joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bae90
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x4bae98
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4bb08a
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x4bb0a0
mov eax, esi
call fcn.004b8c20
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.004045d0
lea ecx, [ebp - 0x10]
mov edx, 0x4bb0b4
mov eax, esi
call fcn.004b8c20
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.004045d0
lea ecx, [ebp - 0x14]
mov edx, 0x4bb0cc
mov eax, esi
call fcn.004b8c20
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.004045d0
lea ecx, [ebp - 0x18]
mov edx, 0x4bb0e8
mov eax, esi
call fcn.004b8c20
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.004045d0
lea ecx, [ebp - 0x1c]
mov edx, 0x4bb104
mov eax, esi
call fcn.004b8c20
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.004045d0
lea ecx, [ebp - 0x24]
mov edx, 0x4bb11c
mov eax, esi
call fcn.004b8c20
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408fd4
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.00409434
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x4bb134
mov eax, esi
call fcn.004b8c20
mov eax, dword [ebp - 0x28]
call fcn.004b7d38
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x4bb144
mov eax, esi
call fcn.004b8c20
mov eax, dword [ebp - 0x2c]
call fcn.004b7d38
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x4bb15c
mov eax, esi
call fcn.004b8c20
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.00409434
inc eax
je 0x4bb02d
lea ecx, [ebp - 0x34]
mov edx, 0x4bb15c
mov eax, esi
call fcn.004b8c20
mov eax, dword [ebp - 0x34]
call fcn.004093f8
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040acac
fstp qword [ebp - 0x3c]
wait
call fcn.0040b070
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x4bb048
lea ecx, [ebp - 0x40]
mov edx, 0x4bb15c
mov eax, esi
call fcn.004b8c20
mov eax, dword [ebp - 0x40]
call fcn.004b7d38
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x4bb16c
mov eax, esi
call fcn.004b8c20
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.004045d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bb091
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.004045a0
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.004045a0
ret
Function at 0x4c7254
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x4c72ae
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.004c7244
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.004b69a4
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.004b65a4
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c72b5
lea eax, [ebp - 4]
call fcn.0040457c
ret

Function at 0x4ca764
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a1c
xor eax, eax
push ebp
push 0x4ca82d
push dword fs:[eax]
mov dword fs:[eax], esp
mov cl, 1
mov dl, 1
mov eax, dword [0x4ca5f8]
call fcn.0041f210
mov ebx, eax
mov byte [ebx + 0xf], 1
lea eax, [ebx + 0x38]
mov edx, dword [ebp - 4]
call fcn.004045d0
xor eax, eax
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x40], esi
call sub.kernel32.dll_GetTickCount
mov edi, eax
mov byte [ebx + 0x3c], 1
mov byte [ebx + 0x3d], 0
mov eax, ebx
call fcn.0041f55c
jmp 0x4ca7f4
call sub.kernel32.dll_GetTickCount
sub eax, edi
lea edx, [esi + 0x7d0]
cmp eax, edx
ja 0x4ca7fa
cmp byte [ebp + 8], 0
jne 0x4ca7ed
mov eax, dword [0x534724]
mov eax, dword [eax]
call fcn.00447fa0
push 1
call sub.kernel32.dll_Sleep
