joyce8/EMBER2024-capa huggingface dataset:
Function at 0x465d8c
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x14], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x465f53
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.00403034
cmp word [ebx + 0xa2], 0
je 0x465dd7
mov edx, ebx
mov eax, dword [ebx + 0xa4]
call dword [ebx + 0xa0]
mov eax, dword [ebx + 0x94]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jle 0x465dee
lea eax, [ebp - 4]
mov dword [ebp - 0xc], eax
jmp 0x465df3
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebx + 0x84], 0
jne 0x465e03
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x465e11
mov eax, dword [ebx + 0x84]
call fcn.00405578
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x80]
call fcn.00405578
push eax
mov eax, dword [ebp - 0x10]
push eax
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.004654ac
mov eax, dword [ebp - 0x18]
call fcn.00405578
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebx + 0x78]
call fcn.00405578
push eax
push dword [ebp - 0x14]
push 0x465f6c
push dword [ebx + 0x58]
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00405438
mov eax, dword [ebp - 0x1c]
call fcn.00405578
push eax
mov eax, ebx
call fcn.004655f8
push eax
mov eax, ebx
call fcn.004655cc
push eax
mov eax, ebx
call fcn.00465580
push eax
push 0xf01ff
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.00465370
mov eax, dword [ebp - 0x20]
call fcn.00405578
push eax
mov eax, dword [ebx + 8]
call fcn.00405578
push eax
push esi
call sub.advapi32.dll_CreateServiceA
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [ebx + 0x94], eax
cmp dword [ebp - 8], 0
jne 0x465eb8
call fcn.0040f6f0
xor edx, edx
push ebp
push 0x465f31
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x465ef6
push dword fs:[edx]
mov dword fs:[edx], esp
cmp word [ebx + 0xaa], 0
je 0x465eec
mov edx, ebx
mov eax, dword [ebx + 0xac]
call dword [ebx + 0xa8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x465f1a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x465f38
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret

Function at 0x465f70
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp word [eax + 0xb2], 0
je 0x465f9c
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0xb4]
call dword [esi + 0xb0]
push 0xf01ff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00405578
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x465fc1
call fcn.0040f6f0
xor eax, eax
push ebp
push 0x465ff8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_DeleteService
test eax, eax
jne 0x465fe1
call fcn.0040f6f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x465fff
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
Function at 0x46798c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov byte [ebp - 1], cl
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.004037dc
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 1
mov ax, word [ebp + 0xc]
mov word [ebp - 0x18], ax
test ebx, ebx
je 0x4679ee
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push edi
push 0
push 0
push 0
push 0
push 0
push esi
push 0
push ebx
call sub.advapi32.dll_CreateProcessAsUserA
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
jmp 0x467a0f
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push edi
push 0
push 0x30
push 0
push 0
push 0
push esi
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x467a36
cmp byte [ebp - 1], 0
je 0x467a24
push 0xffffffffffffffff
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x46891c
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.004050b8
xor eax, eax
push ebp
push 0x4689b8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xff
call fcn.00402b54
mov dword [ebp - 4], eax
push 0xff
mov eax, dword [ebp - 4]
push eax
call sub.wsock32.dll_gethostname
mov eax, dword [ebp - 4]
cmp byte [eax], 0
je 0x468990
mov eax, dword [ebp - 4]
push eax
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x468982
mov eax, ebx
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call fcn.004052b0
jmp 0x46899c
mov eax, ebx
mov edx, 0x4689cc
call fcn.0040510c
jmp 0x46899c
mov eax, ebx
mov edx, 0x4689cc
call fcn.0040510c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4689bf
cmp dword [ebp - 4], 0
je 0x4689b7
mov eax, dword [ebp - 4]
call fcn.00402b84
ret

