joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4eb5b6
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4004
call fcn.0054e7e0
mov eax, dword [0x5c9040]
xor eax, ebp
mov dword [ebp - 4], eax
push ecx
push ecx
mov edx, 0x1000
lea ecx, [ebp - 0x2004]
call fcn.004ea31a
pop ecx
pop ecx
lea ecx, [ebp - 0x2004]
call fcn.004ee063
cmp dword [0x5c9c58], 0
push ecx
lea ecx, [ebp - 0x2004]
jne 0x4eb637
lea edx, [ebp - 0x1004]
call fcn.004eb3e8
push 4
lea eax, [ebp - 0x1004]
push 0x5a99d0
push eax
call fcn.0051cbd0
add esp, 0x10
lea edx, [ebp - 0x1000]
test eax, eax
lea ecx, [ebp - 0x1004]
cmove ecx, edx
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
jmp 0x4eb68b
lea edx, [ebp - 0x4004]
call fcn.004eb320
push 8
lea eax, [ebp - 0x4004]
push 0x5a99dc
push eax
call fcn.0051cbd0
add esp, 0x10
lea ecx, [ebp - 0x4004]
test eax, eax
lea edx, [ebp - 0x3ffc]
cmove ecx, edx
cmp word [ecx + 2], 0x3a
jne 0x4eb684
cmp word [ecx + 4], 0
jne 0x4eb684
push 0x5c
pop eax
mov word [ecx + 4], ax
xor eax, eax
mov word [ecx + 6], ax
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
xor ecx, ebp
neg eax
dec eax
call fcn.0051b034
leave
ret

Function at 0x4eb7bd
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10e8
call fcn.0054e7e0
mov eax, dword [0x5c9040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x3c
xor esi, esi
lea eax, [ebp - 0x10e8]
push esi
push eax
mov edi, ecx
call fcn.0051c010
add esp, 0xc
lea edx, [ebp - 0x10ac]
lea ecx, [ebp - 0x10a8]
call fcn.004ef1a6
mov eax, dword [ebp - 0x1098]
sub eax, 1
je 0x4eb8dd
sub eax, 1
jne 0x4eb827
cmp dword [ebp - 0x10a4], 5
jne 0x4eb827
cmp dword [ebp - 0x10a0], 2
jbe 0x4eb8dd
push ecx
push edi
mov edx, 0x1000
lea ecx, [ebp - 0x1008]
call fcn.004ea31a
pop ecx
pop ecx
lea ecx, [ebp - 0x1008]
call fcn.004edd70
test eax, eax
je 0x4eb857
mov ecx, eax
call fcn.004edc7f
mov dword [ebp - 0x10d4], eax
lea ecx, [ebp - 0x1008]
mov dword [ebp - 0x10e8], 0x3c
mov dword [ebp - 0x10dc], str.runas
call fcn.004edc5a
mov dword [ebp - 0x10d8], eax
lea eax, [ebp - 0x10e8]
push eax
mov dword [ebp - 0x10e0], esi
mov dword [ebp - 0x10cc], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x4eb8ce
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
push str.cmd_s_error:
push str.os_sudo
push 0x286
push str.srcliblibpaloswindowsos_privilege.c
push 0x5a9534
push 0x103
push esi
call fcn.004e8a0a
add esp, 0x20
or esi, 0xffffffff
mov ecx, dword [ebp - 0x10d4]
call fcn.004ebe45
mov eax, esi
jmp 0x4eb8eb
mov ecx, edi
call fcn.004edc5a
push eax
call fcn.0053787a
pop ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0051b034
leave
ret
Function at 0x4eba95
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1110
call fcn.0054e7e0
mov eax, dword [0x5c9040]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, edx
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x4ebb9d
mov ecx, edi
call fcn.004fc1b7
xor ebx, ebx
cmp dword [esi], ebx
je 0x4ebb0a
lea ecx, [ebp - 0x10c]
call fcn.004faabf
mov eax, dword [edi]
push dword [eax + 0xc]
push dword [eax]
lea eax, [ebp - 0x10c]
push eax
push str.Thread_exception:_tname__s__Code0x_x_Address0x_p__nSee_the_log_for_more_information
lea eax, [ebp - 0x110c]
push 0x1000
push eax
call fcn.004ea423
lea eax, [ebp - 0x110c]
push eax
call dword [esi]
add esp, 0x1c
cmp byte [esi + 4], bl
je 0x4ebb16
mov ecx, edi
call fcn.004fc341
cmp byte [esi + 5], bl
je 0x4ebb41
push str.except_handle_n
push str.os_thread_exception_filter
push 0x3f
push str.srcliblibpalosos_thread.c
push 0x5a9534
push 7
push ebx
call fcn.004e8a0a
xor eax, eax
add esp, 0x1c
inc eax
jmp 0x4ebb9f
cmp byte [esi + 6], bl
je 0x4ebb75
push str.thread_panic_exit_n
push str.os_thread_exception_filter
push 0x45
push str.srcliblibpalosos_thread.c
push 0x5a9534
push 0x602
push ebx
call fcn.004e8a0a
add esp, 0x1c
push 0xfe
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.except_continue_n
push str.os_thread_exception_filter
push 0x49
push str.srcliblibpalosos_thread.c
push 0x5a9534
push 3
push ebx
call fcn.004e8a0a
add esp, 0x1c
mov byte [0x6054cc], 1
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051b034
leave
ret

