joyce8/EMBER2024-capa huggingface dataset:
Function at 0x492ac9
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x492b66
push ebx
push esi
call fcn.00492bb7
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00459b9b
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x492b13
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x492b65
push edi
push eax
call fcn.0042e90b
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x492b33
call fcn.0042e8d1
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x492b64
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00459b9b
add esp, 0x20
test eax, eax
jne 0x492b52
push edi
call fcn.0042e8d1
jmp 0x492b5a
push ebx
call fcn.0042e8d1
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x492b69
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x492b7a
pop esi
ret
push ebx
push edi
push esi
call fcn.00492bb7
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.0042e90b
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x492ba2
push ebx
push esi
push edi
call fcn.00414ba0
add esp, 0xc
push 0
call fcn.0042e8d1
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x492bf9
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00492e64
Function at 0x496d05
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.00496e9c
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x496e74
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x496e74
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x496e29
jg 0x496d61
test eax, eax
je 0x496e1f
push 1
push 0x1000
call fcn.0042e874
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x496d84
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x496e16
push 0x8000
push ebx
call fcn.00496bff
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x496dad
jg 0x496da8
cmp ecx, 0x1000
jb 0x496dad
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.004806e1
add esp, 0x10
cmp eax, 0xffffffff
je 0x496df2
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x496da8
jl 0x496dd9
test ecx, ecx
jne 0x496d9a
push dword [ebp - 0xc]
push ebx
call fcn.00496bff
push esi
call fcn.0042e8d1
add esp, 0xc
xor ebx, ebx
jmp 0x496e82
cmp byte [edi + 0x24], 0
je 0x496e09
cmp dword [edi + 0x20], 5
jne 0x496e09
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x496e14
mov ebx, dword [edi + 0x18]
jmp 0x496e16
xor ebx, ebx
push esi
call fcn.0042e8d1
pop ecx
jmp 0x496e82
test ecx, ecx
jg 0x496deb
jl 0x496e29
test eax, eax
jae 0x496deb
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004884cf
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x496e49
cmp byte [edi + 0x1c], 0
je 0x496deb
jmp 0x496e7a
push ebx
call fcn.004584c8
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x496deb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x496e82
cmp byte [edi + 0x1c], 0
je 0x496e7f
mov ebx, dword [edi + 0x18]
jmp 0x496e82
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.004884cf
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x496f10
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0xc
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x4d6800]
mov esi, eax
add esp, 4
test esi, esi
jne 0x496f3b
pop esi
pop ebp
add esp, 0xc
ret
