joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4179bc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x4179f5
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.00406bc4
jmp 0x4179fe
mov eax, ebx
mov edx, esi
call fcn.00406a88
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x417a08
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x417a2a
movzx eax, word [esp]
jmp 0x417a2c
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4181bc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x4182e1
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.00417fcc
mov esi, eax
mov eax, dword [0x54d10c]
cmp byte [eax], 0
je 0x418289
mov eax, dword [0x54cc54]
call fcn.00404724
call fcn.00404350
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x418194]
call fcn.004082a0
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x4182fc
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x4182c5
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x54cbac]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x550c3c]
call fcn.00408394
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4182e8
lea eax, [ebp - 4]
mov edx, dword [0x418194]
call fcn.004082ac
ret
Function at 0x45d150
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x45d30d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x30], 0
jne 0x45d2e9
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x38], 0
je 0x45d2e9
mov eax, dword [ebp - 0xc]
add eax, 0x2c
push eax
mov eax, dword [ebp - 0xc]
add eax, 0x28
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x38]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax + 0x28]
add ebx, ebx
add ebx, ebx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
imul ebx
push eax
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x45d11c]
call fcn.004082a0
add esp, 4
lea eax, [ebp - 4]
call fcn.0040970c
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x38]
push eax
mov eax, dword [0x54cc5c]
push eax
call fcn.00448b48
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 8]
call fcn.004080d8
push eax
push ebx
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x1c]
lea eax, [ebp - 0x38]
xor ecx, ecx
mov edx, 0x2c
call fcn.00404814
mov dword [ebp - 0x38], 0x2c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
neg eax
mov dword [ebp - 0x30], eax
mov word [ebp - 0x2c], 1
mov word [ebp - 0x2a], 0x20
mov dl, 1
mov eax, dword [0x45051c]
call fcn.00459b44
mov ebx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x30], ebx
xor ecx, ecx
push ebp
push 0x45d2c7
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov eax, ebx
mov dl, 7
call fcn.0045b758
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x2c]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x28]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax]
call dword [ebx + 0x6c]
push 0
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
push eax
push 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
mov edx, dword [eax]
call dword [edx + 0x70]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
call fcn.0045a464
call fcn.00454bcc
push eax
call sub.gdi32.dll_SetDIBits
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
mov dl, 1
call fcn.0045a768
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45d2e9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45d314
lea eax, [ebp - 8]
mov edx, dword [0x45d11c]
call fcn.004082ac
lea eax, [ebp - 4]
call fcn.0040970c
ret
Function at 0x4bb7dc
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x4bb7ee
add esp, 0xfffffff0
call fcn.00405384
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00440c7c
mov eax, dword [0x54cbc0]
mov dword [eax + 4], ebx
mov dword [eax], 0x4bbc38
mov eax, dword [0x54cbd0]
mov dword [eax + 4], ebx
mov dword [eax], 0x4bbc44
mov eax, ebx
call fcn.004bbc50
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x40], eax
mov dl, 1
mov eax, dword [0x429bc8]
call fcn.00404e20
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x429bc8]
call fcn.00404e20
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x429bc8]
call fcn.00404e20
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x429bc8]
call fcn.00404e20
mov dword [ebx + 0x5c], eax
mov dl, 1
mov eax, dword [0x429bc8]
call fcn.00404e20
mov dword [ebx + 0x78], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x44], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x5c]
push eax
mov eax, 0x4b6584
push eax
push 0
push 0
mov eax, dword [0x54cefc]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x44c9b0]
call fcn.00452c84
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x44c9b0]
call fcn.00452c84
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x44c9b0]
call fcn.00452c84
mov dword [ebx + 0x7c], eax
mov dl, 1
mov eax, dword [0x44c9b0]
call fcn.00452c84
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x44c9b0]
call fcn.00452c84
mov dword [ebx + 0x8c], eax
mov eax, ebx
call fcn.004bc1a8
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4bc018
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4bc018
mov eax, dword [ebx + 0x7c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4bc018
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4bc018
mov eax, dword [ebx + 0x8c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4bc018
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4bb969
call fcn.004053dc
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4bce5c
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x4bce73
add esp, 0xfffffff0
call fcn.00405384
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00440c7c
mov eax, dword [0x54c9c4]
cmp byte [eax], 0
jne 0x4bcea0
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x17c], al
mov eax, dword [0x54cec0]
cmp word [eax + 2], 0
jne 0x4bceba
mov eax, dword [0x54cec0]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004bef54
mov eax, dword [0x54d098]
cmp word [eax + 2], 0
jne 0x4bced4
