joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54507db0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x54539538
push 0x54517db0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x5454141c]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
xor edi, edi
xor esi, esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x30], edi
push 1
push str.SeDebugPrivilege
call fcn.54514fd0
add esp, 8
test eax, eax
jne 0x54507e2a
push str.EnableDebugPriv___to_failed__n
call fcn.54517f46
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], edi
push str.LSASS.EXE
call fcn.54507480
add esp, 4
cmp eax, edi
jne 0x54507e50
push str.GetProcessId___to_failed__n
call fcn.54517f46
add esp, 4
jmp 0x54507f1e
push eax
push edi
push 0x410
call dword [0x5454285c]
mov esi, eax
mov dword [ebp - 0x2c], esi
cmp esi, edi
jne 0x54507e7c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenProcess_failed_with__d._n
call fcn.54517f46
jmp 0x54507f1b
lea eax, [ebp - 0x1c]
push eax
push 0x60000
push esi
mov ebx, dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call ebx
cmp eax, edi
jne 0x54507ea5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenProcessToken_failed_with__d._n
call fcn.54517f46
jmp 0x54507f1b
lea ecx, [ebp - 0x20]
push ecx
push 0xf01ff
mov edx, dword [ebp - 0x1c]
push edx
call fcn.545078e0
add esp, 0xc
cmp eax, edi
je 0x54507f1e
lea eax, [ebp - 0x24]
push eax
push 0xf01ff
push esi
call ebx
cmp eax, edi
je 0x54507e92
lea ecx, [ebp - 0x28]
push ecx
push 1
push 2
push edi
push 0xf01ff
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x54507efd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.DuplicateTokenEx_____d_n
call fcn.54517f46
jmp 0x54507f1b
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call fcn.545078a0
mov dword [ebp - 0x30], 1
add esp, 8
mov dword [ebp - 4], 0xfffffffe
call fcn.54507f44
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x54507f44
Capabilities:
Acquire debug privileges

Disassembly:
push edi
push str.SeDebugPrivilege
call fcn.54514fd0
add esp, 8
cmp esi, edi
je 0x54507f5d
push esi
call dword [0x54542850]
mov eax, dword [ebp - 0x24]
cmp eax, edi
je 0x54507f6b
push eax
call dword [0x54542850]
mov eax, dword [ebp - 0x1c]
cmp eax, edi
je 0x54507f79
push eax
call dword [0x54542850]
mov eax, dword [ebp - 0x28]
cmp eax, edi
je 0x54507f87
push eax
call dword [0x54542850]
mov eax, dword [ebp - 0x20]
cmp eax, edi
je 0x54507f98
push eax
call dword [0x545428d8]
mov dword [ebp - 0x20], edi
ret
Function at 0x54507fb0
Capabilities:
Create process on windows
Impersonate user

Disassembly:
sub esp, 0x58
push 0x44
lea eax, [esp + 0x18]
push 0
push eax
mov dword [esp + 0xc], 0
call fcn.54516b80
add esp, 0xc
mov dword [esp + 0x14], 0x44
call fcn.54507db0
test eax, eax
jne 0x54507ff0
push str.ImpersonateSystem___to_failed__n
call fcn.54517f46
add esp, 4
xor eax, eax
add esp, 0x58
ret
mov edx, dword [esp + 0x60]
mov eax, dword [esp + 0x5c]
push esi
lea ecx, [esp + 4]
push ecx
push 0
push 2
push edx
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_LogonUserA]
mov esi, eax
test esi, esi
je 0x5450806c
mov eax, dword [esp + 0x68]
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 8]
lea edx, [esp + 0x1c]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
mov esi, eax
test esi, esi
jne 0x54508056
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateProcessAsUser_____d_n
call fcn.54517f46
add esp, 8
jmp 0x5450806c
mov edx, dword [esp + 8]
push edx
call dword [0x54542850]
mov eax, dword [esp + 0xc]
push eax
call dword [0x54542850]
mov eax, dword [esp + 4]
test eax, eax
je 0x5450807b
push eax
call dword [0x54542850]
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov eax, esi
pop esi
add esp, 0x58
ret
Function at 0x54508e50
Capabilities:
Create service