lea ecx, [esi + 0xc]
mov dword [esi], ebp
mov dword [esi + 4], ecx
mov eax, dword [ebp + 0xc]
add eax, ecx
push ebx
mov ebx, dword [esp + 0x24]
mov dword [esi + 8], eax
push edi
lea edi, [ebp + 4]
cmp ebx, dword [ebp + 0x10]
jbe 0x496f8a
mov eax, dword [ebp]
push ecx
call eax
mov eax, dword [edi]
push ebx
push dword [esp + 0x2c]
push dword [esi + 4]
call eax
mov eax, dword [esi + 8]
add eax, dword [ebp + 0xc]
push dword [esi + 4]
mov dword [esp + 0x28], eax
push eax
mov eax, dword [ebp + 8]
call eax
mov ebx, dword [ebp + 0x14]
add esp, 0x18
mov dword [esp + 0x28], ebx
jmp 0x496f92
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], eax
push dword [esi + 4]
mov eax, dword [ebp]
call eax
push dword [esi + 8]
mov eax, dword [ebp]
call eax
mov eax, dword [esp + 0x30]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x497003
mov ebp, dword [esp + 0x14]
mov ebx, eax
mov dword [esp + 0x18], eax
nop dword [eax]
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x13], al
lea eax, [esp + 0x13]
push 1
push eax
push dword [esi + 4]
mov eax, dword [edi]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x1f], al
lea eax, [esp + 0x1f]
push 1
push eax
push dword [esi + 8]
mov eax, dword [edi]
call eax
add esp, 0x18
sub ebx, 1
jne 0x496fc0
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x20]
cmp ebx, dword [ebp + 0x10]
jae 0x497035
nop dword [eax + eax]
mov eax, dword [edi]
push 1
push 0x4ab480
push dword [esi + 4]
call eax
mov eax, dword [edi]
push 1
push 0x4ab481
push dword [esi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [ebp + 0x10]
jb 0x497010
pop edi
pop ebx
mov eax, esi
pop esi
pop ebp
add esp, 0xc
ret
Function at 0x4fcf24
Capabilities:
Delete user account

Disassembly:
xor eax, eax
push eax
call fcn.00408600
mov edx, dword [esp + 8]
lea ecx, [esp]
call fcn.004011b0
push esp
push 0x41
call fcn.00409350
add esp, 8
push 0x20034d
call fcn.00521f18
push 0x20034e
call fcn.00521f18
push dword [esp]
push 0
call sub.NETAPI32.dll_NetUserDel
push 0x20034e
call fcn.00522048
jmp 0x4fcf7f
push edx
push eax
call fcn.00409480
pop eax
push dword [esp + 4]
call fcn.00408690
pop edx
add esp, 4
ret 4
Function at 0x5064d3
Capabilities:
List user account groups

Disassembly:
push ebp
push ebx
mov edx, 7
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x5064da
call fcn.00408600
push dword [esp + 0x28]
call fcn.00401220
push esp
push 0x44
call fcn.00409350
add esp, 8
push 0x20036c
call fcn.00521f18
push 0x20036d
call fcn.00521f18
mov edx, 0x4c31a6
lea ecx, [esp]
call fcn.004011b8
push 0x20036d
call fcn.00521f18
mov dword [esp + 0xc], 0
push 0x20036d
call fcn.00521f18
mov dword [esp + 0x10], 0
push 0x20036d
call fcn.00521f18
mov dword [esp + 0x14], 0
push 0x20036e
call fcn.00521f18
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
push 0xffffffff
lea eax, [esp + 0x18]
push eax
push 0
push 0
call sub.NETAPI32.dll_NetLocalGroupEnum
push 0x20036e
call fcn.00522048
mov ebx, eax
and ebx, ebx
jne 0x50671f
push 0x20036f
call fcn.00521f18
push dword [esp + 8]
pop eax
mov dword [esp + 4], eax
push 0x200371
call fcn.00521f18
mov dword [esp + 0x18], 0
jmp 0x5065d1
push 0x200371
call fcn.00521f18
mov ebx, dword [esp + 0xc]
