edx, ebx
call fcn.004056fc
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00408b5c
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.004055ac
mov eax, dword [ebp - 4]
movzx ebx, byte [eax]
push 0
call sub.user32.dll_GetKeyboardLayout
push eax
push ebx
call sub.user32.dll_VkKeyScanExA
cmp byte [0x478a56], 0
jne 0x4204b0
cmp byte [0x478a55], 0
jne 0x4204b0
cmp byte [0x478a57], 0
je 0x4204e4
lea eax, [ebp - 4]
mov edx, ebx
call fcn.004056fc
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00408b5c
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.004055ac
mov eax, dword [ebp - 4]
movzx ebx, byte [eax]
push 0
call sub.user32.dll_GetKeyboardLayout
push eax
push ebx
call sub.user32.dll_VkKeyScanExA
push 0
call sub.user32.dll_GetKeyboardLayout
push eax
push ebx
call sub.user32.dll_VkKeyScanExA
movsx eax, ax
mov edx, eax
shr dx, 8
movzx edx, dx
mov ecx, edx
sub ecx, 1
je 0x42050a
sub ecx, 6
jne 0x420511
mov byte [0x478a54], 1
mov ecx, edx
sub ecx, 2
je 0x420520
add ecx, 0xfffffffc
sub ecx, 2
jae 0x420527
mov byte [0x478a53], 1
add edx, 0xfffffffa
sub edx, 2
jae 0x420536
mov byte [0x478a52], 1
movzx eax, al
call fcn.0042033c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x420560
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405538
ret
Function at 0x43ad18
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, eax
mov ebp, edx
xor ebx, ebx
xor edi, edi
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
test eax, eax
jle 0x43adb2
movzx edx, byte [esi + ebx]
shr edx, 2
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi], dl
movzx edx, byte [esi + ebx]
and dl, 3
movzx edx, dl
shl edx, 4
movzx ecx, byte [esi + ebx + 1]
shr ecx, 4
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
push edx
pop edx
mov byte [ebp + edi + 1], dl
movzx edx, byte [esi + ebx + 1]
and dl, 0xf
movzx edx, dl
add edx, edx
add edx, edx
movzx ecx, byte [esi + ebx + 2]
shr ecx, 6
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
push edx
pop edx
mov byte [ebp + edi + 2], dl
movzx edx, byte [esi + ebx + 2]
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi + 3], dl
add edi, 4
add ebx, 3
dec eax
jne 0x43ad37
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x43adc8
dec edx
je 0x43adfd
jmp 0x43ae4e
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi + 1], al
mov byte [ebp + edi + 2], 0x3d
mov byte [ebp + edi + 3], 0x3d
jmp 0x43ae4e
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx edx, byte [esi + ebx + 1]
shr edx, 4
add eax, edx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi + 1], al
movzx eax, byte [esi + ebx + 1]
and al, 0xf
movzx eax, al
add eax, eax
add eax, eax
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi + 2], al
mov byte [ebp + edi + 3], 0x3d
mov eax, dword [esp]
add eax, 2
mov ecx, 3
cdq
idiv ecx
add eax, eax
add eax, eax
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x43aec0
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov edi, eax
mov dword [esp + 8], edx
xor esi, esi
xor ebp, ebp
xor eax, eax
mov edx, dword [esp]
test edx, edx
jns 0x43aedf
add edx, 3
sar edx, 2
test edx, edx
jle 0x43afed
mov dword [esp + 0xc], edx
mov edx, 4
lea eax, [esp + 4]
movzx ecx, byte [edi + esi]
cmp ecx, 0x3d
jg 0x43af14
je 0x43af57
sub ecx, 0x2b
je 0x43af4d
sub ecx, 4
je 0x43af52
dec ecx
sub ecx, 0xa
jb 0x43af3f
jmp 0x43af5a
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x43af26
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x43af31
jmp 0x43af5a
movzx ecx, byte [edi + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x43af5a
movzx ecx, byte [edi + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x43af5a
movzx ecx, byte [edi + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x43af5a