Function at 0x4ebc74
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push esi
mov ebx, ecx
mov ecx, 0x110
push edi
mov edi, edx
call fcn.004ebeae
mov esi, eax
test esi, esi
je 0x4ebce7
push ecx
push ebx
mov edx, 0x100
mov ecx, esi
call fcn.004ea31a
cmp dword [esp + 0x24], 0
mov eax, dword [esp + 0x1c]
pop ecx
pop ecx
mov dword [esi + 0x100], edi
mov dword [esi + 0x104], eax
je 0x4ebcc8
push 8
push dword [esp + 0x20]
lea eax, [esi + 0x108]
push eax
call fcn.0051c650
add esp, 0xc
xor eax, eax
push eax
push eax
push esi
push 0x4ebbae
push eax
push eax
call fcn.005308f5
add esp, 0x18
test eax, eax
jne 0x4ebce9
mov ecx, esi
call fcn.004ebe45
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4ebd41
Capabilities:
Terminate thread

Disassembly:
push 1
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
neg eax
sbb eax, eax
neg eax
dec eax
ret
Function at 0x4ed20e
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x5c5e78
call fcn.0051bb70
mov esi, ecx
or ebx, 0xffffffff
mov dword [ebp - 0x1c], ebx
test esi, esi
jne 0x4ed243
call fcn.0052d3fe
mov dword [eax], 0x16
mov eax, ebx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
and dword [ebp - 4], 0
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi + 8], 0
je 0x4ed258
push dword [esi + 8]
call edi
cmp dword [esi + 0xc], 0
je 0x4ed263
push dword [esi + 0xc]
call edi
cmp dword [esi + 0x10], 0
je 0x4ed26e
push dword [esi + 0x10]
call edi
cmp dword [esi + 0x14], 0
je 0x4ed279
push dword [esi + 0x14]
call edi
cmp dword [esi + 0x18], 0
je 0x4ed284
push dword [esi + 0x18]
call edi
push 0xa
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4ed2aa
lea eax, [ebp - 0x20]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x4ed2b4
mov ebx, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ebx
jmp 0x4ed2b4
push 1
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [esi]
call edi
and dword [esi], 0
mov ecx, esi
call fcn.004ebe45
mov dword [ebp - 4], 0xfffffffe
call fcn.004ed2d6
jmp 0x4ed231
Function at 0x4ef0ab
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xc4
mov eax, dword [0x5c9040]
xor eax, ebp
mov dword [ebp + 0x74], eax
mov eax, dword [0x896174]
test eax, eax
jne 0x4ef197
push 0x24
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.0051c010
push 0x9c
lea eax, [ebp - 0x28]
push 0
push eax
call fcn.0051c010
add esp, 0x18
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x4ef10f
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4ef115
cmp dword [ebp - 0x18], 2
je 0x4ef11c
mov eax, 0x55f3a0
jmp 0x4ef192
push 0x5aa260
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x606650], eax
test eax, eax
je 0x4ef184
lea ecx, [ebp - 0x4c]
push ecx
call eax
mov ax, word [ebp - 0x4c]
test ax, ax
je 0x4ef115
cmp ax, 9
jne 0x4ef158
mov eax, 0x5aa290
jmp 0x4ef192
cmp ax, 6
jne 0x4ef165
mov eax, str.ia64
jmp 0x4ef192
cmp ax, 5
jne 0x4ef172
mov eax, 0x5898c0
jmp 0x4ef192
cmp ax, 0xc
jne 0x4ef184
mov eax, str.arm64
mov dword [0x896174], eax
jmp 0x4ef189
mov eax, dword [0x896174]
test eax, eax
jne 0x4ef197
mov eax, str.unknown
mov dword [0x896174], eax
mov ecx, dword [ebp + 0x74]
xor ecx, ebp
call fcn.0051b034
add ebp, 0x78
leave
ret
Function at 0x4efd01
Capabilities:
Get system information on windows