Function at 0x4689d8
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x468a56
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xff
call fcn.00402b54
mov dword [ebp - 8], eax
push 0xff
mov eax, dword [ebp - 8]
push eax
call sub.wsock32.dll_gethostname
mov eax, dword [ebp - 8]
push eax
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x468a2d
push 0x7f000001
call sub.wsock32.dll_htonl
mov dword [ebp - 4], eax
jmp 0x468a3a
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x468a5d
cmp dword [ebp - 8], 0
je 0x468a55
mov eax, dword [ebp - 8]
call fcn.00402b84
ret
Function at 0x468b24
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, eax
or ebx, 0xffffffff
xor edx, edx
push ebp
push 0x468ba1
push dword fs:[edx]
mov dword fs:[edx], esp
test esi, esi
jne 0x468b50
mov eax, ebx
pop dword fs:[0]
add esp, 8
jmp 0x468bb0
mov eax, esi
call fcn.00405578
mov edi, eax
push edi
call sub.wsock32.dll_inet_addr
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x468b97
push edi
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x468b7f
mov eax, dword [ebp - 4]
cmp word [eax + 0xa], 0
jg 0x468b8d
mov eax, ebx
pop dword fs:[0]
add esp, 8
jmp 0x468bb0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ebx, dword [eax]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x468bae
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x468bb8
Capabilities:
Initialize winsock library

Disassembly:
add esp, 0xfffffe70
mov byte [0x4ddc80], 0
mov eax, sub.wsock32.dll_WSAStartup
test eax, eax
je 0x468bef
push esp
push 0x101
call sub.wsock32.dll_WSAStartup
sub eax, 0x2726
je 0x468bef
add eax, 0xffffffbb
sub eax, 2
jb 0x468bef
mov byte [0x4ddc80], 1
add esp, 0x190
ret

Function at 0x4692f8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x4693bd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.004050b8
mov eax, edi
call fcn.00405378
test al, al
jbe 0x469362
mov byte [ebp - 5], al
mov bl, 1
xor eax, eax
mov al, bl
mov ecx, 0xb
xor edx, edx
div ecx
mov dl, byte [edx + 0x4db224]
xor eax, eax
mov al, bl
xor dl, byte [edi + eax - 1]
lea eax, [ebp - 0xc]
call fcn.004052a0
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.00405380
inc ebx
dec byte [ebp - 5]
jne 0x46932e
mov eax, esi
call fcn.004050b8
mov eax, dword [ebp - 4]
call fcn.00405378
mov ebx, eax
cmp bl, 1
jb 0x46939a
xor eax, eax
mov al, bl
mov edx, dword [ebp - 4]
mov al, byte [edx + eax - 1]
lea edx, [ebp - 0x10]
call fcn.004695b4
mov edx, dword [ebp - 0x10]
mov eax, esi
call fcn.00405380
dec ebx
test bl, bl
jne 0x469378
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4693c4
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004050dc
lea eax, [ebp - 4]
call fcn.004050b8
ret
Function at 0x4693cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x4694bf
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.004050b8
mov bl, 1
jmp 0x46943f
lea eax, [ebp - 0x14]
push eax
xor edx, edx
mov dl, bl
mov ecx, 2
mov eax, edi
call fcn.004055d8
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 0x4694d8
call fcn.004053c4
mov eax, dword [ebp - 0x10]
call fcn.00409ebc
mov edx, eax
lea eax, [ebp - 0xc]
call fcn.004052a0
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
call fcn.004053c4
add bl, 2
mov eax, edi
call fcn.00405378
xor edx, edx
mov dl, bl
cmp eax, edx
jg 0x4693f8
mov eax, esi
call fcn.004050b8
mov eax, dword [ebp - 4]
call fcn.00405378
test al, al
jbe 0x46949c
mov byte [ebp - 5], al
mov bl, 1
xor eax, eax
mov al, bl
mov ecx, 0xb
xor edx, edx
div ecx
mov dl, byte [edx + 0x4db230]
xor eax, eax
mov al, bl
mov ecx, dword [ebp - 4]
xor dl, byte [ecx + eax - 1]
lea eax, [ebp - 0x18]
call fcn.004052a0
mov edx, dword [ebp - 0x18]
mov eax, esi
call fcn.00405380
inc ebx
dec byte [ebp - 5]
jne 0x469466
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4694c6
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.004050dc
lea eax, [ebp - 4]
call fcn.004050b8
ret

Function at 0x46a2cc
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push 0x105
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.00405328
mov eax, dword [ebx]
call fcn.00405378
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
jne 0x46a313
mov eax, dword [ebx]
call fcn.00405378
mov edx, eax
dec edx
mov eax, ebx
call fcn.00405704
add esp, 0x108
pop ebx
ret