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 0xc]
push esi
mov esi, ecx
mov ecx, dword [esp + 0xc]
push 0xf003f
push 0
push 0
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test eax, eax
mov dword [esi + 0x14], eax
jne 0x54508e8c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
xor eax, eax
pop esi
ret 0xc
mov ecx, dword [esi + 4]
mov edx, dword [esi + 0xc]
push 0
push 0
push 0
push 0
push 0
push ecx
mov ecx, dword [esi + 8]
push 1
push 3
push 1
push 0xf01ff
push edx
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
test eax, eax
mov dword [esi + 0x18], eax
jne 0x54508f04
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
mov dword [esi], eax
jne 0x54508ef4
mov edx, dword [esi + 8]
mov eax, dword [esi + 0x14]
push 0xf01ff
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
test eax, eax
mov dword [esi + 0x18], eax
jne 0x54508f04
mov ecx, dword [esi + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
pop esi
ret 0xc
mov edx, dword [esi + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
pop esi
ret 0xc
mov eax, 1
pop esi
ret 0xc

Function at 0x54509010
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
lea ecx, [eax - 1]
test ecx, ecx
mov byte [esp + 8], al
jl 0x5450904c
push ebx
push esi
mov esi, dword [esp + 0xc]
xor byte [ecx + esi], al
mov al, cl
mov bl, 0xb
imul bl
mov dl, cl
and dl, 0xf
add dl, 0x55
xor dl, al
xor dl, byte [esp + 0x10]
xor dl, 0xaa
sub ecx, 1
mov al, dl
mov byte [esp + 0x10], al
jns 0x54509025
pop esi
pop ebx
ret

Function at 0x54509050
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret

Function at 0x54509500
Capabilities:
Check os version

Disassembly:
sub esp, 0x98
mov eax, dword [0x5454141c]
xor eax, esp
mov dword [esp + 0x94], eax
lea eax, [esp]
push eax
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x545095ae
cmp dword [esp + 0x10], 2
jne 0x545095ae
cmp dword [esp + 4], 5
jne 0x545095ae
cmp dword [0x5454000c], 0
je 0x545095ae
mov eax, 0x5453ffd0
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x54509550
sub eax, edx
push eax
push 0x5453ffd0
call fcn.54509010
mov eax, 0x5453ffdc
add esp, 8
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x54509571
sub eax, edx
push eax
push 0x5453ffdc
call fcn.54509010
add esp, 8
mov dword [0x5454000c], 0
call fcn.54509330
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.54516b6f
add esp, 0x98
ret
mov ecx, dword [esp + 0x94]
xor ecx, esp
xor eax, eax
call fcn.54516b6f
add esp, 0x98
ret
Function at 0x5450a120
Capabilities:
Create thread
Get socket status

Disassembly:
sub esp, 0x110
mov ecx, dword [0x54544208]
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
push eax
push 0x8004667e
xor edi, edi
push ecx
mov dword [esp + 0x20], 1
mov dword [esp + 0x1c], edi
call dword [0x54542c24]
mov ebp, dword [sym.imp.WS2_32.dll_select]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x5450a160
mov edx, dword [0x54544208]
push edi
push edi
push edi
lea eax, [esp + 0x28]
push eax
push edi
mov dword [esp + 0x34], edx
mov dword [esp + 0x30], 1
call ebp
test eax, eax
jle 0x5450a1f2
mov ecx, dword [0x54544208]
push edi
push edi
push ecx
call dword [0x54542c20]
push 0x54543208
mov esi, eax
push 0x54544218
push esi
call fcn.545159f0
add esp, 0xc
test eax, eax
jne 0x5450a1b2
push esi
call dword [0x54542c28]
jmp 0x5450a160
lea edx, [esp + 0x10]
push edx
push 0x8004667e
push esi
call dword [0x54542c24]
push 8
call fcn.54518434
add esp, 4
cmp eax, edi
je 0x5450a160
lea ecx, [esp + 0x18]
push ecx
push edi
push eax
push 0x54509ce0
push edi
push edi
mov dword [eax], esi
mov dword [eax + 4], edi
call ebx
push eax
call dword [0x54542850]
jmp 0x5450a160
cmp dword [0x5454420c], edi
jle 0x5450a213
lea ebx, [ebx]
push 0x1f4
call dword [0x545428b4]
cmp dword [0x5454420c], edi
jg 0x5450a200
mov dword [0x54544208], edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret

Function at 0x5450b000
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [esp + 8]
lea eax, [esp + 8]
push eax
push 0
push esi
push 0x5450ae20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x5450b031
push eax
mov ecx, esi
call fcn.5450a760
mov eax, 1
pop esi
ret 4
xor eax, eax
pop esi
ret 4

Function at 0x5450b040
Capabilities:
Create thread

Disassembly:
mov ecx, dword [esp + 4]
lea eax, [esp + 4]
push eax
push 0
push ecx
push 0x5450af00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x5450b06e
push eax
call dword [0x54542850]
mov eax, 1
ret 4
xor eax, eax
ret 4

Function at 0x5450b3e0
Capabilities:
Create thread

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
push eax
push 0
mov esi, ecx
push esi
push 0x5450b080
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x5450b3da
mov dword [esi + 0x1c], eax
mov eax, 1
pop esi
pop ecx
ret
xor eax, eax
pop esi
pop ecx
ret
mov dword [ecx + 0x54], 0
jmp 0x5450b3b0
Function at 0x5450d9a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5452fcf7
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5454141c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
lea ecx, [esi + 0x14]
call fcn.5450f180
lea ecx, [esi + 0x24]
mov dword [esp + 0x14], 0
call fcn.5450bb30
lea ecx, [esi + 0x30]
mov byte [esp + 0x14], 1
call fcn.5450bd40
lea ecx, [esi + 0x48]
mov byte [esp + 0x14], 2
call fcn.5450ba40
lea ecx, [esi + 0x5c]
mov byte [esp + 0x14], 3
call fcn.5450ce00
lea ecx, [esi + 0x514]
mov byte [esp + 0x14], 4
call fcn.5450f180
mov eax, dword [esp + 0x1c]
mov dword [esi], eax
xor eax, eax
mov dword [esi + 0xc], 1
mov dword [esi + 0x10], 9
mov byte [esi + 0x510], 1
mov byte [esi + 0x511], 0
mov dword [esi + 0x524], eax
mov dword [esi + 0x528], eax
mov dword [esi + 0x52c], eax
mov dword [esi + 0x530], eax
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4

Function at 0x5450da70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5452fd57
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5454141c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
lea ecx, [esi + 0x514]
mov dword [esp + 0x14], 4
call fcn.5450f1a0
lea ecx, [esi + 0x5c]
mov byte [esp + 0x14], 3
call fcn.5450c010
lea ecx, [esi + 0x48]
mov byte [esp + 0x14], 2
call fcn.54529470
lea ecx, [esi + 0x30]
mov byte [esp + 0x14], 1
call fcn.54529470
lea ecx, [esi + 0x24]
mov byte [esp + 0x14], 0
call fcn.5450bb40
lea ecx, [esi + 0x14]
mov dword [esp + 0x14], 0xffffffff
call fcn.5450f1a0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x5450db00
Capabilities:
Open clipboard
Read clipboard data
Write clipboard data

Disassembly:
push esi
push edi
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x5450dbd2
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, dword [esp + 0xc]
mov edi, eax
test edi, edi
je 0x5450db6e
push edi
call dword [0x545428cc]
mov ecx, esi
lea ecx, [ecx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x5450db50
test dl, dl
je 0x5450db4c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x5450db50
add eax, 2
add ecx, 2
test dl, dl
jne 0x5450db30
xor eax, eax
jmp 0x5450db55
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
push edi
jne 0x5450db68
call dword [0x545428d0]
pop edi
pop esi
jmp dword [sym.imp.USER32.dll_CloseClipboard]
call dword [0x545428d0]
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x5450dbd2
mov eax, esi
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x5450db80
sub eax, edx
add eax, 1
push eax
push 0x2002
call dword [0x545428c4]
mov edi, eax
test edi, edi
je 0x5450dbd2
push edi
call dword [0x545428cc]
mov cl, byte [esi]
mov byte [eax], cl
add esi, 1
add eax, 1
test cl, cl
jne 0x5450dba7
push edi
call dword [0x545428d0]
push edi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
push str.SetClipboardData__r_n
call fcn.54517f46
add esp, 4
pop edi
pop esi
jmp dword [sym.imp.USER32.dll_CloseClipboard]