Disassembly:
mov eax, 0x102c
call fcn.0054e7e0
mov eax, dword [0x5c9040]
xor eax, esp
mov dword [esp + 0x1028], eax
mov eax, dword [0x603ea4]
cmp eax, 0xffffffff
jne 0x4efe24
push ebx
push ebp
push edi
call fcn.004f9d60
xor ebp, ebp
xor ebx, ebx
inc ebp
cmp dword [eax + 0x60], ebx
je 0x4efdc4
mov dword [esp + 0xc], ebx
call fcn.004f9d60
lea ecx, [esp + 0xc]
push ecx
push ebx
push ebx
call dword [eax + 0x60]
test eax, eax
jne 0x4efdc4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4efdc4
cmp dword [esp + 0xc], 0x1000
ja 0x4efdc4
mov edi, ebx
call fcn.004f9d60
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x38]
push ecx
push ebx
call dword [eax + 0x60]
test eax, eax
je 0x4efdc4
mov ecx, ebx
cmp dword [esp + 0xc], ecx
jbe 0x4efdb6
push esi
lea edx, [esp + 0x38]
add edx, ecx
cmp dword [edx], ebx
jne 0x4efdac
cmp word [edx + 0x1e], bp
jne 0x4efdac
mov esi, dword [edx + 0x20]
test esi, esi
je 0x4efdac
mov eax, esi
and eax, ebp
add edi, eax
shr esi, 1
jne 0x4efda2
add ecx, dword [edx + 4]
cmp ecx, dword [esp + 0x10]
jb 0x4efd8b
pop esi
test edi, edi
mov eax, ebp
cmovne eax, edi
mov dword [0x603ea4], eax
jmp 0x4efdc9
mov eax, dword [0x603ea4]
cmp eax, 0xffffffff
jne 0x4efe21
call fcn.004f9d60
cmp dword [eax + 0x5c], ebx
je 0x4efdec
call fcn.004f9d60
push 0xffff
call dword [eax + 0x5c]
mov dword [0x603ea4], eax
jmp 0x4efdf1
mov eax, dword [0x603ea4]
cmp eax, 0xffffffff
jne 0x4efe21
push 0x24
lea eax, [esp + 0x14]
push ebx
push eax
call fcn.0051c010
add esp, 0xc
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [esp + 0x24], ebx
mov eax, ebp
cmovne eax, dword [esp + 0x24]
mov dword [0x603ea4], eax
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1028]
xor ecx, esp
call fcn.0051b034
add esp, 0x102c
ret