Function at 0x46a31c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push 0x105
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.00405328
mov eax, dword [ebx]
call fcn.00405378
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
jne 0x46a363
mov eax, dword [ebx]
call fcn.00405378
mov edx, eax
dec edx
mov eax, ebx
call fcn.00405704
add esp, 0x108
pop ebx
ret

Function at 0x46c7e8
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.004037dc
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret
Function at 0x46dcc8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 8]
dec ecx
test ecx, ecx
jl 0x46dced
inc ecx
xor esi, esi
mov bl, byte [eax + esi]
xor bl, byte [edx + esi]
mov edi, dword [ebp - 4]
mov byte [edi + esi], bl
inc esi
dec ecx
jne 0x46dcdd
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4

Function at 0x46df2c
Capabilities:
Encrypt data using twofish

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov dword [esp + 4], ecx
mov dword [esp], eax
mov ebx, dword [esp]
and ebx, 0xff
mov ecx, dword [esp]
shr ecx, 8
and ecx, 0xff
mov eax, dword [esp]
shr eax, 0x10
and eax, 0xff
mov esi, dword [esp]
shr esi, 0x18
mov dword [esp + 8], esi
cmp dword [esp + 4], 0x100
jne 0x46dfbd
movzx ebx, byte [ebx + 0x4db734]
mov esi, dword [edx + 0xc]
mov edi, esi
and edi, 0xff
xor ebx, edi
movzx ecx, byte [ecx + 0x4db634]
mov edi, esi
shr edi, 8
and edi, 0xff
xor ecx, edi
movzx eax, byte [eax + 0x4db634]
mov edi, esi
shr edi, 0x10
and edi, 0xff
xor eax, edi
mov edi, dword [esp + 8]
movzx edi, byte [edi + 0x4db734]
shr esi, 0x18
xor edi, esi
mov dword [esp + 8], edi
cmp dword [esp + 4], 0xc0
jl 0x46e017
movzx ebx, byte [ebx + 0x4db734]
mov esi, dword [edx + 8]
mov edi, esi
and edi, 0xff
xor ebx, edi
movzx ecx, byte [ecx + 0x4db734]
mov edi, esi
shr edi, 8
and edi, 0xff
xor ecx, edi
movzx eax, byte [eax + 0x4db634]
mov edi, esi
shr edi, 0x10
and edi, 0xff
xor eax, edi
mov edi, dword [esp + 8]
movzx edi, byte [edi + 0x4db634]
shr esi, 0x18
xor edi, esi
mov dword [esp + 8], edi
movzx ebx, byte [ebx + 0x4db634]
mov esi, dword [edx + 4]
and esi, 0xff
xor ebx, esi
movzx ebx, byte [ebx + 0x4db634]
mov esi, dword [edx]
and esi, 0xff
xor ebx, esi
mov ebx, dword [ebx*4 + 0x4ddccc]
movzx ecx, byte [ecx + 0x4db734]
mov esi, dword [edx + 4]
shr esi, 8
and esi, 0xff
xor ecx, esi
movzx ecx, byte [ecx + 0x4db634]
mov esi, dword [edx]
shr esi, 8
and esi, 0xff
xor ecx, esi
xor ebx, dword [ecx*4 + 0x4de0cc]
movzx eax, byte [eax + 0x4db634]
mov ecx, dword [edx + 4]
shr ecx, 0x10
and ecx, 0xff
xor eax, ecx
movzx eax, byte [eax + 0x4db734]
mov ecx, dword [edx]
shr ecx, 0x10
and ecx, 0xff
xor eax, ecx
xor ebx, dword [eax*4 + 0x4de4cc]
mov eax, dword [esp + 8]
movzx eax, byte [eax + 0x4db734]
mov ecx, dword [edx + 4]
shr ecx, 0x18
xor eax, ecx
movzx eax, byte [eax + 0x4db734]
mov edx, dword [edx]
shr edx, 0x18
xor eax, edx
xor ebx, dword [eax*4 + 0x4de8cc]
mov eax, ebx
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x46e618
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
xor ebx, ebx
mov esi, dword [edx + ebx*4]
mov edi, ecx
and edi, 0xff
imul edi, edi, 0x1010101
xor esi, edi
mov dword [eax + ebx*4], esi
inc ebx
cmp ebx, 0x40
jne 0x46e61d
pop edi
pop esi
pop ebx
ret