Function at 0x5450ddc0
Capabilities:
Log keystrokes

Disassembly:
xor eax, eax
cmp byte [esp + 4], al
jne 0x5450ddcd
mov eax, 2
test al, 2
push esi
mov esi, dword [esp + 0xc]
je 0x5450deb1
cmp esi, 0xa0
je 0x5450de8c
cmp esi, 0xa1
je 0x5450de8c
cmp esi, 0xa2
je 0x5450de67
cmp esi, 0xa3
je 0x5450de67
cmp esi, 0xa4
je 0x5450de42
cmp esi, 0xa5
je 0x5450de42
cmp esi, 0x5b
je 0x5450de20
cmp esi, 0x5c
jne 0x5450deb1
push 2
push 0x5b
call fcn.5450dda0
add esp, 8
pop esi
mov dword [esp + 8], 2
mov dword [esp + 4], 0x5c
jmp fcn.5450dda0
push 2
push 0xa4
call fcn.5450dda0
add esp, 8
pop esi
mov dword [esp + 8], 2
mov dword [esp + 4], 0xa5
jmp fcn.5450dda0
push 2
push 0xa2
call fcn.5450dda0
add esp, 8
pop esi
mov dword [esp + 8], 2
mov dword [esp + 4], 0xa3
jmp fcn.5450dda0
push 2
push 0xa0
call fcn.5450dda0
add esp, 8
pop esi
mov dword [esp + 8], 2
mov dword [esp + 4], 0xa1
jmp fcn.5450dda0
push 0
push eax
push 0
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push esi
call dword [sym.imp.USER32.dll_keybd_event]
pop esi
ret
Function at 0x5450ea70
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x545397b8
push 0x54517db0
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x5454141c]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x2c], 8
xor esi, esi
mov dword [ebp - 0x20], esi
push esi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x5450ebee
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
mov dword [ebp - 0x24], edi
test edi, edi
jne 0x5450eaff
call dword [sym.imp.USER32.dll_CloseClipboard]
push 0
push 0
push 4
mov ecx, ebx
call fcn.5450dff0
neg eax
sbb eax, eax
neg eax
sub eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
call dword [0x545428cc]
mov dword [ebp - 0x28], eax
mov esi, eax
lea ecx, [esi + 1]
mov edi, edi
mov al, byte [esi]
add esi, 1
test al, al
jne 0x5450eb10
sub esi, ecx
jne 0x5450eb37
push edi
call dword [0x545428d0]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov byte [ebp - 0x44], 4
mov byte [ebp - 0x43], 0
mov dword [ebp - 0x42], esi
jmp 0x5450ead7
add esi, 1
lea eax, [esi + 0x400]
mov dword [ebp - 0x1c], eax
push esi
call fcn.54516c18
mov edi, eax
mov dword [ebp - 0x38], edi
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.54516c18
add esp, 8
mov ebx, eax
mov dword [ebp - 0x3c], ebx
test edi, edi
je 0x5450ec1b
test ebx, ebx
je 0x5450ec1b
push esi
mov edx, dword [ebp - 0x28]
push edx
push edi
call fcn.54518080
add esp, 0xc
mov eax, dword [ebp - 0x24]
push eax
call dword [0x545428d0]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], esi
push 8
push esi
push edi
lea ecx, [ebp - 0x1c]
push ecx
push ebx
lea ecx, [ebp - 0x2c]
call fcn.5450f290
test eax, eax
je 0x5450ebb0
xor esi, esi
jmp 0x5450ebdf
mov byte [ebp - 0x44], 4
mov byte [ebp - 0x43], 1
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x42], eax
push eax
push ebx
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x34]
add ecx, 0x24
call fcn.5450bc70
mov esi, eax
neg esi
sbb esi, esi
and esi, 2
add esi, 0xffffffff
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 0xfffffffe
call fcn.5450ec0b
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x24]
push ecx
call dword [0x545428d0]
call dword [sym.imp.USER32.dll_CloseClipboard]
push edi
call fcn.54516bfa
push ebx
call fcn.54516bfa
add esp, 8
xor eax, eax
jmp 0x5450ebf0
Function at 0x5450eee0
Capabilities:
Create thread

