joyce8/EMBER2024-capa huggingface dataset:
Function at 0x481e8f
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x52472c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
test ecx, ecx
jne 0x481eb0
xor al, al
jmp 0x481fd0
push 2
lea esi, [ebp - 0x408]
pop edi
jmp 0x481ec2
mov word [esi], ax
add ecx, edi
add esi, edi
movzx eax, word [ecx]
test ax, ax
jne 0x481ebb
xor eax, eax
mov word [esi], ax
push 0x5c
xor dl, dl
pop ebx
sub esi, edi
xor al, al
mov byte [ebp - 0x409], dl
cmp word [ebp - 0x408], bx
jne 0x481f00
cmp word [ebp - 0x406], bx
jne 0x481f00
mov byte [ebp - 0x409], 1
cmp word [esi], bx
je 0x481f07
inc al
jmp 0x481f07
cmp word [esi], bx
jne 0x481f07
mov dl, 1
lea ecx, [ebp - 0x404]
mov dword [ebp - 0x410], ecx
cmp word [ebp - 0x404], bx
je 0x481f29
add ecx, edi
cmp word [ecx], bx
jne 0x481f1c
mov dword [ebp - 0x410], ecx
test al, al
jne 0x481f33
test dl, dl
je 0x481f43
jmp 0x481f3c
add esi, edi
mov eax, ebx
mov word [esi], ax
add esi, edi
xor eax, eax
mov word [esi], ax
sub esi, edi
and dword [ebp - 0x418], 0
and dword [ebp - 0x414], 0
lea eax, [ebp - 0x420]
push eax
push eax
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x481fb1
cmp word [esi], bx
jne 0x481f7f
jmp 0x481f7d
cmp word [esi], bx
je 0x481f89
sub esi, edi
lea eax, [ebp - 0x408]
cmp esi, eax
ja 0x481f78
cmp esi, dword [ebp - 0x410]
jb 0x481ea9
cmp byte [ebp - 0x409], 0
jne 0x481fa6
cmp esi, dword [ebp - 0x410]
jne 0x481fa8
add esi, edi
xor eax, eax
mov word [esi], ax
sub esi, edi
jmp 0x481f51
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0x414]
ja 0x481fce
jb 0x481fc9
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x418]
jae 0x481fce
xor eax, eax
inc eax
jmp 0x481fd0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b1fae
leave
ret

Function at 0x482008
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp byte [esi], bl
je 0x482019
mov al, 1
jmp 0x48209f
mov al, byte [ebp + 8]
push edi
mov byte [esi + 1], al
mov eax, dword [ebp + 0xc]
lea edi, [esi + 4]
mov byte [esi], 1
call fcn.00439ecc
push 0x4ffc40
lea eax, [ebp + 8]
push eax
call fcn.004054bc
mov edi, dword [edi]
push dword [edi - 0xc]
lea eax, [ebp + 8]
push edi
call fcn.0044678f
pop edi
cmp byte [esi + 1], bl
je 0x482077
push ebx
push 0x1388
mov eax, 0x7f90
push eax
push eax
push 0xff
push 6
push 3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov dword [esi + 8], eax
cmp byte [esi + 1], bl
jne 0x48208e
push ebx
push ebx
push 3
push ebx
push ebx
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 8], eax
cmp dword [esi + 8], 0xffffffff
lea ecx, [ebp + 8]
setne bl
call fcn.004029ae
mov al, bl
pop ebx
pop ebp
ret 8
Function at 0x482266
Capabilities:
Connect pipe
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
cmp byte [ebp + 0x10], bl
jne 0x482298
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x482298
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x217
neg eax
sbb eax, eax
inc eax
jne 0x482298
cmp byte [esi + 0x11], bl
je 0x4822ea
mov eax, dword [esi + 0xc]
push edi
push ebx
lea ecx, [ebp + 0x10]
push ecx
push 0x7f90
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 0x10]
mov edx, dword [esi + 0xc]
xor edi, edi
shr ecx, 1
mov word [edx + ecx*2], di
pop edi
cmp eax, ebx
je 0x4822ea
cmp dword [ebp + 0x10], ebx
je 0x4822ea
push dword [esi + 0xc]
lea eax, [ebp - 4]
push eax
call fcn.004054bc
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call int.0041808f
lea ecx, [ebp - 4]
call fcn.004029ae
jmp 0x4822f2
push dword [ebp + 8]
call fcn.00447480
mov eax, dword [ebp + 8]
pop ebx
leave
ret 0xc

Function at 0x4822fa
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0xffffffff
jne 0x48230b
push edi
call fcn.00447480
jmp 0x482335
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
push 0
lea edx, [ebp + 0xc]
push edx
add ecx, ecx
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x482303
push 1
push dword [ebp + 8]
push edi
call fcn.00482266
mov eax, edi
pop ebp
ret 8

Function at 0x48233b
Capabilities:
Write file on windows

Disassembly:
push ecx
mov eax, dword [eax]
push 0
lea ecx, [esp + 4]
push ecx
mov ecx, dword [eax - 0xc]
add ecx, ecx
push ecx
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
pop ecx
ret
Function at 0x482899
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x40]
push 0
push eax
call fcn.004b4140
add esp, 0xc
push 0x64
pop eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [ebp - 0x40], esi
mov edi, dword [eax - 0xc]
mov ebx, 0x52702c
push eax
mov ecx, ebx
lea esi, [ebp - 4]
call fcn.0043b78e
lea eax, [ebp - 0x40]
push eax
push 0
push 0
push dword [ebp - 4]
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x48290d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea ecx, [ebp - 4]
call fcn.004029ae
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
push dword [ebp - 0x30]
mov edi, dword [ebp - 0x2c]
mov ecx, ebx
lea esi, [ebp + 8]
call fcn.0043b78e
mov edi, dword [ebp + 0x14]
mov eax, esi
call fcn.00439ecc
mov ecx, esi
call fcn.004029ae
push dword [ebp - 0x14]
mov edi, dword [ebp - 0x10]
mov ecx, ebx
lea esi, [ebp + 8]
call fcn.0043b78e
mov edi, dword [ebp + 0x18]
mov eax, esi
call fcn.00439ecc
mov ecx, esi
call fcn.004029ae
cmp dword [ebp - 0x24], 0
je 0x482976
push dword [ebp - 0x24]
mov edi, dword [ebp - 0x20]
mov ecx, ebx
lea esi, [ebp + 8]
call fcn.0043b78e
mov edi, dword [ebp + 0x1c]
mov eax, esi
call fcn.00439ecc
mov ecx, esi
call fcn.004029ae
cmp dword [ebp - 0x1c], 0
je 0x48299d
push dword [ebp - 0x1c]
mov edi, dword [ebp - 0x18]
mov ecx, ebx
lea esi, [ebp + 8]
call fcn.0043b78e
mov edi, dword [ebp + 0x20]
mov eax, esi
call fcn.00439ecc
mov ecx, esi
call fcn.004029ae
cmp dword [ebp - 0xc], 0
je 0x4829c4
push dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov ecx, ebx
lea esi, [ebp + 8]
call fcn.0043b78e
mov edi, dword [ebp + 0x24]
mov eax, esi
call fcn.00439ecc
mov ecx, esi
call fcn.004029ae
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov ax, word [ebp - 0x28]
mov ecx, dword [ebp + 0x10]
mov word [ecx], ax
xor esi, esi
jmp 0x4828fe
Function at 0x482ade
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x52472c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 3
push SysReAllocStringLen
push ecx
mov dword [ebp - 0x90], eax
mov byte [eax], bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x98], esi
cmp esi, 0xffffffff
jne 0x482b28
push eax
jmp 0x482b66
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
je 0x482b61
cmp eax, dword [ebp + 0xc]
jbe 0x482b61
sub eax, dword [ebp + 0xc]
mov edi, 0x10000
mov dword [ebp - 0x8c], eax
push edi
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], ebx
call fcn.00444a35
cmp dword [ebp - 0x80], ebx
jne 0x482b7d
push ebx
call fcn.004b3fe5
pop ecx
cmp esi, ebx
je 0x482b6c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b1fae
leave
ret
lea eax, [ebp - 0x78]
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x88], ebx
mov byte [ebp - 0x79], bl
call fcn.004aed30
jmp 0x482b9c
mov esi, dword [ebp - 0x98]
push ebx
lea eax, [ebp - 0x88]
push eax
push edi
push dword [ebp - 0x80]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x482bf8
mov esi, dword [ebp - 0x88]
cmp esi, ebx
je 0x482bf8
mov eax, dword [ebp - 0x84]
lea ecx, [esi + eax]
cmp ecx, dword [ebp - 0x8c]
jbe 0x482be0
mov esi, dword [ebp - 0x8c]
sub esi, eax
mov dword [ebp - 0x88], esi
mov byte [ebp - 0x79], 1
push dword [ebp - 0x80]
mov eax, esi
lea ecx, [ebp - 0x78]
call fcn.004aeb50
add dword [ebp - 0x84], esi
cmp byte [ebp - 0x79], bl
je 0x482b96
lea esi, [ebp - 0x78]
call fcn.004aec10
mov ebx, dword [ebp - 0x90]
mov eax, esi
call fcn.004aece0
push dword [ebp - 0x80]
mov bl, al
call fcn.004b3fe5
cmp dword [ebp - 0x98], 0
pop ecx
je 0x482c2d
push dword [ebp - 0x98]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
jmp 0x482b6e
Function at 0x482fcc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov ebx, eax
mov eax, dword [ebp + 8]
push edi
xor edi, edi
mov dword [eax + 0x10], ebx
cmp dword [eax + 4], edi
je 0x48305e
cmp ebx, edi
je 0x483009
push edi
push edi
push edi
push edi