Function at 0x46f598
Capabilities:
Encrypt data using twofish

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov dword [esp + 0x18], pe_nt_image_headers32
mov esi, 0x4db634
mov ebx, 0x4ddccc
movzx edi, byte [esi]
mov dword [esp], edi
mov eax, edi
call fcn.0046de48
mov dword [esp + 8], eax
mov eax, edi
call fcn.0046de58
mov dword [esp + 0x10], eax
movzx edi, byte [esi + 0x100]
mov dword [esp + 4], edi
mov eax, edi
call fcn.0046de48
mov dword [esp + 0xc], eax
mov eax, edi
call fcn.0046de58
mov ebp, eax
mov dword [esp + 0x14], ebp
mov eax, edi
mov edx, dword [esp + 0xc]
shl edx, 8
or eax, edx
mov edx, ebp
shl edx, 0x10
or eax, edx
mov edx, ebp
shl edx, 0x18
or eax, edx
mov dword [ebx], eax
mov eax, dword [esp + 0x10]
mov edx, eax
mov ecx, eax
shl ecx, 8
or edx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x10
or edx, ecx
mov ecx, dword [esp]
shl ecx, 0x18
or edx, ecx
mov dword [ebx + 0x400], edx
mov edx, dword [esp + 0xc]
shl ebp, 8
or edx, ebp
shl edi, 0x10
or edx, edi
mov ecx, dword [esp + 0x14]
shl ecx, 0x18
or edx, ecx
mov dword [ebx + 0x800], edx
mov edx, dword [esp + 8]
mov ecx, dword [esp]
shl ecx, 8
or edx, ecx
shl eax, 0x10
or edx, eax
mov eax, dword [esp + 8]
shl eax, 0x18
or edx, eax
mov dword [ebx + 0xc00], edx
add ebx, 4
inc esi
dec dword [esp + 0x18]
jne 0x46f5b1
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x47129c
Capabilities:
Connect network resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4713a9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x20
call fcn.004037dc
xor eax, eax
mov dword [ebp - 0x24], eax
test ebx, ebx
je 0x471311
lea eax, [ebp - 0x2c]
push eax
mov ecx, 2
mov edx, 1
mov eax, ebx
call fcn.004055d8
mov eax, dword [ebp - 0x2c]
mov edx, 0x4713c4
call fcn.004054c4
je 0x471311
lea eax, [ebp - 8]
mov ecx, ebx
mov edx, 0x4713c4
call fcn.004053c4
jmp 0x47131b
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00405150
lea eax, [ebp - 4]
mov edx, edi
call fcn.00405150
mov eax, dword [ebp - 8]
call fcn.00405578
mov edi, eax
mov dword [ebp - 0x14], edi
push 0
mov eax, dword [ebp - 4]
call fcn.00405578
push eax
mov eax, esi
call fcn.00405578
push eax
lea eax, [ebp - 0x28]
push eax
call sub.mpr.dll_WNetAddConnection2A
mov ebx, eax
cmp ebx, 0x4c3
sete al
and al, byte [ebp + 8]
je 0x471386
push 0
push 0
push edi
call sub.mpr.dll_WNetCancelConnection2A
push 0
mov eax, dword [ebp - 4]
call fcn.00405578
push eax
mov eax, esi
call fcn.00405578
push eax
lea eax, [ebp - 0x28]
push eax
call sub.mpr.dll_WNetAddConnection2A
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4713b0
lea eax, [ebp - 0x2c]
call fcn.004050b8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004050dc
ret