dec ebx
cmp ebx, dword [esp + 0x18]
jl 0x5066d0
push 0x200372
call fcn.00521f18
push 4
push dword [esp + 8]
call sub.KERNEL32.dll_IsBadReadPtr
push 0x200372
call fcn.00522048
mov ebx, eax
and ebx, ebx
jne 0x5066b2
push 0x200373
call fcn.00521f18
push 8
mov ebp, dword [esp + 8]
call fcn.00521fa1
push dword [ebp]
call sub.KERNEL32.dll_IsBadReadPtr
push 0x200373
call fcn.00522048
mov ebx, eax
and ebx, ebx
jne 0x506693
push 0x200374
call fcn.00521f18
mov edx, dword [esp]
push edx
call fcn.00408730
pop edx
push eax
push edx
call fcn.00408640
push edx
call fcn.00408730
pop edx
push eax
push edx
call fcn.00408730
pop edx
push eax
mov ebp, dword [esp + 0x10]
call fcn.00521fa1
push dword [ebp]
call fcn.004081a0
call fcn.004084d0
pop eax
mov edx, 0x4c31c2
push edx
call fcn.00408640
lea eax, [esp + 4]
push eax
call fcn.00408560
push 0x200375
call fcn.00521f18
push 0x200376
call fcn.00521f18
mov ebx, dword [esp + 4]
add ebx, 4
mov dword [esp + 4], ebx
push 0x200377
call fcn.00521f18
push 0x200378
call fcn.00521f18
inc dword [esp + 0x18]
jno 0x5065c7
push 0x200379
call fcn.00521f18
push 4
push dword [esp + 0xc]
call sub.KERNEL32.dll_IsBadReadPtr
push 0x200379
call fcn.00522048
mov ebx, eax
and ebx, ebx
jne 0x506715
push 0x20037a
call fcn.00521f18
push dword [esp + 8]
call sub.NETAPI32.dll_NetApiBufferFree
push 0x20037a
call fcn.00522048
push 0x20037b
call fcn.00521f18
push 0x20037c
call fcn.00521f18
push 0x20037d
call fcn.00521f18
mov edx, dword [esp]
push edx
call fcn.00408730
pop edx
push eax
push edx
call fcn.00408640
pop eax
push eax
call fcn.004011e0
pop edx
add eax, edx
jmp 0x506764
push edx
push eax
call fcn.00409480
pop eax
push dword [esp + 4]
call fcn.00408690
pop edx
add esp, 0x1c
pop ebx
pop ebp
ret
Function at 0x50bf28
Capabilities:
Shutdown system

Disassembly:
push ebp
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00408600
push esp
push 0x4a
call fcn.00409350
add esp, 8
push 0x2003ac
call fcn.00521f18
push 0x2003ae
call fcn.00521f18
lea eax, [esp]
push eax
push 0x28
call sub.KERNEL32.dll_GetCurrentProcess
push 0x2003ae
call fcn.00522048
push eax
call sub.ADVAPI32.dll_OpenProcessToken
push 0x2003ae
call fcn.00522048
push 0x2003af
call fcn.00521f18
lea ebp, [esp + 4]
push ebp
pop ebp
lea eax, [ebp + 4]
push eax
mov eax, str.SeShutdownPrivilege
push eax
push 0
call sub.ADVAPI32.dll_LookupPrivilegeValueW
push 0x2003af
call fcn.00522048
push 0x2003b0
call fcn.00521f18
lea ebp, [esp + 4]
call fcn.00521fa1
mov dword [ebp], 1
push 0x2003b1
call fcn.00521f18
push ebp
pop ebp
call fcn.00521fa1
mov dword [ebp + 0xc], 2
push 0x2003b2
call fcn.00521f18
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
push dword [esp + 0x14]
call sub.ADVAPI32.dll_AdjustTokenPrivileges
push 0x2003b2
call fcn.00522048
push 0x2003b3
call fcn.00521f18
push 0
push 6
call sub.USER32.dll_ExitWindowsEx
push 0x2003b3
call fcn.00522048
push 0x2003b4
call fcn.00521f18
xor eax, eax
push edx
push eax
call fcn.00409480
pop eax
pop edx
add esp, 0x14
pop ebx
pop ebp
ret
Function at 0x512bf2
Capabilities:
Set registry value

Disassembly:
push ebx
mov edx, 8
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x512bf8
call fcn.00408600