Function at 0x4f0bab
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3004
call fcn.0054e7e0
mov eax, dword [0x5c9040]
xor eax, ebp
mov dword [ebp - 4], eax
push ecx
push ecx
mov edx, 0x1000
lea ecx, [ebp - 0x1004]
call fcn.004ea31a
pop ecx
pop ecx
lea ecx, [ebp - 0x1004]
call fcn.004ee063
cmp dword [0x5c9c58], 0
push ecx
lea ecx, [ebp - 0x1004]
jne 0x4f0c0c
lea edx, [ebp - 0x2004]
call fcn.004eb3e8
pop ecx
lea eax, [ebp - 0x2004]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x4f0c25
lea edx, [ebp - 0x3004]
call fcn.004eb320
pop ecx
lea eax, [ebp - 0x3004]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4f0c2e
or eax, eax
jmp 0x4f0c34
shr eax, 4
and eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051b034
leave
ret
Function at 0x4f12c8
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3008
call fcn.0054e7e0
mov eax, dword [0x5c9040]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x5c9c58], 0
push ebx
push esi
push ecx
jne 0x4f1314
lea edx, [ebp - 0x1008]
call fcn.004eb3e8
pop ecx
xor eax, eax
push eax
push eax
push 4
push eax
push 7
push 0x40000000
lea eax, [ebp - 0x1008]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
jmp 0x4f133b
lea edx, [ebp - 0x3008]
call fcn.004eb320
pop ecx
xor eax, eax
push eax
push eax
push 4
push eax
push 7
push 0x40000000
lea eax, [ebp - 0x3008]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
or eax, 0xffffffff
cmp esi, eax
je 0x4f136d
push dword [ebp + 0xc]
push dword [ebp + 8]
push ecx
mov ecx, esi
call fcn.004fc7a3
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor ebx, ebx
test eax, eax
push esi
setne bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx - 1]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0051b034
leave
ret

Function at 0x4f13c9
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.0054e7e0
mov eax, dword [0x5c9040]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x5c9c58], 0
push esi
mov esi, edx
push ecx
jne 0x4f1414
lea edx, [ebp - 0x1004]
call fcn.004eb3e8
pop ecx
push esi
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x4f1410
or eax, 0xffffffff
jmp 0x4f1435
xor eax, eax
jmp 0x4f1435
lea edx, [ebp - 0x2004]
call fcn.004eb320
pop ecx
push esi
lea eax, [ebp - 0x2004]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
neg eax
sbb eax, eax
neg eax
dec eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0051b034
leave
ret