mov byte [eax], 0x3e
jmp 0x43af5a
mov byte [eax], 0x3f
jmp 0x43af5a
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x43aef7
movzx eax, byte [esp + 4]
add eax, eax
add eax, eax
movzx edx, byte [esp + 5]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp], al
lea eax, [ebp + 1]
movzx edx, byte [esp + 6]
cmp dl, 0xff
je 0x43afab
cmp byte [esp + 7], 0xff
jne 0x43afab
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
lea eax, [ebp + 2]
inc ebp
jmp 0x43afe2
cmp dl, 0xff
je 0x43afe2
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
mov eax, dword [esp + 8]
movzx edx, byte [esp + 6]
shl edx, 6
or dl, byte [esp + 7]
mov byte [eax + ebp + 2], dl
lea eax, [ebp + 3]
add ebp, 2
inc ebp
dec dword [esp + 0xc]
jne 0x43aeee
add esp, 0x10
pop ebp
pop edi
pop esi
ret

Function at 0x43bcac
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jbe 0x43bccd
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
movzx ebx, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x43bcba
pop edi
pop esi
pop ebx
ret
Function at 0x44157c
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 8
add esp, 0xfffff004
push eax
dec eax
jne 0x441585
mov eax, dword [ebp - 4]
add esp, 0xfffffee8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x8014], edx
mov dword [ebp - 0x8018], edx
mov dword [ebp - 0x811c], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44170c
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4416dc
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x4416bb
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x44]
lea eax, [ebp - 8]
push eax
push 0
push 0
push 1
push 1
call sub.mpr.dll_WNetOpenEnumA
test eax, eax
jne 0x4416b1
mov dword [ebp - 0xc], 0x400
mov dword [ebp - 0x10], 0x8000
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x8010]
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.mpr.dll_WNetEnumResourceA
mov edi, eax
test edi, edi
jne 0x4416a9
mov esi, dword [ebp - 0xc]
dec esi
test esi, esi
jl 0x4416a9
inc esi
lea ebx, [ebp - 0x8008]
cmp dword [ebx], 3
jne 0x4416a3
cmp dword [ebx + 8], 0
je 0x4416a3
lea eax, [ebp - 0x8118]
mov edx, dword [ebx + 8]
call fcn.004040e0
lea edx, [ebp - 0x8118]
lea eax, [ebp - 0x8018]
call fcn.00405778
push dword [ebp - 0x8018]
push 0x441724
lea eax, [ebp - 0x811c]
mov edx, dword [ebx + 0xc]
call fcn.0040570c
push dword [ebp - 0x811c]
lea eax, [ebp - 0x8014]
mov edx, 3
call fcn.004058c4
mov edx, dword [ebp - 0x8014]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x38]
add ebx, 0x20
dec esi
jne 0x44163a
test edi, edi
je 0x4415ff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4416c5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4416e3
mov eax, dword [ebp - 8]
push eax
call sub.mpr.dll_WNetCloseEnum
ret
Function at 0x441728
Capabilities:
Connect network resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x441809
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4417e4
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x24]
xor ecx, ecx
mov edx, 0x20
call fcn.00403a68
mov dword [ebp - 0x20], 1
mov eax, ebx
call fcn.004059c0
mov dword [ebp - 0x14], eax
mov eax, esi
call fcn.004059c0
mov dword [ebp - 0x10], eax
push 1
mov eax, edi
call fcn.004059c0
push eax
mov eax, dword [ebp + 0xc]
call fcn.004059c0
push eax
lea eax, [ebp - 0x24]
push eax
call sub.mpr.dll_WNetAddConnection2A
mov ebx, eax
test ebx, ebx
je 0x4417d7
cmp byte [ebp + 8], 0
je 0x4417d7
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x2c]
call fcn.0040ce4c
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
mov edx, 0x441824
call fcn.00405848
mov eax, dword [ebp - 0x28]
call fcn.0043fdf4
mov dword [ebp - 4], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4417ee
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x441810