mov edx, dword [esp + 0x28]
lea ecx, [esp]
call fcn.004011b0
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 4]
call fcn.004011b0
mov edx, dword [esp + 0x30]
lea ecx, [esp + 8]
call fcn.004011b0
push esp
push 0x3e
call fcn.00409350
add esp, 8
push 0x20030a
call fcn.00521f18
push 0x20030b
call fcn.00521f18
mov dword [esp + 0xc], 0
push 0x20030e
call fcn.00521f18
call fcn.0050adb4
push 0x20030e
call fcn.00522048
and eax, eax
je 0x512c7e
mov eax, 1
jmp 0x512c80
xor eax, eax
and eax, eax
je 0x512ca2
push 0x20030f
call fcn.00521f18
mov dword [esp + 0x18], 0xf013f
push 0x200310
call fcn.00521f18
jmp 0x512cbe
push 0x200310
call fcn.00521f18
push 0x200311
call fcn.00521f18
mov dword [esp + 0x18], 0xf003f
push 0x200312
call fcn.00521f18
push 0x200313
call fcn.00521f18
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x1c]
push 0
mov eax, 0x4c31a6
push eax
push closesocket
call sub.ADVAPI32.dll_RegOpenKeyExW
push 0x200313
call fcn.00522048
mov ebx, eax
and ebx, ebx
jne 0x512dd4
push 0x200314
call fcn.00521f18
lea eax, [esp + 0x14]
push eax
push dword [esp + 4]
push dword [esp + 0x18]
call sub.ADVAPI32.dll_RegCreateKeyW
push 0x200314
call fcn.00522048
mov ebx, eax
and ebx, ebx
jne 0x512dad
push 0x200315
call fcn.00521f18
push dword [esp + 8]
call fcn.004021c0
mov ebx, eax
inc ebx
add ebx, ebx
push ebx
push dword [esp + 0xc]
push 2
push 0
push dword [esp + 0x14]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegSetValueExW
push 0x200315
call fcn.00522048
mov ebx, eax
and ebx, ebx
jne 0x512d86
push 0x200316
call fcn.00521f18
mov dword [esp + 0xc], 1
push 0x200317
call fcn.00521f18
push 0x200318
call fcn.00521f18
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
push 0x200318
call fcn.00522048
push 0x200319
call fcn.00521f18
push 0x20031a
call fcn.00521f18
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegCloseKey
push 0x20031a
call fcn.00522048
push 0x20031b
call fcn.00521f18
push 0x20031c
call fcn.00521f18
mov eax, dword [esp + 0xc]
jmp 0x512dfa
push edx
push eax
call fcn.00409480
pop eax
push dword [esp + 8]
call fcn.00408690
push dword [esp + 0xc]
call fcn.00408690
push dword [esp + 4]
call fcn.00408690
pop edx
add esp, 0x20
pop ebx
ret 0xc
Function at 0x513bfa
Capabilities:
Get common file path

Disassembly:
push ebp
push ebx
mov edx, 9
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x513c01
call fcn.00408600
push dword [esp + 0x30]
call fcn.00401220
push esp
push 0x36
call fcn.00409350
add esp, 8
push 0x2002a6
call fcn.00521f18
push 0x2002a7
call fcn.00521f18
lea edx, [esp]
push edx
push 0
push 0xb
push 1
mov eax, 1
push 2
call fcn.00521fae
call fcn.00407c95
push 0x2002a8
call fcn.00521f18
push 0
push 0
call sub.KERNEL32.dll_GetSystemDirectoryW
push 0x2002a8
call fcn.00522048
mov dword [esp + 0x20], eax
push 0x2002a9
call fcn.00521f18
mov ebx, dword [esp + 0x20]
and ebx, ebx
jne 0x513cca
push 0x2002aa
call fcn.00521f18
mov edx, 0x4c31a6
push edx
call fcn.00408730
pop edx
push eax
push edx
call fcn.00408640
pop eax
push eax
call fcn.004011e0
pop edx
add eax, edx
jmp 0x513dce
push 0x2002ab
call fcn.00521f18
push 0x2002ac
call fcn.00521f18
mov eax, dword [esp + 0x20]
inc eax
lea edx, [esp]
push edx