lea esi, [eax + 0x14]
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edi, eax
call fcn.004199db
push dword [esi]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x20]
mov eax, dword [ebp + 8]
xor edi, edi
lea ecx, [ebp - 4]
push ecx
push edi
push eax
push 0x483067
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
cmp ebx, edi
je 0x483029
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x483053
mov ebx, dword [ebp - 4]
cmp esi, edi
je 0x48304f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x483060
cmp esi, edi
je 0x48305e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x483578
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x2e
mov esi, ebx
mov edi, eax
call fcn.0044667d
test eax, eax
jg 0x48359a
mov al, 1
jmp 0x4836d7
lea ecx, [ebp - 8]
push ecx
push ebx
mov ecx, eax
call fcn.0043b439
lea eax, [ebp - 0x14]
push eax
call fcn.00447480
push dword [ebp - 8]
mov eax, dword [ebp + 0xc]
push dword [ebx]
push dword [eax]
lea eax, [ebp - 0x14]
push str.__verbose___log_file__s____remove_pack_file___s____s_
push eax
call fcn.0044c153
add esp, 0x14
cmp dword [edi + 0x10], 0
je 0x4835d9
mov ecx, dword [edi + 0x10]
mov eax, dword [ecx]
push ebx
call dword [eax + 0x14]
push 0
push 0x8000008
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [edi + 0xc]
push eax
call fcn.00471a7e
add esp, 0x14
lea esi, [ebp - 8]
mov byte [ebp - 1], 1
call fcn.00460420
test al, al
je 0x483611
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4836a8
lea eax, [ebp - 0x10]
push eax
call fcn.00447480
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
call fcn.004722cd
pop ecx
lea eax, [ebp - 0xc]
push eax
call fcn.00447480
push 0xca
lea esi, [ebp - 0x18]
call fcn.004825ae
mov eax, dword [ebp - 8]
mov ebx, dword [eax - 0xc]
mov eax, dword [ebp - 0x18]
pop ecx
push 0x5c
lea esi, [ebp - 8]
mov dword [ebp - 0x1c], eax
call fcn.0044667d
mov ecx, ebx
sub ecx, eax
lea eax, [ebp - 0x20]
push eax
mov eax, esi
push eax
call fcn.0043b3dd
push dword [ebp - 0x10]
push dword [eax]
lea eax, [ebp - 0xc]
push dword [ebp - 0x1c]
push eax
call fcn.0044c153
add esp, 0x10
lea ecx, [ebp - 0x20]
call fcn.004029ae
push 0
lea esi, [ebp - 0xc]
call fcn.0047860d
pop ecx
lea ecx, [ebp - 0x18]
mov byte [ebp - 1], 0
call fcn.004029ae
mov ecx, esi
call fcn.004029ae
lea ecx, [ebp - 0x10]
call fcn.004029ae
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [edi + 0x10], 0
je 0x4836c4
mov edi, dword [edi + 0x10]
mov eax, dword [edi]
push ebx
mov ecx, edi
call dword [eax + 0x18]
lea ecx, [ebp - 0x14]
call fcn.004029ae
lea ecx, [ebp - 8]
call fcn.004029ae
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x48381c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
mov dword [ebx + 0x10], eax
cmp dword [eax], edi
je 0x483853
push edi
push edi
push edi
push edi
lea esi, [ebx + 0x14]
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edi, eax
call fcn.004199db
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
push dword [esi]
mov eax, dword [ecx]
call dword [eax + 0x10]
xor edi, edi
lea eax, [ebp - 4]
push eax
push edi
push ebx
push 0x483a77
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x18], esi
cmp dword [eax], edi
je 0x4838a9
mov edi, ebx
call fcn.004838e7
mov ebx, dword [ebx + 4]
mov esi, eax
mov eax, dword [edi]
mov dword [ebp - 0xc], edx
call fcn.0046ec0b
add esi, eax
adc dword [ebp - 0xc], edx
mov eax, dword [edi + 0x10]
push dword [ebp - 0xc]
mov ecx, dword [eax]
mov eax, dword [ecx]
push esi
call dword [eax]
mov eax, dword [edi + 0x10]
mov ecx, dword [eax]
mov eax, dword [ecx]
call dword [eax + 8]
mov esi, dword [ebp - 0x18]
xor edi, edi
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x4838d3
mov ebx, dword [ebp - 4]
cmp esi, edi
je 0x4838cf
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x4838e0
cmp esi, edi
je 0x4838de
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x483e48
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push edi
push 0x3c
xor edi, edi
lea eax, [ebp - 0x3c]
push edi
push eax
call fcn.004b4140