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.00405538
ret

Function at 0x442978
Capabilities:
Acquire debug privileges

Disassembly:
mov dl, 1
mov eax, 0x4429e4
call fcn.00442868
mov dl, 1
mov eax, 0x4429fc
call fcn.00442868
mov dl, 1
mov eax, 0x442a20
call fcn.00442868
mov dl, 1
mov eax, 0x442a40
call fcn.00442868
mov dl, 1
mov eax, 0x442a64
call fcn.00442868
mov dl, 1
mov eax, 0x442a8c
call fcn.00442868
mov dl, 1
mov eax, 0x442aac
call fcn.00442868
mov dl, 1
mov eax, 0x442ac8
call fcn.00442868
ret
Function at 0x442b34
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 9], cl
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059b0
xor eax, eax
push ebp
push 0x442cb3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
push 0x20
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0x20]
push eax
push 0x442cc8
mov eax, dword [ebp - 4]
call fcn.004059c0
mov edi, eax
push edi
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x18], 2
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
lea eax, [ebp - 0x24]
push eax
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
cmp byte [ebp - 9], 1
cmc
sbb eax, eax
push eax
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [ebp + 8]
push eax
push 0x442ce4
push edi
call sub.advapi32.dll_InitiateSystemShutdownA
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
test bl, bl
je 0x442bf6
lea eax, [ebp - 8]
mov edx, 0x442cf0
call fcn.004055ac
jmp 0x442c03
lea eax, [ebp - 8]
mov edx, 0x442d00
call fcn.004055ac
cmp byte [ebp - 9], 0
jne 0x442c30
push 0x442d10
push dword [ebp - 8]
push 0x442d2c
push dword [ebp - 4]
lea eax, [ebp - 0x28]
mov edx, 4
call fcn.004058c4
mov eax, dword [ebp - 0x28]
call fcn.0043f95c
jmp 0x442c55
push 0x442d38
push dword [ebp - 8]
push 0x442d2c
push dword [ebp - 4]
lea eax, [ebp - 0x2c]
mov edx, 4
call fcn.004058c4
mov eax, dword [ebp - 0x2c]
call fcn.0043f95c
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x18], 2
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
lea eax, [ebp - 0x24]
push eax
push 0
push esi
call sub.advapi32.dll_AdjustTokenPrivileges
cmp dword [ebp - 0x10], 0xffffffff
je 0x442c8b
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x442cba
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.00405538
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405538
ret

Function at 0x442f1c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004059c0
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x442f35
test al, 0x10
jne 0x442f39
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x447fe0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059b0
mov eax, dword [ebp - 8]
call fcn.004059b0
mov eax, dword [ebp - 0xc]
call fcn.004059b0
mov eax, dword [ebp + 0x5c]
call fcn.004059b0
mov eax, dword [ebp + 0x4c]
call fcn.004059b0
mov eax, dword [ebp + 0x28]
call fcn.004059b0
mov eax, dword [ebp + 0x24]
call fcn.004059b0
mov eax, dword [ebp + 0x20]
call fcn.004059b0
mov eax, dword [ebp + 0x18]
call fcn.004059b0
mov eax, dword [ebp + 8]
call fcn.004059b0
xor eax, eax
push ebp
push 0x448192
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x441b18]
mov eax, 0x58
call fcn.0040657c
mov ebx, eax
mov eax, dword [ebp + 0x60]
mov dword [ebx], eax
mov eax, dword [ebp + 0x64]
mov dword [ebx + 4], eax
lea eax, [ebx + 0x10]
mov edx, dword [ebp - 4]
call fcn.00405568
mov eax, dword [ebp + 0x2c]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp + 0x30]
mov dword [ebx + 0x1c], eax
lea eax, [ebx + 0xc]
mov edx, dword [ebp + 0x4c]
call fcn.00405568
lea eax, [ebx + 0x20]
mov edx, dword [ebp - 0xc]
call fcn.00405568
lea eax, [ebx + 0x24]
mov edx, dword [ebp + 0x5c]
call fcn.00405568
movzx eax, byte [ebp + 0x58]
mov byte [ebx + 0x28], al