cmp byte [ebx + 0x3c], 1
je 0x4ca7ca
cmp byte [ebx + 0x3c], 2
sete byte [ebp - 9]
cmp byte [ebp - 9], 0
je 0x4ca813
mov eax, dword [ebp - 8]
mov edx, dword [ebx + 0x34]
call fcn.004045d0
mov byte [ebx + 0x3d], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ca834
lea eax, [ebp - 4]
call fcn.0040457c
ret
Function at 0x4cca44
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffeb8
mov ebx, ecx
mov ebp, edx
mov esi, eax
xor edi, edi
push edi
lea eax, [esp + 8]
push eax
mov ecx, 0x4ccc68
mov edx, 0x4ccc6c
mov eax, esi
call fcn.004cc73c
test al, al
jne 0x4cca78
xor eax, eax
jmp 0x4ccc5c
lea eax, [esp + 0xac]
xor ecx, ecx
mov edx, 0x9c
call fcn.00407b64
mov word [esp + 0xd0], 0x9c
mov word [esp + 0xd2], 0
lea eax, [esp + 0xac]
push eax
mov eax, dword [0x531de8]
push eax
push 0
call sub.user32.dll_EnumDisplaySettingsA
mov dword [esp + 0xd4], 0x1c0000
test ebx, ebx
je 0x4ccafc
or dword [esp + 0xd4], 0x20
mov eax, dword [ebx]
lea edx, [esp + 0xd8]
mov dword [edx], eax
mov eax, dword [ebx + 4]
lea edx, [esp + 0xd8]
mov dword [edx + 4], eax
mov eax, dword [ebx + 8]
sub eax, dword [ebx]
mov dword [esp + 0x118], eax
mov eax, dword [ebx + 0xc]
sub eax, dword [ebx + 4]
mov dword [esp + 0x11c], eax
lea eax, [esp + 0xac]
xor ecx, ecx
mov edx, 0x20
call fcn.0040305c
mov edx, 0x4ccc7c
mov eax, esi
call fcn.004cc958
mov ebx, eax
test ebx, ebx
jne 0x4ccb28
xor eax, eax
jmp 0x4ccc5c
push 0x4ccc88
push ebx
call sub.advapi32.dll_RegDeleteValueA
push 0x4ccc9c
push ebx
call sub.advapi32.dll_RegDeleteValueA
test ebp, ebp
je 0x4ccb4b
mov dword [esp], 3
jmp 0x4ccb50
xor eax, eax
mov dword [esp], eax
push 4
lea eax, [esp + 4]
push eax
push 4
push 0
push 0x4cccac
push ebx
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x4ccb71
xor eax, eax
jmp 0x4ccc5c
mov dword [esp], 1
push 4
lea eax, [esp + 4]
push eax
push 4
push 0
push 0x4cccc0
push ebx
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x4ccb99
xor eax, eax
jmp 0x4ccc5c
mov dword [esp], 1
push 4
lea eax, [esp + 4]
push eax
push 4
push 0
push 0x4cccdc
push ebx
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x4ccbc1
xor eax, eax
jmp 0x4ccc5c
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_GetThreadDesktop
mov ebp, eax
xor edi, edi
test ebp, ebp
je 0x4ccbee
push 0x2000000
push 0
push 0
call sub.user32.dll_OpenInputDesktop
mov edi, eax
test edi, edi
je 0x4ccbee
push edi
call sub.user32.dll_SetThreadDesktop
cmp dword [esp + 0x114], 0x18
jne 0x4ccc03
mov dword [esp + 0x114], 0x20
push 0
push 1
push 0
lea eax, [esp + 0xb8]
push eax
lea eax, [esp + 0x18]
push eax
call sub.user32.dll_ChangeDisplaySettingsExA
push esi
push edi
lea edi, [esi + 4]
lea esi, [esp + 0xb4]
mov ecx, 0x27
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [esi + 0xa0]
lea edx, [esp + 8]
mov ecx, 0x20
call fcn.004047e4
push ebp
call sub.user32.dll_SetThreadDesktop
test edi, edi
je 0x4ccc54
push edi
call sub.user32.dll_CloseDesktop
push ebx
call sub.advapi32.dll_RegCloseKey_1
mov al, 1
add esp, 0x148
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4cccf0
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffeb8
mov ebx, eax
lea eax, [ebx + 0xa0]
call fcn.0040457c
xor esi, esi
push esi
lea eax, [esp + 8]
push eax
mov ecx, 0x4cce38
mov edx, 0x4cce3c
mov eax, ebx
call fcn.004cc73c
test al, al
je 0x4cce2d
lea eax, [esp + 0xac]
xor ecx, ecx
mov edx, 0x9c
call fcn.00407b64
mov word [esp + 0xd0], 0x9c
mov word [esp + 0xd2], 0