push eax
call fcn.00521fae
call fcn.00407e52
push 0x2002ad
call fcn.00521f18
mov ebx, dword [esp + 0x20]
add ebx, ebx
push ebx
mov eax, 0
mov edx, dword [esp + 4]
mov edx, dword [edx - 8]
call fcn.00521fbb
mov ebp, dword [esp + 4]
lea eax, [ebp]
push eax
call fcn.00408030
call fcn.00408310
push 0x2002ae
call fcn.00521f18
push dword [esp + 0x20]
mov eax, 0
mov edx, dword [esp + 4]
mov edx, dword [edx - 8]
call fcn.00521fbb
lea eax, [ebp]
push eax
call sub.KERNEL32.dll_GetSystemDirectoryW
push 0x2002ae
call fcn.00522048
mov dword [esp + 0x20], eax
push 0x2002af
call fcn.00521f18
push edx
call fcn.00408730
pop edx
push eax
push edx
call fcn.00408730
pop edx
push eax
push 0x19
push 0xffffffff
mov eax, 0
mov edx, dword [esp + 0x10]
mov edx, dword [edx - 8]
call fcn.00521fbb
mov ebp, dword [esp + 0x10]
lea eax, [ebp]
push eax
call fcn.00408140
call fcn.004083b0
mov edx, 0x4c3372
push edx
call fcn.00408640
pop eax
push eax
call fcn.004011e0
pop edx
add eax, edx
jmp 0x513dce
push edx
push eax
call fcn.00409480
pop eax
push eax
push dword [esp + 8]
call fcn.00407e02
pop eax
pop edx
add esp, 0x24
pop ebx
pop ebp
ret
Function at 0x519e1a
Capabilities:
Add user account

Disassembly:
push ebp
mov edx, 0xc
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x519e20
call fcn.00408600
mov edx, dword [esp + 0x38]
lea ecx, [esp]
call fcn.004011b0
mov edx, dword [esp + 0x3c]
lea ecx, [esp + 4]
call fcn.004011b0
push esp
push 0x40
call fcn.00409350
add esp, 8
push 0x200342
call fcn.00521f18
push 0x200344
call fcn.00521f18
mov dword [esp + 8], 1
push 0x200345
call fcn.00521f18
mov dword [esp + 0xc], 0
push 0x200346
call fcn.00521f18
push 0
push 0x20
lea eax, [esp + 0x18]
push eax
call fcn.00408030
call fcn.004082f0
push 0x200347
call fcn.00521f18
mov eax, dword [esp]
push eax
lea ebp, [esp + 0x14]
call fcn.00521fa1
pop eax
mov dword [ebp], eax
push 0x200348
call fcn.00521f18
mov eax, dword [esp + 4]
push eax
call fcn.00521fa1
pop eax
mov dword [ebp + 4], eax
push 0x200349
call fcn.00521f18
call fcn.00521fa1
mov dword [ebp + 0xc], 1
push 0x20034a
call fcn.00521f18
call fcn.00521fa1
mov dword [ebp + 0x18], 1
push 0x20034b
call fcn.00521f18
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x10]
push 0
call sub.NETAPI32.dll_NetUserAdd
push 0x20034b
call fcn.00522048
jmp 0x519f43
push edx
push eax
call fcn.00409480
pop eax
push dword [esp + 4]
call fcn.00408690
push dword [esp + 8]
call fcn.00408690
pop edx
add esp, 0x30
pop ebp
ret 8
Function at 0x51d49f
Capabilities:
Set socket configuration

Disassembly:
xor eax, eax
push eax
push eax
call fcn.00408600
push esp
push 0x12
call fcn.00409350
add esp, 8
push 0x200019
call fcn.00521f18
push 0x20001b
call fcn.00521f18
mov dword [esp + 4], 4
push 0x20001c
call fcn.00521f18
push dword [esp + 0x10]
pop eax
mov dword [esp], eax
push 0x20001d
call fcn.00521f18
lea eax, [esp + 4]
push eax
lea eax, [esp + 4]
push eax
push 0x1002
push 0xffff
push dword [esp + 0x1c]
call sub.WS2_32.dll_setsockopt
push 0x20001d
call fcn.00522048
push 0x20001e
call fcn.00521f18
lea eax, [esp + 4]
push eax
lea eax, [esp + 4]
push eax
push 0x1001
push 0xffff
push dword [esp + 0x1c]
call sub.WS2_32.dll_setsockopt