Disassembly:
sub esp, 0x14
push esi
mov esi, ecx
mov eax, dword [esi]
push eax
lea ecx, [esi + 0x24]
call fcn.5450bb50
test eax, eax
jne 0x5450eefa
pop esi
add esp, 0x14
ret
push ebx
lea ecx, [esp + 0xc]
push ecx
push 0
push esi
push 0x5450eed0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
test ebx, ebx
mov dword [esp + 8], ebx
jne 0x5450ef22
pop ebx
pop esi
add esp, 0x14
ret
push edi
lea ecx, [esp + 0x14]
call fcn.5450f8e0
lea edi, [esi + 0x5c]
push 4
mov ecx, edi
call fcn.5450c090
mov ecx, esi
call fcn.5450e020
test eax, eax
jne 0x5450ef4a
pop edi
pop ebx
pop esi
add esp, 0x14
ret
cmp byte [esi + 0x510], 0
je 0x5450efe4
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x5450ef70
push 0x3e8
lea ecx, [esp + 0x1c]
call fcn.5450fae0
push esi
push 0x5450e3a0
call ebx
push eax
mov ecx, edi
call fcn.5450cec0
test eax, eax
jne 0x5450efab
push 0x400
call ebp
add byte [edi + 0x4b0], 1
cmp byte [edi + 0x4b0], 2
ja 0x5450efdf
jmp 0x5450efb2
mov byte [esi + 0x50c], 0
cmp byte [esi + 0x4f9], 0
jne 0x5450efbf
push 1
call ebp
lea ecx, [esi + 0x48]
call fcn.5450ba70
test al, al
je 0x5450efd6
mov ecx, esi
call fcn.5450e050
test eax, eax
je 0x5450efdf
cmp byte [esi + 0x510], 0
jne 0x5450ef70
mov ebx, dword [esp + 0x10]
pop ebp
mov byte [esi + 0x510], 0
call fcn.5450d5a0
call fcn.5450ded0
cmp dword [esi + 0x524], 0
je 0x5450f041
push str.kill_system_Explorer_r_n
call fcn.54517f46
mov edx, dword [esi + 0x524]
add esp, 4
push 0
push edx
call dword [0x54542864]
mov eax, dword [esi + 0x528]
push eax
call dword [0x54542850]
mov ecx, dword [esi + 0x524]
push ecx
call dword [0x54542850]
push str.Winlogon
call fcn.5450e690
add esp, 4
push 0xffffffffffffffff
push ebx
call dword [0x545428ac]
push ebx
call dword [0x54542850]
pop edi
pop ebx
mov eax, 1
pop esi
add esp, 0x14
ret

Function at 0x5450f2f0
Capabilities:
Get socket status

Disassembly:
sub esp, 0x210
mov cl, byte [esp + 0x218]
test cl, cl
mov eax, dword [esp + 0x220]
push esi
mov esi, dword [esp + 0x218]
push edi
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0
mov edi, 1
je 0x5450f330
mov dword [esp + 0x118], esi
mov dword [esp + 0x114], edi
mov dl, byte [esp + 0x224]
test dl, dl
je 0x5450f343
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edi
sub eax, 0xffffffff
neg eax
sbb eax, eax
lea edi, [esp + 8]
and eax, edi
neg dl
push eax
lea eax, [esp + 0x14]
push 0
sbb edx, edx
and edx, eax
neg cl
push edx
lea edx, [esp + 0x120]
sbb ecx, ecx
and ecx, edx
push ecx
add esi, 1
push esi
call dword [sym.imp.WS2_32.dll_select]
pop edi
pop esi
add esp, 0x210
ret

