joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4860c8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059cc
mov eax, dword [ebp - 8]
call fcn.004059cc
mov eax, dword [ebp - 0xc]
call fcn.004059cc
xor eax, eax
push ebp
push 0x486179
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x14
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov esi, eax
mov ebx, esi
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00405584
lea eax, [ebx + 4]
call fcn.00405530
lea eax, [ebx + 8]
mov edx, dword [ebp - 8]
call fcn.00405584
lea eax, [ebx + 0xc]
mov edx, dword [ebp - 0xc]
call fcn.00405584
lea eax, [ebx + 0x10]
mov edx, 0x486190
call fcn.00405584
mov eax, dword [0x495c30]
push eax
push 0
push esi
push 0x483c98
push 0
push 0
call sub.kernel32.dll_CreateThread_1
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x486180
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405554
ret

Function at 0x486780
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Receive data
Receive data on socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4868b2
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov dword [0x49f3a8], eax
cmp dword [0x49f3a8], 0xffffffff
je 0x486897
mov word [ebp - 0x10], 2
mov eax, dword [0x4959d8]
movzx eax, word [eax]
push eax
call sub.wsock32.dll_htons
mov word [ebp - 0xe], ax
mov eax, dword [0x495b34]
mov eax, dword [eax]
push eax
call sub.wsock32.dll_inet_addr
mov edi, eax
mov dword [ebp - 0xc], edi
inc edi
jne 0x48680c
mov eax, dword [0x495b34]
mov eax, dword [eax]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x486897
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
push 0x10
lea eax, [ebp - 0x10]
push eax
mov eax, dword [0x49f3a8]
push eax
call sub.wsock32.dll_connect
push 0
push 0x1fff
push 0x49d3a8
mov eax, dword [0x49f3a8]
push eax
call sub.wsock32.dll_recv
mov eax, 0x49d3a8
xor ecx, ecx
mov edx, 0x2000
call fcn.00403af4
lea edx, [ebp - 0x18]
mov eax, dword [esi + 0x50]
call fcn.00409d78
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 0x4868cc
call fcn.00405864
mov edx, dword [ebp - 0x14]
mov eax, dword [0x49f3a8]
call fcn.00475e38
push 0
push 0x1fff
push 0x49d3a8
mov eax, dword [0x49f3a8]
push eax
call sub.wsock32.dll_recv
mov eax, 0x49d3a8
xor ecx, ecx
mov edx, 0x2000
call fcn.00403af4
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4868b9
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00405554
ret
Function at 0x486bb4
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x486c6a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x486c84
call fcn.004055c8
lea ecx, [ebp - 0x10]
mov edx, dword [0x495b5c]
mov edx, dword [edx]
mov eax, dword [ebp - 4]
call fcn.00461360
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
call fcn.004055c8
mov eax, dword [ebp - 4]
test eax, eax
je 0x486c0d
sub eax, 4
mov eax, dword [eax]
mov esi, eax
mov edi, 1
mov byte [ebp - 9], 1
test esi, esi
jle 0x486c4c
push 0
push esi
lea eax, [ebp - 4]
call fcn.00405a3c
lea eax, [eax + edi - 1]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x40]
push eax
call sub.wsock32.dll_send
mov ebx, eax
test ebx, ebx
jg 0x486c44
mov byte [ebp - 9], 0
jmp 0x486c4c
sub esi, ebx
add edi, ebx
test esi, esi
jg 0x486c1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x486c71
lea eax, [ebp - 0x10]
call fcn.00405530
lea eax, [ebp - 4]
call fcn.00405530
ret
Function at 0x4880e4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059cc
mov eax, dword [ebp - 8]
call fcn.004059cc
mov eax, dword [ebp - 0xc]
call fcn.004059cc
mov eax, dword [ebp + 8]
call fcn.004059cc
xor eax, eax
push ebp
push 0x488248
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x49f3b0
call sub.kernel32.dll_EnterCriticalSection
xor eax, eax
push ebp
push 0x488211
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00487b58
test al, al
je 0x48815c
call fcn.00404f70
jmp 0x488218
push dword [ebp - 4]
push 0x488260
push dword [ebp - 8]
push 0x488260
push dword [ebp - 0xc]
push 0x488260
push dword [ebp + 8]
push 0x48826c
lea eax, [ebp - 0x10]
mov edx, 8
call fcn.004058e0
mov edx, dword [ebp - 0x10]
mov eax, dword [0x49f3ac]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x10
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov esi, eax
mov ebx, esi
mov eax, dword [ebp - 8]
call fcn.00409ee4
mov dword [ebx], eax
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.00409b84
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 4]
call fcn.00405584
lea edx, [ebp - 0x1c]
mov eax, dword [ebp + 8]
call fcn.00409b84
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 8]
call fcn.00405584
xor eax, eax
mov dword [ebx + 0xc], eax
lea eax, [ebp - 0x14]
push eax
push 0
push esi
push 0x48766c
push 0
push 0
call sub.kernel32.dll_CreateThread_1
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x488218
push 0x49f3b0
call sub.kernel32.dll_LeaveCriticalSection
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48824f
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00405554
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00405554
lea eax, [ebp + 8]
call fcn.00405530
ret

Function at 0x488724
Capabilities:
Power down monitor

Disassembly:
push ebx
mov ebx, eax
cmp byte [ebx + 0x50], 0
je 0x488734
xor eax, eax
call fcn.0048a6dc
cmp byte [ebx + 0x51], 0
je 0x488741
xor eax, eax
call fcn.0048a830
cmp byte [ebx + 0x52], 0
je 0x48875d
push 2
push 0xf170
push 0x112
push 0xffff
call sub.user32.dll_SendMessageA
cmp byte [ebx + 0x53], 0
je 0x48876a
mov al, 1
call fcn.0048b9f0
pop ebx
ret