mov eax, dword [0x54d098]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004bf164
mov byte [ebx + 0x35], 0
mov dl, 1
mov eax, dword [0x44c9b0]
call fcn.00452c84
mov esi, eax
mov dword [ebx + 0x3c], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x4bf714
mov dl, 1
mov eax, dword [0x429bc8]
call fcn.00404e20
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x429bc8]
call fcn.00404e20
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x450e48]
call fcn.0045c0f4
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x4bd0b4
mov eax, dword [0x54ccb8]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.0045c588
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x4bf9fc
mov dl, 1
mov eax, dword [0x429bc8]
call fcn.00404e20
mov dword [ebx + 0x98], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x54ccb8]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00414028
test eax, eax
je 0x4bcfe5
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00413d9c
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.0041400c
test eax, eax
je 0x4bcffd
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW_1
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00406c98
push ebx
push 0x4be924
call fcn.004b2b6c
mov dword [ebx + 0x178], eax
mov byte [ebx + 0xd0], 0
mov eax, dword [0x54c9c4]
cmp byte [eax], 0
jne 0x4bd04e
mov eax, ebx
call fcn.004bd228
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
mov byte [ebx + 0xd1], 0
mov byte [ebx + 0xdc], 0
xor eax, eax
mov dword [ebx + 0xd4], eax
mov byte [ebx + 0xd3], 0
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.004bfc28
mov eax, ebx
call fcn.004c085c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4bd0ab
call fcn.004053dc
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x536670
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00406a70
xor eax, eax
push ebp
push 0x5366ee
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00406b14
mov dword [ebp - 8], eax
cmp dword [ebx + 8], 0
jne 0x5366b9
mov eax, dword [ebx + 4]
call fcn.00406b14
push eax
push 0
call sub.advapi32.dll_RegisterEventSourceW
mov dword [ebx + 8], eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push 1
push 0
mov eax, dword [ebp + 8]
push eax
movzx eax, word [ebp + 0xc]
push eax
push esi
mov eax, dword [ebx + 8]
push eax
call sub.advapi32.dll_ReportEventW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5366f5
lea eax, [ebp - 4]
call fcn.00406a78
ret

Function at 0x53773c
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5378e4
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
xor eax, eax
call fcn.004045bc
cmp word [ebx + 0xaa], 0
je 0x537785
mov edx, ebx
mov eax, dword [ebx + 0xac]
call dword [ebx + 0xa8]
mov eax, dword [ebx + 0x98]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x537799
lea esi, [ebp - 0xc]
jmp 0x53779b
xor esi, esi
cmp dword [ebx + 0x88], 0
jne 0x5377a8
xor edi, edi
jmp 0x5377b5
mov eax, dword [ebx + 0x88]
call fcn.00406b14
mov edi, eax
mov eax, dword [ebx + 0x84]
call fcn.00406b14
push eax
push edi
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.00536e68
mov eax, dword [ebp - 0x14]
call fcn.00406b14
push eax
push esi
mov eax, dword [ebx + 0x7c]
call fcn.00406b14
push eax
mov eax, dword [ebp - 4]
call fcn.00406b14
push eax
mov eax, ebx
call fcn.00536fb0
push eax
mov eax, ebx
call fcn.00536f84
push eax
mov eax, ebx
call fcn.00536f3c
push eax
push 0xf01ff
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.00536d10
mov eax, dword [ebp - 0x18]
call fcn.00406b14
push eax
mov eax, dword [ebx + 8]
call fcn.00406b14
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CreateServiceW
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x98], eax
cmp dword [ebp - 0x10], 0
jne 0x537841
call fcn.0041aa70
xor edx, edx
push ebp
push 0x5378ba
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x53787f
push dword fs:[edx]
mov dword fs:[edx], esp
cmp word [ebx + 0xb2], 0
je 0x537875
mov edx, ebx
mov eax, dword [ebx + 0xb4]
call dword [ebx + 0xb0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5378a3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5378c1
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
Function at 0x5378f4
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp word [eax + 0xba], 0
je 0x537920
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0xbc]
call dword [esi + 0xb8]
push 0xf01ff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00406b14
push eax
push ebx
call sub.advapi32.dll_OpenServiceW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x537945
call fcn.0041aa70
xor eax, eax
push ebp
push 0x53797c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_DeleteService
test eax, eax
jne 0x537965
call fcn.0041aa70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x537983
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret

Function at 0x5384c0
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x538511
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x114], 0x114
lea eax, [ebp - 0x114]
push eax
call sub.kernel32.dll_GetVersionExW
mov al, 1
call fcn.00538400
push 0
push 6
call sub.user32.dll_ExitWindowsEx
xor eax, eax
call fcn.00538400
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x53851b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x538524
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x218], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x5385c3
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x538596
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x212]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathW
lea eax, [ebp - 0x218]
lea edx, [ebp - 0x212]
mov ecx, 0x105
call fcn.00406c98
mov eax, dword [ebp - 0x218]
mov edx, dword [ebp - 8]
call fcn.00419dc0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5385aa
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5385ca
lea eax, [ebp - 0x218]
call fcn.00406a78
ret
Function at 0x5385d4