Function at 0x5450f7f0
Capabilities:
Simulate ctrl alt del

Disassembly:
push esi
call dword [0x54542874]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
push str.Winlogon
mov esi, eax
call fcn.5450f6b0
add esp, 4
test eax, eax
je 0x5450f835
push 0x2e0003
push 0
push 0x312
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageA]
test esi, esi
je 0x5450f835
push esi
call fcn.5450f5d0
add esp, 4
xor eax, eax
pop esi
ret
Function at 0x5450fb30
Capabilities:
Compute adler32 checksum

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
movzx ecx, di
shr edi, 0x10
test esi, esi
jne 0x5450fb4a
pop edi
lea eax, [esi + 1]
pop esi
ret
push ebx
mov ebx, dword [esp + 0x18]
test ebx, ebx
jbe 0x5450fc5c
push ebp
jmp 0x5450fb60
cmp ebx, 0x15b0
mov eax, ebx
jb 0x5450fb6f
mov eax, 0x15b0
sub ebx, eax
cmp eax, 0x10
jl 0x5450fc1b
mov edx, eax
shr edx, 4
mov ebp, edx
neg ebp
shl ebp, 4
add eax, ebp
jmp 0x5450fb90
movzx ebp, byte [esi]
add ecx, ebp
movzx ebp, byte [esi + 1]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 2]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 3]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 4]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 5]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 6]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 7]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 8]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 9]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xa]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xb]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xc]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xd]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xe]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xf]
add edi, ecx
add ecx, ebp
add edi, ecx
add esi, 0x10
sub edx, 1
jne 0x5450fb90
test eax, eax
je 0x5450fc2f
nop
movzx edx, byte [esi]
add ecx, edx
add esi, 1
add edi, ecx
sub eax, 1
jne 0x5450fc20
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul edx, edx, 0xffff000f
add ecx, edx
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul edx, edx, 0xffff000f
add edi, edx
test ebx, ebx
ja 0x5450fb60
pop ebp
mov eax, edi
pop ebx
shl eax, 0x10
pop edi
or eax, ecx
pop esi
ret
Function at 0x54510330
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esi + 0x24]
push ebp
push edi
mov eax, dword [esi + 0x64]
mov ebp, dword [esi + 0x34]
mov ecx, dword [esi + 0x6c]
sub ebp, eax
sub ebp, ecx
jne 0x54510351
test eax, eax
jne 0x5451035d
test ecx, ecx
jne 0x5451035d
mov ebp, ebx
jmp 0x545103cc
cmp ebp, 0xffffffff
jne 0x5451035d
mov ebp, 0xfffffffe
jmp 0x545103cc
mov ecx, dword [esi + 0x24]
lea edx, [ebx + ecx - 0x106]
cmp eax, edx
jb 0x545103cc
mov eax, dword [esi + 0x30]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.54518080
mov edx, dword [esi + 0x44]
mov eax, dword [esi + 0x3c]
sub dword [esi + 0x68], ebx
sub dword [esi + 0x64], ebx
add esp, 0xc
sub dword [esi + 0x54], ebx
lea ecx, [eax + edx*2]
mov edi, edi
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebx
jb 0x5451039f
sub eax, ebx
jmp 0x545103a1
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x54510390
mov ecx, dword [esi + 0x38]
mov edx, ebx
lea ecx, [ecx + ebx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebx
jb 0x545103c0
sub eax, ebx
jmp 0x545103c2
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x545103b1
add ebp, ebx
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x54510427
mov edx, dword [esi + 0x6c]
add edx, dword [esi + 0x64]
mov ecx, ebp
add edx, dword [esi + 0x30]
push edx
call fcn.545100e0
add dword [esi + 0x6c], eax
mov edx, dword [esi + 0x6c]
add esp, 4
cmp edx, 3
jb 0x54510413
mov eax, dword [esi + 0x64]
mov ecx, dword [esi + 0x30]
lea edi, [eax + ecx]
movzx eax, byte [edi]
mov ecx, dword [esi + 0x50]
mov dword [esi + 0x40], eax
shl eax, cl
movzx ecx, byte [edi + 1]
xor eax, ecx
and eax, dword [esi + 0x4c]
mov dword [esi + 0x40], eax
cmp edx, 0x106
jae 0x54510427
mov edx, dword [esi]
cmp dword [edx + 4], 0
jne 0x54510336
pop edi
pop ebp
pop ebx
ret