lea eax, [esp + 0xac]
push eax
mov eax, dword [0x531de8]
push eax
push 0
call sub.user32.dll_EnumDisplaySettingsA
mov dword [esp + 0xd4], 0x1c0000
mov byte [esp + 0xac], 0
mov edx, 0x4cce4c
mov eax, ebx
call fcn.004cc958
mov ebx, eax
test ebx, ebx
je 0x4cce2d
xor eax, eax
mov dword [esp], eax
push 4
lea eax, [esp + 4]
push eax
push 4
push 0
push 0x4cce58
push ebx
call sub.advapi32.dll_RegSetValueExA
push 0x4cce6c
push ebx
call sub.advapi32.dll_RegDeleteValueA
push 0x4cce80
push ebx
call sub.advapi32.dll_RegDeleteValueA
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_GetThreadDesktop
mov edi, eax
xor esi, esi
test edi, edi
je 0x4ccdea
push 0x2000000
push 0
push 0
call sub.user32.dll_OpenInputDesktop
mov esi, eax
test esi, esi
je 0x4ccdea
push esi
call sub.user32.dll_SetThreadDesktop
cmp dword [esp + 0x114], 0x18
jne 0x4ccdff
mov dword [esp + 0x114], 0x20
push 0
push 1
push 0
lea eax, [esp + 0xb8]
push eax
lea eax, [esp + 0x18]
push eax
call sub.user32.dll_ChangeDisplaySettingsExA
push edi
call sub.user32.dll_SetThreadDesktop
test esi, esi
je 0x4cce27
push esi
call sub.user32.dll_CloseDesktop
push ebx
call sub.advapi32.dll_RegCloseKey_1
add esp, 0x148
pop edi
pop esi
pop ebx
ret
Function at 0x4cd0e0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
xor eax, eax
push ebp
push 0x4cd307
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0x531e08], eax
xor eax, eax
mov dword [0x53a0b4], eax
xor eax, eax
mov dword [0x53a0b8], eax
xor eax, eax
mov dword [0x53a0bc], eax
xor eax, eax
mov dword [0x53a0c0], eax
xor eax, eax
mov dword [0x53a0b0], eax
xor eax, eax
mov dword [0x53a0c4], eax
xor eax, eax
mov dword [0x53a0c8], eax
xor eax, eax
mov dword [0x53a0cc], eax
xor eax, eax
mov dword [0x53a0d0], eax
cmp dword [0x531e0c], 0
je 0x4cd2e9
push 0x4cd314
mov eax, dword [0x531e0c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x53a0b4], eax
push 0x4cd31c
mov eax, dword [0x531e0c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x53a0b8], eax
push 0x4cd324
mov eax, dword [0x531e0c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x53a0bc], eax
push 0x4cd32c
mov eax, dword [0x531e0c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x53a0c0], eax
push 0x4cd334
mov eax, dword [0x531e0c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x53a0b0], eax
push 0x4cd33c
mov eax, dword [0x531e0c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x53a0c4], eax
push 0x4cd34c
mov eax, dword [0x531e0c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x53a0c8], eax
push 0x4cd358
mov eax, dword [0x531e0c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x53a0cc], eax
push 0x4cd368
mov eax, dword [0x531e0c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x53a0d0], eax
cmp dword [0x53a0b4], 0
je 0x4cd2e9
cmp dword [0x53a0b8], 0
je 0x4cd2e9
cmp dword [0x53a0bc], 0
je 0x4cd2e9
cmp dword [0x53a0c0], 0
je 0x4cd2e9
cmp dword [0x53a0b0], 0
je 0x4cd2e9
cmp dword [0x531e10], 0xffffffff
jne 0x4cd285
push 0
push 1
mov edx, dword [0x534848]
mov edx, dword [edx]
lea eax, [ebp - 8]
mov ecx, 0x4cd384
call fcn.00404880
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.00404e38
mov eax, dword [ebp - 4]
mov edx, 0x4cd398
call fcn.0046d0b8
mov dword [0x531e10], eax
cmp dword [0x531e10], 2
jge 0x4cd29d
push 0x58
push 0x6f401
call dword [0x53a0c0]
jmp 0x4cd2b1
cmp dword [0x531e10], 2
jne 0x4cd2b1
push 0x51a7b0e
call dword [0x53a0b8]
mov dword [0x531e08], 1