mov eax, dword [ebp + 8]
mov eax, dword [eax]
add esp, 0xc
lea ecx, [ebp - 0x3c]
push ecx
push edi
push edi
push eax
mov dword [ebp - 0x28], 0x64
mov dword [ebp - 0x3c], 0x3c
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x483e8c
push ebx
call fcn.00447480
jmp 0x483e99
push dword [ebp - 0x2c]
mov edi, dword [ebp - 0x28]
mov eax, ebx
call fcn.00472823
mov eax, ebx
pop edi
leave
ret
Function at 0x4844a9
Capabilities:
Get session user name
List groups for user account

Disassembly:
push ebp
lea ebp, [esp - 0x19c]
sub esp, 0x21c
mov eax, dword [0x52472c]
xor eax, ebp
mov dword [ebp + 0x198], eax
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x6c]
xor ebx, ebx
push eax
mov dword [ebp - 0x78], ebx
call esi
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x6c]
push eax
call esi
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.004054bc
lea eax, [ebp - 0x70]
push eax
mov ecx, 0x4eea90
call fcn.00461660
test eax, eax
jne 0x484510
lea ecx, [ebp - 0x70]
call fcn.004029ae
mov al, 1
jmp 0x484569
push edi
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x74]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x7c]
push eax
push 1
push ebx
push dword [ebp - 0x70]
mov dword [ebp - 0x7c], ebx
push ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x80], ebx
call sub.NETAPI32.dll_NetUserGetLocalGroups
test eax, eax
jne 0x48455e
mov esi, dword [ebp - 0x7c]
xor edi, edi
cmp dword [ebp - 0x74], ebx
jbe 0x48455e
cmp esi, ebx
je 0x484551
mov ecx, dword [esi]
call fcn.0045e7e0
test eax, eax
je 0x48455c
add esi, 4
inc edi
cmp edi, dword [ebp - 0x74]
jb 0x484542
jmp 0x48455e
mov bl, 1
lea ecx, [ebp - 0x70]
call fcn.004029ae
mov al, bl
pop edi
mov ecx, dword [ebp + 0x198]
pop esi
xor ecx, ebp
pop ebx
call fcn.004b1fae
add ebp, 0x19c
leave
ret

Function at 0x484782
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [eax]
sub esp, 0x1c
push SysReAllocStringLen
push eax
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
test eax, eax
jne 0x4847a3
xor al, al
jmp 0x4847c0
lea ecx, [ebp - 0x1c]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x48479f
cmp dword [ebp - 0x18], 4
je 0x4847be
cmp dword [ebp - 0x18], 2
jne 0x48479f
mov al, 1
leave
ret 4
Function at 0x4854c0
Capabilities:
Create process on windows
Query service status
Start service

Disassembly:
push ebp
lea ebp, [esp - 0x304]
sub esp, 0x384
mov eax, dword [0x52472c]
xor eax, ebp
mov dword [ebp + 0x300], eax
push esi
push edi
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0xc], 1
jne 0x48558b
push 0x500018
push str.SAGEWINDOWCLASS
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x485513
xor eax, eax
jmp 0x4855ee
push 0x44
pop esi
push esi
xor edi, edi
lea eax, [ebp - 0x80]
push edi
push eax
call fcn.004b4140
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp + 0xf8]
push eax
push 0x104
push edi
push str.mstask.exe
push edi
mov dword [ebp - 0x80], esi
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x485555
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4855ee
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x80]
push eax
push edi
push edi
push 0x210
push edi
push edi
push edi
push edi
lea eax, [ebp + 0xf8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x48554a
push dword [ebp - 0x30]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x2c]
call esi
jmp 0x48550c
push 1
xor edi, edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
cmp esi, edi
je 0x48554a
push ebx
push 0x14
push str.Schedule
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, eax
call esi
cmp ebx, edi
je 0x4855e0
lea eax, [ebp - 0x3c]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4855dd
cmp dword [ebp - 0x38], 4
je 0x4855e8
push edi
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x4855e8
push ebx
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4855ed
push ebx
call esi
xor eax, eax
pop ebx
mov ecx, dword [ebp + 0x300]
pop edi
xor ecx, ebp
pop esi
call fcn.004b1fae
add ebp, 0x304
leave
ret
Function at 0x485ba6
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, eax