push 0x20001e
call fcn.00522048
push 0x200024
call fcn.00521f18
xor eax, eax
push edx
push eax
call fcn.00409480
pop eax
pop edx
add esp, 8
ret 8

Function at 0x51dd4b
Capabilities:
Shutdown system

Disassembly:
push ebp
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00408600
push esp
push 0x49
call fcn.00409350
add esp, 8
push 0x2003a3
call fcn.00521f18
push 0x2003a5
call fcn.00521f18
lea eax, [esp]
push eax
push 0x28
call sub.KERNEL32.dll_GetCurrentProcess
push 0x2003a5
call fcn.00522048
push eax
call sub.ADVAPI32.dll_OpenProcessToken
push 0x2003a5
call fcn.00522048
push 0x2003a6
call fcn.00521f18
lea ebp, [esp + 4]
push ebp
pop ebp
lea eax, [ebp + 4]
push eax
mov eax, str.SeShutdownPrivilege
push eax
push 0
call sub.ADVAPI32.dll_LookupPrivilegeValueW
push 0x2003a6
call fcn.00522048
push 0x2003a7
call fcn.00521f18
lea ebp, [esp + 4]
call fcn.00521fa1
mov dword [ebp], 1
push 0x2003a8
call fcn.00521f18
push ebp
pop ebp
call fcn.00521fa1
mov dword [ebp + 0xc], 2
push 0x2003a9
call fcn.00521f18
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
push dword [esp + 0x14]
call sub.ADVAPI32.dll_AdjustTokenPrivileges
push 0x2003a9
call fcn.00522048
push 0x2003aa
call fcn.00521f18
push 0
push 2
call sub.USER32.dll_ExitWindowsEx
push 0x2003aa
call fcn.00522048
push 0x2003ab
call fcn.00521f18
xor eax, eax
push edx
push eax
call fcn.00409480
pop eax
pop edx
add esp, 0x14
pop ebx
pop ebp
ret
Function at 0x51e889
Capabilities:
List user accounts

Disassembly:
push ebp
push ebx
mov edx, 7
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x51e890
call fcn.00408600
push dword [esp + 0x28]
call fcn.00401220
push esp
push 0x3f
call fcn.00409350
add esp, 8
push 0x200325
call fcn.00521f18
push 0x200326
call fcn.00521f18
mov edx, 0x4c31a6
lea ecx, [esp]
call fcn.004011b8
push 0x200326
call fcn.00521f18
mov dword [esp + 0xc], 0
push 0x200326
call fcn.00521f18
mov dword [esp + 0x10], 0
push 0x200326
call fcn.00521f18
mov dword [esp + 0x14], 0
push 0x200327
call fcn.00521f18
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
push 0xffffffff
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
call sub.NETAPI32.dll_NetUserEnum
push 0x200327
call fcn.00522048
mov ebx, eax
and ebx, ebx
jne 0x51eada
push 0x200328
call fcn.00521f18
push dword [esp + 8]
pop eax
mov dword [esp + 4], eax
push 0x20032a
call fcn.00521f18
mov dword [esp + 0x18], 0
jmp 0x51e98c
push 0x20032a
call fcn.00521f18
mov ebx, dword [esp + 0xc]
dec ebx
cmp ebx, dword [esp + 0x18]
jl 0x51ea8b
push 0x20032b
call fcn.00521f18
push 4
push dword [esp + 8]
call sub.KERNEL32.dll_IsBadReadPtr
push 0x20032b
call fcn.00522048
mov ebx, eax
and ebx, ebx
jne 0x51ea6d
push 0x20032c
call fcn.00521f18
push 8
mov ebp, dword [esp + 8]
call fcn.00521fa1
push dword [ebp]
call sub.KERNEL32.dll_IsBadReadPtr
push 0x20032c
call fcn.00522048
mov ebx, eax
and ebx, ebx
jne 0x51ea4e
push 0x20032d
call fcn.00521f18
mov edx, dword [esp]
push edx
call fcn.00408730
pop edx
push eax
push edx
call fcn.00408640
push edx
call fcn.00408730
pop edx
push eax
push edx
call fcn.00408730
pop edx
push eax
mov ebp, dword [esp + 0x10]
call fcn.00521fa1
push dword [ebp]
call fcn.004081a0