cmp dword [0x53a0c4], 0
je 0x4cd2e9
cmp dword [0x53a0c8], 0
je 0x4cd2e9
cmp dword [0x53a0cc], 0
je 0x4cd2e9
cmp dword [0x53a0d0], 0
je 0x4cd2e9
mov dword [0x531e08], 2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cd30e
lea eax, [ebp - 8]
call fcn.0040457c
lea eax, [ebp - 4]
call fcn.00404c98
ret
Function at 0x4cf0cc
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov ebx, eax
mov byte [ebp - 1], 0
push 0x4cf194
push 0xffffffffffffffff
push 4
call sub.kernel32.dll_OpenFileMappingA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4cf18a
xor eax, eax
push ebp
push 0x4cf183
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xa7e
push 0
push 0
push 4
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4cf16c
xor eax, eax
push ebp
push 0x4cf165
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
xor ecx, ecx
mov edx, 0xa7e
call fcn.0040305c
mov edx, ebx
mov eax, dword [ebp - 0xc]
mov ecx, 0xa7e
call fcn.00402974
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cf16c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_UnmapViewOfFile
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cf18a
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
mov al, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4d23dc
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a1c
xor eax, eax
push ebp
push 0x4d251a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.0040457c
xor edi, edi
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push edi
push 0
push 0x1e
push 0
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
cmp eax, 0x6f
jne 0x4d2504
mov eax, dword [ebp - 0x10]
call fcn.00408d00
mov edi, eax
mov esi, edi
lea eax, [ebp - 0x10]
push eax
push edi
push 0
push 0x1e
push 0
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
test eax, eax
jne 0x4d24fd
test esi, esi
je 0x4d24fd
mov ebx, dword [esi + 0x10]
cmp dword [ebp - 8], 2
jne 0x4d24a4
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 4]
call fcn.00404a84
push eax
call sub.Ntdll.dll_RtlIpv4StringToAddressA
test ebx, ebx
je 0x4d24f2
mov eax, dword [ebx + 0xc]
cmp word [eax], 2
jne 0x4d249b
mov eax, dword [eax + 4]
cmp eax, dword [ebp - 0x2c]
jne 0x4d249b
mov edx, dword [ebp - 0xc]
lea eax, [esi + 0x2c]
call fcn.004efadc
jmp 0x4d24fd
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4d247d
jmp 0x4d24f2
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
call fcn.00404a84
push eax
call sub.Ntdll.dll_RtlIpv6StringToAddressA
test ebx, ebx
je 0x4d24f2
mov eax, dword [ebx + 0xc]
cmp word [eax], 0x17
jne 0x4d24eb
lea edx, [ebp - 0x28]
mov eax, dword [ebx + 0xc]
add eax, 8
mov ecx, 0x10
call fcn.004efe1c
test eax, eax
jne 0x4d24eb
mov edx, dword [ebp - 0xc]
lea eax, [esi + 0x2c]
call fcn.004efadc
jmp 0x4d24fd
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4d24be
mov esi, dword [esi + 8]
test esi, esi
jne 0x4d2458
mov eax, edi
call fcn.004027dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d2521
lea eax, [ebp - 4]
call fcn.0040457c
ret
Function at 0x4d28cc
Capabilities:
Create process on windows
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0xc], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4d2a30
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x532ef0], 0x7d9
cmp si, 2
jne 0x4d2926
lea eax, [ebp - 0x20]
mov edx, dword [0x53451c]
mov edx, dword [edx]
call fcn.00404e38
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0xc]
mov edx, 0x4d2a48
call fcn.0046d3ec