Function at 0x4f169e
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x202c
call fcn.0054e7e0
mov eax, dword [0x5c9040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
xorps xmm0, xmm0
push ecx
mov dword [ebp - 0x2028], esi
mov dword [ebp - 0x200e], esi
movlpd qword [ebp - 0x2016], xmm0
cmp dword [0x5c9c58], esi
jne 0x4f1724
lea edx, [ebp - 0x1008]
call fcn.004eb3e8
pop ecx
push 0x50
pop eax
mov word [ebp - 0x2018], ax
lea eax, [ebp - 0x1008]
mov dword [ebp - 0x2020], eax
lea eax, [ebp - 0x2028]
push eax
mov dword [ebp - 0x201c], esi
mov dword [ebp - 0x2024], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
test eax, eax
je 0x4f179f
or eax, 0xffffffff
jmp 0x4f17a1
lea edx, [ebp - 0x2008]
call fcn.004eb320
pop ecx
push 0x50
pop eax
mov word [ebp - 0x2018], ax
lea eax, [ebp - 0x2008]
mov dword [ebp - 0x2020], eax
lea eax, [ebp - 0x2028]
push eax
mov dword [ebp - 0x201c], esi
mov dword [ebp - 0x2024], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x4f179f
cmp eax, 2
je 0x4f179f
push eax
lea ecx, [ebp - 0x2008]
call fcn.004edbf6
push eax
push str.del___s__errno_d
push str.os_win_remove_maybe_recycle
push 0x182
push str.srcliblibpalosos_file.c
push 0x5a9534
push 7
push esi
call fcn.004e8a0a
add esp, 0x24
jmp 0x4f171f
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0051b034
leave
ret
Function at 0x4f17db
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8008
call fcn.0054e7e0
mov eax, dword [0x5c9040]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x5c9c58], 0
push esi
push edi
jne 0x4f1864
mov edi, 0x2000
mov byte [ebp - 0x2008], 0
push edi
lea edx, [ebp - 0x2008]
call fcn.004edb94
pop ecx
push edi
lea eax, [ebp - 0x6008]
push eax
lea eax, [ebp - 0x2008]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x4f18c9
cmp eax, edi
ja 0x4f18c9
mov eax, dword fs:[0x2c]
lea ecx, [ebp - 0x6008]
push edi
mov eax, dword [eax]
lea esi, [eax + 0x30]
mov edx, esi
mov byte [esi], 0
call fcn.004edb31
cmp byte [esi], 0
pop ecx
je 0x4f18c9
mov eax, esi
jmp 0x4f18cb
xor eax, eax
lea edx, [ebp - 0x8008]
push 0x4000
mov word [ebp - 0x8008], ax
call fcn.004ed834
pop ecx
mov edi, 0x2000
lea eax, [ebp - 0x4008]
push edi
push eax
lea eax, [ebp - 0x8008]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x4f18c9
cmp eax, edi
ja 0x4f18c9
mov eax, dword fs:[0x2c]
lea ecx, [ebp - 0x4008]
push edi
mov eax, dword [eax]
lea esi, [eax + 0x30]
mov edx, esi
mov byte [esi], 0
call fcn.004ed73d
xor eax, eax
cmp byte [esi], al
pop ecx
cmove esi, eax
jmp 0x4f1860
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0051b034
leave
ret

Function at 0x4f1c70
Capabilities:
Encode data using base64

Disassembly:
push ecx
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
mov eax, ecx
push esi
push edi
push 3
mov edi, edx
mov dword [esp + 0x18], eax
xor ebx, ebx
xor ecx, ecx
mov esi, ebp
pop edx
mov dword [esp + 0x10], edx
test eax, eax
je 0x4f1d0f
test ebp, ebp
je 0x4f1d0f
cmp edi, 0x3fffffff
jae 0x4f1d0f
xor edx, edx
lea eax, [edi + 2]
div dword [esp + 0x10]
lea eax, [eax*4 + 1]
cmp dword [esp + 0x20], eax
jb 0x4f1d0c
test edi, edi
je 0x4f1cf4
mov ebp, dword [esp + 0x14]
movzx eax, byte [ebp]
add ecx, 8
shl ebx, 8
add ebx, eax
inc ebp
mov edx, ebx
dec edi
shl edx, 6
mov eax, edx
shr eax, cl
sub ecx, 6
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], al
inc esi
cmp ecx, 6
jg 0x4f1cd0
test edi, edi
jne 0x4f1cbd
test ecx, ecx
jg 0x4f1cd0
mov ebp, dword [esp + 0x1c]
mov eax, esi
sub eax, ebp
jmp 0x4f1cff
mov byte [esi], 0x3d
inc esi
inc eax
test al, 3
jne 0x4f1cfa
mov byte [esi], 0
sub esi, ebp
mov eax, esi
jmp 0x4f1d3d
push 3
pop edx
push str.ib__ob____in___UINT32_MAX___4__on___PL_BASE64_ENCODE_LEN_in__
push str.expr__s_:_assert_failed_n
push str.str_base64_encode_imp
push 0xf
push str.srcliblibpal_string_str_base64.c
push 0x5a9534
push edx
push 0
call fcn.004e8a0a
add esp, 0x20
call fcn.004ee4bf
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret

Function at 0x4f210e
Capabilities:
Hash data with md5

Disassembly:
push esi
push 0x58
mov esi, ecx
push 0
push esi
call fcn.0051c010
and dword [esi + 0x10], 0
add esp, 0xc
and dword [esi + 0x14], 0
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
pop esi
ret
Function at 0x4f3dd6
Capabilities:
Enumerate processes

Disassembly:
mov eax, 0x1244
call fcn.0054e7e0
mov eax, dword [0x5c9040]
xor eax, esp
mov dword [esp + 0x123c], eax
push ebx
push ebp
push esi
push edi
push 0x228
lea eax, [esp + 0x20]
mov ebp, ecx
push 0
push eax
call fcn.0051c010
add esp, 0xc
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4f3e20
xor eax, eax
jmp 0x4f3f34
push 0xc
pop ecx
call fcn.004ebeae
mov esi, eax
push 0x24
pop ecx
and dword [esi + 4], 0
mov dword [esi + 8], 8
call fcn.004ebeae
mov dword [esi], eax
lea eax, [esp + 0x18]
push eax
push edi
mov dword [esp + 0x20], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x4f3f14
push ebp
lea ecx, [esp + 0x40]
call fcn.004edbf6
mov ecx, eax
call fcn.004ee26c
push eax
call fcn.005205d0
pop ecx
pop ecx
test eax, eax
je 0x4f3eb7
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x248]
call fcn.004f3f4d
test eax, eax
jne 0x4f3f08
push 1
mov edx, ebp
lea ecx, [esp + 0x24c]
call fcn.004f35ec
pop ecx
test al, al
jne 0x4f3eb7
push ebp
lea ecx, [esp + 0x24c]
call fcn.004ee26c
push eax
call fcn.005205d0
pop ecx
pop ecx
test eax, eax
jne 0x4f3f08
mov edx, dword [esi + 8]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x14], eax
cmp dword [esi + 4], edx
jne 0x4f3ef9
mov ecx, dword [esi]
lea edx, [edx*8 + 4]
call fcn.004ebed2
mov ebx, eax
test ebx, ebx
je 0x4f3f08
mov edx, dword [esi + 4]
lea ecx, [edx*4 + 4]
push ecx
lea ecx, [ebx + edx*4]
push 0
push ecx
call fcn.0051c010
add esp, 0xc
mov dword [esi], ebx
shl dword [esi + 8], 1
mov ecx, dword [esi + 4]
mov eax, dword [esi]
mov edx, dword [esp + 0x14]
mov dword [eax + ecx*4], edx
inc dword [esi + 4]
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4f3e58
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi + 4], 0
jne 0x4f3f32
mov ecx, esi
call fcn.004f40c2
xor esi, esi
mov eax, esi
mov ecx, dword [esp + 0x124c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0051b034
add esp, 0x1244
ret

Function at 0x4f3fdc
Capabilities:
Terminate process

Disassembly:
push esi
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4f3ff3
xor al, al
pop esi
ret
push ebx
push 1
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop ebx
pop esi
ret
Function at 0x4f400b
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5c9040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x18]
mov esi, ecx
push eax
push 0x28
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea eax, [ebp - 0x10]
push eax
push str.SeShutdownPrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
push ebx
push dword [ebp - 0x18]
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x4f408f
push str.AdjustTokenPrivileges_error:
push str.os_shutdown
push 0x78
push str.srcliblibpaloswindowsos_pid.c
push 0x5a9534
push 0x107
push ebx
call fcn.004e8a0a
add esp, 0x1c
xor al, al
jmp 0x4f40b4
sub esi, ebx
je 0x4f40a7
sub esi, 1
je 0x4f40a2
sub esi, 1
jne 0x4f40b2
push ebx
push 6
jmp 0x4f40aa
push ebx
push 0xc
jmp 0x4f40aa
push ebx
push 5
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov bl, al
mov al, bl
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0051b034
leave
ret
Function at 0x4f5c6d
Capabilities:
Get file attributes