mov eax, dword [ebp + 0x50]
mov dword [ebx + 0x30], eax
mov eax, dword [ebp + 0x54]
mov dword [ebx + 0x34], eax
movzx eax, byte [ebp + 0x48]
mov byte [ebx + 0x3a], al
movzx eax, byte [ebp + 0x44]
mov byte [ebx + 0x3b], al
lea eax, [ebx + 0x3c]
mov edx, dword [ebp + 0x28]
call fcn.00405568
movzx eax, byte [ebp + 0x40]
mov byte [ebx + 0x44], al
movzx eax, byte [ebp + 0x3c]
mov byte [ebx + 0x39], al
lea eax, [ebx + 0x40]
mov edx, dword [ebp + 0x24]
call fcn.00405568
lea eax, [ebx + 0x14]
mov edx, dword [ebp - 8]
call fcn.00405568
lea eax, [ebx + 8]
mov edx, dword [ebp + 0x20]
call fcn.00405568
movzx eax, byte [ebp + 0x38]
mov byte [ebx + 0x45], al
movzx eax, byte [ebp + 0x34]
mov byte [ebx + 0x46], al
lea eax, [ebx + 0x48]
mov edx, dword [ebp + 0x18]
call fcn.00405568
movzx eax, byte [ebp + 0x14]
mov byte [ebx + 0x4c], al
movzx eax, byte [ebp + 0x1c]
mov byte [ebx + 0x4e], al
movzx eax, byte [ebp + 0x10]
mov byte [ebx + 0x4f], al
movzx eax, byte [ebp + 0xc]
mov byte [ebx + 0x50], al
lea eax, [ebx + 0x54]
mov edx, dword [ebp + 8]
call fcn.00405568
mov edx, ebx
mov eax, dword [0x478cd4]
call fcn.004145e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x448199
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405538
lea eax, [ebp + 8]
call fcn.00405514
lea eax, [ebp + 0x18]
call fcn.00405514
lea eax, [ebp + 0x20]
mov edx, 3
call fcn.00405538
lea eax, [ebp + 0x4c]
call fcn.00405514
lea eax, [ebp + 0x5c]
call fcn.00405514
ret
Function at 0x4482a4
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059b0
xor eax, eax
push ebp
push 0x44844b
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
push ebp
push 0x44842e
push dword fs:[ecx]
mov dword fs:[ecx], esp
xor ecx, ecx
push ebp
push 0x4483f0
push dword fs:[ecx]
mov dword fs:[ecx], esp
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov esi, 1
mov ebx, 0x478c90
cmp dword [ebx], 0
jne 0x44831d
mov edx, dword [0x441c64]
mov eax, 0xc
call fcn.0040657c
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebx], eax
mov dword [ebp - 0x10], esi
jmp 0x448326
inc esi
add ebx, 4
cmp esi, 0xb
jne 0x4482fb
cmp dword [ebp - 0x10], 0
jne 0x44833e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.00404f34
jmp 0x448435
mov eax, dword [ebp - 0x10]
mov eax, dword [eax*4 + 0x478c8c]
xor edx, edx
mov dword [eax], edx
xor edx, edx
mov dword [eax + 4], edx
mov eax, dword [ebp - 4]
cmp byte [eax], 0x2a
jne 0x448378
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x448365
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 4]
push eax
mov ecx, ebx
mov edx, 2
mov eax, dword [ebp - 4]
call fcn.00405a28
mov edx, dword [ebp - 4]
mov eax, edx
test eax, eax
je 0x448386
sub eax, 4
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
cmp byte [ecx + eax - 1], 0x2a
jne 0x4483af
mov ebx, edx
test ebx, ebx
je 0x44839b
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 4]
push eax
mov ecx, ebx
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00405a28
mov eax, dword [ebp - 0x10]
mov eax, dword [eax*4 + 0x478c8c]
add eax, 8
mov edx, dword [ebp - 4]
call fcn.00405568
mov eax, dword [ebp - 0x10]
push eax
push 0x4481a0
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 0x10]
mov eax, dword [eax*4 + 0x478c8c]
mov eax, dword [eax + 4]
test eax, eax
je 0x4483e6
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4483fa
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x448435
cmp dword [ebp - 0xc], 0
je 0x44841b
mov edx, dword [0x441c64]
mov eax, dword [ebp - 0xc]
call fcn.00406590
cmp dword [ebp - 0x10], 0
je 0x44842d
mov eax, dword [ebp - 0x10]
xor edx, edx
mov dword [eax*4 + 0x478c8c], edx
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x448452
lea eax, [ebp - 4]
call fcn.00405514
ret