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x5386c2
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea eax, [ebp - 8]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
mov ebx, eax
test ebx, ebx
jne 0x538627
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x3f0
jne 0x538627
lea eax, [ebp - 8]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov ebx, eax
test ebx, ebx
je 0x5386b8
mov eax, 0x400
call fcn.004041e8
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x400
push esi
push 2
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_GetTokenInformation
mov ebx, eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
test ebx, ebx
je 0x5386b1
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
push 0x54c980
call sub.advapi32.dll_AllocateAndInitializeSid
mov ebx, dword [esi]
dec ebx
test ebx, ebx
jl 0x5386a8
inc ebx
xor edi, edi
mov eax, dword [esi + edi*8 + 4]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x5386a4
mov byte [ebp - 1], 1
jmp 0x5386a8
inc edi
dec ebx
jne 0x53868c
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_FreeSid
mov eax, esi
call fcn.00404204
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5386d0
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x539020
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406a70
mov eax, dword [ebp - 8]
call fcn.00406a70
xor eax, eax
push ebp
push 0x539151
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x53911a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x3c
call fcn.00404814
mov dword [ebp - 0x48], 0x3c
mov dword [ebp - 0x44], 0x40
mov eax, dword [0x54d040]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
mov dword [ebp - 0x40], eax
lea edx, [ebp - 0x4c]
mov eax, dword [ebp - 4]
call fcn.00413b08
mov eax, dword [ebp - 0x4c]
call fcn.00406b14
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 8]
call fcn.00406b14
mov dword [ebp - 0x34], eax
lea edx, [ebp - 0x50]
mov eax, dword [ebp - 4]
call fcn.00413acc
mov eax, dword [ebp - 0x50]
call fcn.00406b14
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 1
lea eax, [ebp - 0x48]
push eax
call sub.shell32.dll_ShellExecuteExW
test eax, eax
je 0x53910d
mov eax, dword [0x54d040]
mov eax, dword [eax]
call fcn.004beb18
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetExitCodeProcess
cmp dword [ebp - 0xc], 0x103
jne 0x53910d
mov eax, dword [0x54d040]
mov eax, dword [eax]
cmp byte [eax + 0xa4], 0
je 0x5390db
mov ebx, dword [ebp - 0xc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x539129
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x539158
lea eax, [ebp - 0x50]
mov edx, 2
call fcn.00406a80
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406a80
ret

Function at 0x539164
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406a70
mov eax, dword [ebp - 8]
call fcn.00406a70
xor eax, eax
push ebp
push 0x5391f0
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x5391cb
push dword fs:[eax]
mov dword fs:[eax], esp
push 5
push 0
mov eax, dword [ebp - 8]
call fcn.00406b14
push eax
mov eax, dword [ebp - 4]
call fcn.00406b14
push eax
push 0x539200
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5391d5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5391f7
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406a80
ret
Function at 0x539310
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406a70
xor eax, eax
push ebp
push 0x53938f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x53936f
push dword fs:[eax]
mov dword fs:[eax], esp
push 5
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00406b14
push eax
push 0x53939c
mov eax, dword [0x54d040]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x539379
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x539396
lea eax, [ebp - 4]
call fcn.00406a78
ret

Function at 0x53a318
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd74
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x288], edx
mov dword [ebp - 0x28c], edx
mov dword [ebp - 0x27c], edx
mov dword [ebp - 0x280], edx
mov dword [ebp - 0x274], edx
mov dword [ebp - 0x278], edx
lea eax, [ebp - 0x270]
mov edx, dword [0x40d5c4]
call fcn.00407728
xor eax, eax
push ebp
push 0x53a519
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x53a4d0
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0x278]
xor eax, eax
call fcn.004045bc
mov eax, dword [ebp - 0x278]
lea edx, [ebp - 0x274]
call fcn.00413acc
lea eax, [ebp - 0x274]
mov edx, 0x53a534
call fcn.00406eac
mov eax, dword [ebp - 0x274]
lea ecx, [ebp - 0x270]
mov edx, 0x1ff
call fcn.00413960
xor edx, edx
push ebp
push 0x53a428
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0x280]
xor eax, eax
call fcn.004045bc
mov eax, dword [ebp - 0x280]
lea edx, [ebp - 0x27c]
call fcn.00413acc
lea eax, [ebp - 0x27c]
mov edx, dword [ebp - 0x25c]
call fcn.00406eac
mov ebx, dword [ebp - 0x27c]
mov dword [ebp - 0x284], ebx
mov eax, dword [ebp - 0x284]
call fcn.00406b14
push eax
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb eax, eax
inc eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x53a4a8
xor eax, eax
push ebp
push 0x53a49e
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x28c]
xor eax, eax
call fcn.004045bc
mov eax, dword [ebp - 0x28c]
lea edx, [ebp - 0x288]
call fcn.00413acc
lea eax, [ebp - 0x288]
mov edx, dword [ebp - 0x25c]
call fcn.00406eac
mov esi, dword [ebp - 0x288]
mov dword [ebp - 0x284], esi
mov eax, dword [ebp - 0x284]
call fcn.00406b14
push eax
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x53a4a8
lea eax, [ebp - 0x270]
call fcn.004139b0
test eax, eax
je 0x53a434
lea eax, [ebp - 0x270]
call fcn.004139d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x53a4da
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53a520
lea eax, [ebp - 0x28c]
mov edx, 2
call fcn.00406a80
lea eax, [ebp - 0x280]
mov edx, 4
call fcn.00406a80
lea eax, [ebp - 0x270]
mov edx, dword [0x40d5c4]
call fcn.00407800
ret