test edi, edi
je 0x485bba
add edi, 0xffffffc0
jmp 0x485bbc
xor edi, edi
push dword [ebp + 8]
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push dword [edi + 4]
mov dword [ebp - 0xc], 1
call ebx
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
or dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], eax
push eax
mov eax, dword [ebp + 0xc]
call fcn.004274a1
test eax, eax
je 0x485c09
mov ecx, dword [ebp - 4]
inc ecx
push ecx
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], eax
or eax, 0xffffffff
call fcn.00402961
mov eax, dword [ebp - 4]
cmp dword [ebp - 8], eax
jge 0x485c3a
and dword [ebp - 0xc], 0
push 0xffffffffffffffff
add edi, 0x40
call dword [sym.imp.USER32.dll_MessageBeep]
test edi, edi
je 0x485c29
lea eax, [edi - 0x40]
jmp 0x485c2b
xor eax, eax
push dword [ebp + 8]
push dword [eax + 4]
call ebx
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x486079
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push esi
call fcn.004723b9
test eax, eax
je 0x486116
lea eax, [esp + 8]
push eax
xor esi, esi
push 0x28
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4860c6
cmp dword [esp + 8], esi
je 0x4860c2
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x48612d
lea eax, [esp + 0x14]
push eax
push str.SeShutdownPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push esi
push esi
push esi
lea eax, [esp + 0x1c]
push eax
push esi
push dword [esp + 0x1c]
mov dword [esp + 0x28], 1
mov dword [esp + 0x34], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4860b2
cmp dword [esp + 8], esi
je 0x48611b
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x48611b
call fcn.00486132
push 0x80040002
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
setne al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x486132
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x52472c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
push 0x5000fc
push ebx
call esi
test eax, eax
je 0x486270
push 0
push 2
call eax
mov dword [ebp - 0x248], eax
cmp eax, 0xffffffff
jne 0x486188
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x486270
push str._WindowsFolder_explorer.exe
lea eax, [ebp - 0x23c]
push eax
call fcn.004054bc
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x23c]
call fcn.00477d83
pop ecx
lea ecx, [ebp - 0x23c]
call fcn.004029ae
push 0x5000ec
push ebx
call esi
push 0x5000dc
push ebx
mov edi, eax
call esi
push 0x228
mov dword [ebp - 0x23c], eax
lea eax, [ebp - 0x234]
push 0
push eax
call fcn.004b4140
add esp, 0xc
lea eax, [ebp - 0x238]
push eax
push dword [ebp - 0x248]
mov dword [ebp - 0x238], 0x22c
call edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x486250
lea eax, [ebp - 0x240]
push eax
lea ecx, [ebp - 0x214]
call fcn.00461660
test eax, eax
jne 0x48623d
push dword [ebp - 0x230]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test esi, esi
je 0x48623d
push esi
call edi
lea eax, [ebp - 0x238]
push eax
push dword [ebp - 0x248]
call dword [ebp - 0x23c]
test eax, eax
jne 0x486206
lea ecx, [ebp - 0x240]
call fcn.004029ae
cmp dword [ebp - 0x248], 0
je 0x486270
push dword [ebp - 0x248]
call edi
test ebx, ebx
je 0x48627b
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b1fae
leave
ret

Function at 0x488207
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
push 0x3f7
push dword [esi + 4]
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call ebx
push 0x3eb
push dword [esi + 4]
call edi
push 0
push eax
mov dword [ebp - 4], eax
call ebx
push 0x3ec
push dword [esi + 4]
call edi
xor edi, edi
push edi
push eax
call ebx
mov ebx, dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x14]
push eax
add esi, 0x88
push dword [esi]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
call ebx
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 4]
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
call ebx
mov eax, dword [ebp - 0x18]
push 0x222
push edi
mov dword [ebp - 8], eax
push esi
lea eax, [ebp - 0x14]
call fcn.004024e8
pop edi
pop esi
pop ebx
leave
ret