Disassembly:
mov eax, 0x1010
call fcn.0054e7e0
mov eax, dword [0x5c9040]
xor eax, esp
mov dword [esp + 0x100c], eax
push ebx
push ebp
mov ebp, dword [esp + 0x101c]
mov ebx, edx
push esi
push edi
xor edi, edi
mov dword [esp + 0x14], ebx
cmp byte [0x608b14], 0
mov esi, ecx
jne 0x4f5cb4
mov ecx, 0x5adcc8
call fcn.004eb8f9
mov byte [0x608b14], 1
push 0x584950
push esi
call fcn.005205d0
pop ecx
pop ecx
test eax, eax
jne 0x4f5ccd
push 9
pop edi
jmp 0x4f5e11
cmp byte [esi], 0x5c
jne 0x4f5d17
mov al, byte [esi + 1]
test al, al
je 0x4f5d17
cmp byte [esi + 2], 0
jne 0x4f5d17
movsx eax, al
xor edi, edi
push eax
push 0x5adcdc
push 0x1000
push ebp
inc edi
call fcn.004ea423
movsx eax, byte [esi + 1]
push eax
push str.._c:
lea eax, [esp + 0x30]
push 0x1000
push eax
call fcn.004ea423
add esp, 0x20
jmp 0x4f5e11
push 4
push str.._
push esi
call fcn.0051cbd0
add esp, 0xc
test eax, eax
jne 0x4f5d7a
mov al, byte [esi + 4]
test al, al
je 0x4f5d66
cmp byte [esi + 5], 0x3a
jne 0x4f5d66
mov bl, byte [esi + 6]
movsx eax, al
push eax
push 0x5adcdc
push 0x1000
push ebp
call fcn.004ea423
add esp, 0x10
xor edi, edi
inc edi
test bl, bl
mov ebx, dword [esp + 0x14]
push 8
pop eax
cmovne edi, eax
jmp 0x4f5dff
push 0x11
push str..PhysicalDrive
push esi
call fcn.0051cbd0
add esp, 0xc
push 2
jmp 0x4f5df9
mov al, byte [esi]
test al, al
je 0x4f5dd0
cmp byte [esi + 1], 0x3a
jne 0x4f5dd0
cmp byte [esi + 2], 0
movsx eax, al
push eax
push 0x5adcdc
push 0x1000
push ebp
jne 0x4f5dad
xor edi, edi
inc edi
call fcn.004ea423
movsx esi, byte [esi]
mov eax, str.._c:
jmp 0x4f5db7
call fcn.004ea423
mov eax, 0x5adcf4
add esp, 0x10
push esi
push eax
lea eax, [esp + 0x20]
push 0x1000
push eax
call fcn.004ea423
add esp, 0x10
jmp 0x4f5e11
mov edx, str..GLOBALROOTDeviceHarddiskVolumeShadowCopy
mov ecx, esi
call fcn.004f2b65
test al, al
je 0x4f5dff
push 0x5c
push str..GLOBALROOTDeviceHarddiskVolumeShadowCopy
call fcn.00520660
pop ecx
add eax, esi
push eax
call fcn.0051c170
pop ecx
pop ecx
push 3
test eax, eax
pop ecx
cmove edi, ecx
push ecx
push esi
mov edx, 0x1000
lea ecx, [esp + 0x20]
call fcn.004ea31a
pop ecx
pop ecx
push 0x2000
mov edx, ebx
lea ecx, [esp + 0x1c]
call fcn.004ed834
pop ecx
test edi, edi
jne 0x4f5e5c
cmp dword [0x5c9c58], edi
jne 0x4f5e48
push 0x1000
mov edx, ebp
lea ecx, [esp + 0x1c]
call fcn.004edb94
pop ecx
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x4f5e4f
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4f5e5c
test al, 0x10
push 8
pop eax
cmovne edi, eax
mov ecx, dword [esp + 0x101c]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0051b034
add esp, 0x1010
ret