jmp 0x4d2952
cmp si, 8
je 0x4d2932
cmp si, 1
jne 0x4d2952
lea eax, [ebp - 0x24]
mov edx, dword [0x53451c]
mov edx, dword [edx]
call fcn.00404e38
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0xc]
mov edx, 0x4d2a58
call fcn.0046d3ec
cmp dword [ebp - 0xc], 0
je 0x4d296d
push 1
lea eax, [ebp - 0xc]
call fcn.00404a84
push eax
call sub.kernel32.dll_WinExec
jmp 0x4d2a05
test si, 2
jne 0x4d2982
test si, 1
jne 0x4d2982
test si, 8
je 0x4d29eb
lea eax, [ebp - 4]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x4d29eb
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x28]
mov eax, 0x29
call fcn.004a94e4
mov eax, dword [ebp - 0x28]
call fcn.00404a2c
push eax
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle_1
test bl, bl
je 0x4d29f3
or si, 4
push 0
movzx eax, si
push eax
call sub.user32.dll_ExitWindowsEx
xor eax, eax
mov dword [0x532ef0], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d2a37
lea eax, [ebp - 0x28]
call fcn.0040457c
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00404cb0
lea eax, [ebp - 0xc]
call fcn.0040457c
ret
Function at 0x4d67d8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x4d6919
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x53b52c], 0
je 0x4d68c9
mov dl, 1
mov eax, dword [0x414af0]
call fcn.00403740
mov edi, eax
mov edx, dword [0x53b520]
mov eax, 0x4d6930
call fcn.00404b70
test eax, eax
jle 0x4d6851
push 0x4d693c
push dword [0x53b520]
push 0x4d6948
push dword [0x53b524]
lea eax, [ebp - 8]
mov edx, 4
call fcn.004048f4
mov edx, dword [ebp - 8]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4d687e
push 0x4d6954
push dword [0x53b520]
push 0x4d6930
push dword [0x53b524]
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.004048f4
mov edx, dword [ebp - 0xc]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [0x534848]
mov edx, dword [edx]
lea eax, [ebp - 4]
mov ecx, 0x4d6964
call fcn.00404880
mov edx, dword [ebp - 4]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x74]
push 1
mov eax, dword [0x53b528]
call fcn.00404a2c
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00404a2c
push eax
push 0x4d6970
mov eax, esi
call fcn.0045dd60
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4d68fe
push 1
mov eax, dword [0x53b528]
call fcn.00404a2c
push eax
mov eax, dword [0x53b524]
call fcn.00404a2c
push eax
mov eax, dword [0x53b520]
call fcn.00404a2c
push eax
push 0x4d6970
mov eax, esi
call fcn.0045dd60
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d6920
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004045a0
ret
Function at 0x4dda80
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4ddb97
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x532ef0], 0x808
lea edx, [ebp - 8]
mov eax, 0xfb
call fcn.004a94e4
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0xc]
mov edx, 0x53b19c
mov ecx, 0x105
call fcn.004047e4
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
pop ecx
call fcn.00404880
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.00404e38
mov eax, dword [ebp - 0x10]
mov dx, 0xffff
call fcn.0046da4c
mov ebx, eax
test ebx, ebx
je 0x4ddb60
mov ecx, dword [esi + 4]
sub ecx, 0x20
lea edx, [esi + 0x20]
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, ebx
call fcn.00403770
mov eax, 0xc8
call fcn.004d25dc
push 1
push 0x4ddba4
push 0x4ddbb0
push dword [ebp - 4]
push 0x4ddbc0
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004048f4
mov eax, dword [ebp - 0x14]