Function at 0x47145c
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x47155f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.004050b8
mov cl, 1
mov edx, 0x471578
xor eax, eax
call fcn.004713c8
sub bl, 1
jb 0x4714a5
je 0x4714a9
dec bl
je 0x4714b0
dec bl
je 0x4714b7
jmp 0x4714bc
xor esi, esi
jmp 0x4714bc
mov esi, 2
jmp 0x4714bc
mov esi, 1
jmp 0x4714bc
mov esi, 8
cmp byte [ebp - 1], 0
je 0x4714de
mov eax, dword [0x4dcf28]
cmp dword [eax], 2
jne 0x4714db
mov eax, dword [0x4dc96c]
cmp dword [eax], 5
jl 0x4714db
or esi, 0x10
jmp 0x4714de
or esi, 4
push 0x40000
push esi
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x471517
cmp byte [ebp - 1], 0
je 0x471517
mov eax, dword [0x4dcf28]
cmp dword [eax], 2
jne 0x471517
or esi, 4
push 0x40000
push esi
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x47153b
call sub.kernel32.dll_GetLastError_1
test eax, eax
je 0x47153b
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 8]
call fcn.004675b4
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.0040510c
mov edx, 0x471578
xor ecx, ecx
xor eax, eax
call fcn.004713c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x471566
lea eax, [ebp - 8]
call fcn.004050b8
ret
Function at 0x47158c
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x47165c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.004050b8
xor ebx, ebx
mov eax, dword [0x4dcf28]
cmp dword [eax], 2
je 0x4715d3
mov eax, dword [ebp + 8]
mov edx, 0x471678
call fcn.0040510c
jmp 0x471646
mov eax, esi
call fcn.00405578
mov edi, eax
mov eax, edi
mov cl, 1
mov edx, 0x47169c
call fcn.004713c8
cmp byte [ebp + 0x10], 1
cmc
sbb eax, eax
push eax
cmp byte [ebp + 0xc], 1
cmc
sbb eax, eax
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00405578
push eax
push edi
call sub.advapi32.dll_InitiateSystemShutdownA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x471638
call sub.kernel32.dll_GetLastError_1
test eax, eax
je 0x471638
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0xc]
call fcn.004675b4
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
call fcn.0040510c
push edi
mov edx, 0x47169c
xor ecx, ecx
pop eax
call fcn.004713c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x471663
lea eax, [ebp - 0xc]
call fcn.004050b8
ret
Function at 0x472714
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov byte [ebp - 0xd], 0
lea eax, [ebp - 0x64]
xor ecx, ecx
mov edx, 0x44
call fcn.004037dc
mov dword [ebp - 0x64], 0x44
mov dword [ebp - 0x38], 1
mov ax, word [ebp - 0xc]
mov word [ebp - 0x34], ax
test ebx, ebx
jne 0x472764
test esi, esi
jne 0x472764
test edi, edi
je 0x4727a8
add dword [ebp - 0x38], 0x100
test ebx, ebx
je 0x472774
mov dword [ebp - 0x2c], ebx
jmp 0x47277e
push 0xfffffffffffffff6
call sub.kernel32.dll_GetStdHandle_1
mov dword [ebp - 0x2c], eax
test esi, esi
je 0x472787
mov dword [ebp - 0x28], esi
jmp 0x472791
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
mov dword [ebp - 0x28], eax
test edi, edi
je 0x47279a
mov dword [ebp - 0x24], edi
jmp 0x4727a4
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
mov dword [ebp - 0x24], eax
mov bl, 1
jmp 0x4727aa
xor ebx, ebx
cmp dword [0x4db938], 0
je 0x4727f1
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebp - 8]
call fcn.00405578
push eax
push 0
push 0
cmp bl, 1
cmc
sbb eax, eax
push eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405578
push eax
push 0
mov eax, dword [0x4db938]
push eax
call sub.advapi32.dll_CreateProcessAsUserA
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x472827
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebp - 8]
call fcn.00405578
push eax
push 0
push 0
cmp bl, 1
cmc
sbb eax, eax
push eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405578
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x472898
cmp dword [ebp + 0x18], 0
jne 0x472838
mov dword [ebp + 0x18], 0xffffffff
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
jne 0x472870
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_GetExitCodeProcess
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
jne 0x472884
mov eax, dword [ebp + 0x14]
mov dword [eax], 0xfffffffd
jmp 0x472884
push 0
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_TerminateProcess
mov eax, dword [ebp + 0x14]
mov dword [eax], 0xfffffffe
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x4728a1
mov eax, dword [ebp + 0x14]
mov dword [eax], 0xffffffff
mov al, byte [ebp - 0xd]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14