call fcn.004084d0
pop eax
mov edx, 0x4c31c2
push edx
call fcn.00408640
lea eax, [esp + 4]
push eax
call fcn.00408560
push 0x20032e
call fcn.00521f18
push 0x20032f
call fcn.00521f18
mov ebx, dword [esp + 4]
add ebx, 4
mov dword [esp + 4], ebx
push 0x200330
call fcn.00521f18
push 0x200331
call fcn.00521f18
inc dword [esp + 0x18]
jno 0x51e982
push 0x200332
call fcn.00521f18
push 4
push dword [esp + 0xc]
call sub.KERNEL32.dll_IsBadReadPtr
push 0x200332
call fcn.00522048
mov ebx, eax
and ebx, ebx
jne 0x51ead0
push 0x200333
call fcn.00521f18
push dword [esp + 8]
call sub.NETAPI32.dll_NetApiBufferFree
push 0x200333
call fcn.00522048
push 0x200334
call fcn.00521f18
push 0x200335
call fcn.00521f18
push 0x200336
call fcn.00521f18
mov edx, dword [esp]
push edx
call fcn.00408730
pop edx
push eax
push edx
call fcn.00408640
pop eax
push eax
call fcn.004011e0
pop edx
add eax, edx
jmp 0x51eb1f
push edx
push eax
call fcn.00409480
pop eax
push dword [esp + 4]
call fcn.00408690
pop edx
add esp, 0x1c
pop ebx
pop ebp
ret
Function at 0x521d11
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push esp
push 4
call fcn.00409350
add esp, 8
push 0x300033
call fcn.00521f18
push 0x300034
call fcn.00521f18
mov edx, dword [esp + 8]
push 0x300035
call fcn.00521f18
mov ecx, dword [esp + 0xc]
push 0x300036
call fcn.00521f18
mov eax, dword [esp + 4]
push 0x300037
call fcn.00521f18
push ebx
push 0x300038
call fcn.00521f18
push esi
push 0x300039
call fcn.00521f18
push edi
push 0x30003a
call fcn.00521f18
lea edi, [0x4ca1f4]
push 0x30003b
call fcn.00521f18
not eax
push 0x30003c
call fcn.00521f18
sub ecx, 4
jb 0x521e69
push 0x30003f
call fcn.00521f18
mov ebx, dword [edx]
push 0x300040
call fcn.00521f18
xor ebx, eax
push 0x300041
call fcn.00521f18
movzx esi, bl
push 0x300042
call fcn.00521f18
mov eax, dword [edi + esi*4 + 0xc00]
push 0x300043
call fcn.00521f18
shr ebx, 8
push 0x300044
call fcn.00521f18
movzx esi, bl
push 0x300045
call fcn.00521f18
xor eax, dword [edi + esi*4 + 0x800]
push 0x300046
call fcn.00521f18
shr ebx, 8
push 0x300047
call fcn.00521f18
movzx esi, bl
push 0x300048
call fcn.00521f18
xor eax, dword [edi + esi*4 + 0x400]
push 0x300049
call fcn.00521f18
shr ebx, 8
push 0x30004a
call fcn.00521f18
xor eax, dword [edi + ebx*4]
push 0x30004b
call fcn.00521f18
add edx, 4
push 0x30004c
call fcn.00521f18
sub ecx, 4
jae 0x521da3
push 0x30004f
call fcn.00521f18
add ecx, 4
je 0x521ec7
push 0x300052
call fcn.00521f18
movzx ebx, byte [edx]
push 0x300053
call fcn.00521f18
xor bl, al
push 0x300054
call fcn.00521f18
shr eax, 8
push 0x300055
call fcn.00521f18
xor eax, dword [edi + ebx*4]
push 0x300056
call fcn.00521f18
add edx, 1
push 0x300057
call fcn.00521f18
sub ecx, 1
jne 0x521e78
push 0x30005a
call fcn.00521f18
pop edi
push 0x30005b
call fcn.00521f18
pop esi
push 0x30005c
call fcn.00521f18
pop ebx
push 0x30005d
call fcn.00521f18
not eax
push 0x30005e
call fcn.00521f18
jmp 0x521f0c
push edx
push eax
call fcn.00409480
pop eax
pop edx
ret 0xc

Function at 0x521f18
Capabilities:
Packed with generic packer

Disassembly:
pushal
pushfd
push esp
push dword [esp + 0x2c]
call fcn.00408810
add esp, 8
or eax, eax
je 0x521f30
jmp 0x4f05b2
popfd
popal
ret 4