call fcn.00404a2c
push eax
lea edx, [ebp - 0x18]
mov eax, 0x62
call fcn.004a94e4
mov eax, dword [ebp - 0x18]
call fcn.00404a2c
push eax
push 0x4ddbc4
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
mov dword [0x532ef0], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ddb9e
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004045a0
lea eax, [ebp - 0x10]
call fcn.00404c98
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004045a0
ret

Function at 0x4dfa5c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4dfbbe
push dword fs:[eax]
mov dword fs:[eax], esp
cmp word [0x53b2ac], 0
jbe 0x4dfad1
mov ax, word [0x532f30]
cmp ax, word [0x53b2ac]
jb 0x4dfad1
mov eax, dword [0x532ef8]
mov dword [0x532f20], eax
mov eax, dword [0x532efc]
mov dword [0x532f24], eax
mov word [0x532f30], 0
mov eax, dword [0x53a15c]
call fcn.0049dc18
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.004e395c
mov dl, 1
mov ax, 2
call fcn.004d28cc
jmp 0x4dfba8
cmp word [0x53b2ae], 0
jbe 0x4dfb3f
mov ax, word [0x532f30]
cmp ax, word [0x53b2ae]
jb 0x4dfb3f
mov eax, dword [0x532ef8]
mov dword [0x532f20], eax
mov eax, dword [0x532efc]
mov dword [0x532f24], eax
mov word [0x532f30], 0
cmp dword [0x53b2b0], 0
je 0x4dfb3f
lea eax, [ebp - 4]
mov ecx, dword [0x53b2b0]
mov edx, 0x4dfbd4
call fcn.00404880
lea eax, [ebp - 4]
call fcn.004d37b0
push 0
lea eax, [ebp - 4]
call fcn.00404a84
push eax
call sub.kernel32.dll_WinExec
cmp word [0x53b2b4], 0
jbe 0x4dfba8
mov ax, word [0x532f30]
cmp ax, word [0x53b2b4]
jb 0x4dfba8
mov eax, dword [0x532ef8]
mov dword [0x532f20], eax
mov eax, dword [0x532efc]
mov dword [0x532f24], eax
mov word [0x532f30], 0
cmp dword [0x53b2b8], 0
je 0x4dfba8
lea eax, [ebp - 4]
mov edx, dword [0x53b2b8]
call fcn.00404614
lea eax, [ebp - 4]
call fcn.004d37b0
push 0
lea eax, [ebp - 4]
call fcn.00404a84
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dfbc5
lea eax, [ebp - 4]
call fcn.0040457c
ret
Function at 0x4e2d00
Capabilities:
Change the wallpaper

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4e2e23
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x532ef0], 0x821
mov dl, 1
mov eax, dword [0x4221e0]
call fcn.0042881c
mov ebx, eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
mov edx, eax
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
mov edx, eax
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x34]
push esi
mov eax, ebx
call fcn.00428de4
xor ecx, ecx
xor edx, edx
call fcn.00423c10
lea edx, [ebp - 8]
mov eax, 0x105
call fcn.004a94e4
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, dword [0x53b2a4]
call fcn.00404880
mov edx, dword [ebp - 4]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, ebx
call fcn.00403770
lea edx, [ebp - 0xc]
mov eax, 0x106
call fcn.004a94e4
mov eax, dword [ebp - 0xc]
push eax
lea edx, [ebp - 0x10]
mov eax, 0xb0
call fcn.004a94e4
mov eax, dword [ebp - 0x10]
mov ecx, 0x4e2e38
pop edx
call fcn.0046c0c0
lea edx, [ebp - 0x14]
mov eax, 0x107
call fcn.004a94e4
mov eax, dword [ebp - 0x14]
push eax
lea edx, [ebp - 0x18]
mov eax, 0xb0
call fcn.004a94e4
mov eax, dword [ebp - 0x18]
mov ecx, 0x4e2e44
pop edx
call fcn.0046c0c0
push 3
lea eax, [ebp - 4]
call fcn.00404a84
push eax
push 0
push 0x14
call sub.user32.dll_SystemParametersInfoA
xor eax, eax
mov dword [0x532ef0], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e2e2a
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004045a0
ret