Function at 0x489544
Capabilities:
Create process on windows

Disassembly:
sub eax, 1
jb 0x489555
je 0x48956d
sub eax, 2
je 0x489585
dec eax
je 0x48958b
jmp 0x489590
push 5
push 0
push 0
push 0x489594
push 0x48959c
push 0
call sub.shell32.dll_ShellExecuteA
ret
push 5
push 0
push 0
push 0x4895a4
push 0x48959c
push 0
call sub.shell32.dll_ShellExecuteA
ret
call fcn.00461ba4
ret
call fcn.00461bdc
ret
Function at 0x48a0a4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.004059cc
xor eax, eax
push ebp
push 0x48a11e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [esi + 0x48], 0
je 0x48a108
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x48a0d9
sub ebx, 4
mov ebx, dword [ebx]
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
call fcn.004059dc
push eax
mov eax, dword [esi + 0x40]
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x48a134
mov eax, dword [esi + 0x40]
push eax
call sub.kernel32.dll_WriteFile_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48a125
lea eax, [ebp - 4]
call fcn.00405530
ret

Function at 0x48a3f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x48a49f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x104
call fcn.00405c6c
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x48a422
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [ebp - 4]
call fcn.004059dc
push eax
push ebx
call sub.kernel32.dll_GetTempPathA
mov edx, eax
lea eax, [ebp - 4]
call fcn.00405c6c
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x48a447
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 8]
push eax
mov ecx, 1
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00405a44
mov eax, dword [ebp - 8]
mov edx, 0x48a4b4
call fcn.00405974
je 0x48a47a
mov eax, esi
mov ecx, 0x48a4b4
mov edx, dword [ebp - 4]
call fcn.00405864
jmp 0x48a484
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00405584
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48a4a6
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405554
ret

Function at 0x48a4b8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x48a567
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x104
call fcn.00405c6c
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x48a4ea
sub ebx, 4
mov ebx, dword [ebx]
push ebx
mov eax, dword [ebp - 4]
call fcn.004059dc
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov edx, eax
lea eax, [ebp - 4]
call fcn.00405c6c
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x48a50f
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 8]
push eax
mov ecx, 1
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00405a44
mov eax, dword [ebp - 8]
mov edx, 0x48a57c
call fcn.00405974
je 0x48a542
mov eax, esi
mov ecx, 0x48a57c
mov edx, dword [ebp - 4]
call fcn.00405864
jmp 0x48a54c
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00405584
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48a56e
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405554
ret
Function at 0x48a580
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x48a62f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x104
call fcn.00405c6c
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x48a5b2
sub ebx, 4
mov ebx, dword [ebx]
push ebx
mov eax, dword [ebp - 4]
call fcn.004059dc
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, eax
lea eax, [ebp - 4]
call fcn.00405c6c
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x48a5d7
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 8]
push eax
mov ecx, 1
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00405a44
mov eax, dword [ebp - 8]
mov edx, 0x48a644
call fcn.00405974
je 0x48a60a
mov eax, esi
mov ecx, 0x48a644
mov edx, dword [ebp - 4]
call fcn.00405864
jmp 0x48a614
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00405584
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48a636
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405554
ret

Function at 0x48a648
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059cc
xor eax, eax
push ebp
push 0x48a6b5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, 0x48a6c8
call fcn.00405864
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
push 0x48a6cc
push 0x48a6d4
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48a6bc
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405554
ret

Function at 0x48a8c0
Capabilities:
Shutdown system

Disassembly:
push ebx
add esp, 0xffffffd8
mov ebx, eax
mov eax, dword [0x495d18]
cmp dword [eax], 2
jne 0x48a93a
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x48a93a
lea eax, [esp + 0xc]
push eax
push 0x48a950
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
cmp eax, 1
sbb eax, eax
inc eax
mov dword [esp + 8], 1
mov dword [esp + 0x14], 2
mov edx, 0x10
xor ecx, ecx
mov dword [esp + 4], ecx
test al, al
je 0x48a93a
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x1c]
push eax
push edx
lea eax, [esp + 0x14]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
push 0
push ebx
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x28
pop ebx
ret
Function at 0x48aa68
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.004059cc
xor eax, eax
push ebp
push 0x48aaf4
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x3c
call fcn.00403af4
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x3c], 0x500
mov eax, dword [ebp - 4]
call fcn.004059dc
mov dword [ebp - 0x30], eax
mov eax, 0x48ab04
mov dword [ebp - 0x34], eax
mov eax, 0x48ab0c
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], 1
lea eax, [ebp - 0x40]
push eax
call sub.shell32.dll_ShellExecuteExA
test eax, eax
je 0x48aade
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48aafb
lea eax, [ebp - 4]
call fcn.00405530
ret

Function at 0x48ac18
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059cc
xor eax, eax
push ebp
push 0x48aca0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x22]
xor ecx, ecx
mov edx, 0x1e
call fcn.00403af4
mov dword [ebp - 0x1e], 3
lea eax, [ebp - 0x28]
mov ecx, 0x48acb8
mov edx, dword [ebp - 4]
call fcn.00405864
mov eax, dword [ebp - 0x28]
call fcn.004059dc
mov dword [ebp - 0x1a], eax
mov word [ebp - 0x12], 0x54
lea eax, [ebp - 0x22]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48aca7
lea eax, [ebp - 0x28]
call fcn.00405530
lea eax, [ebp - 4]
call fcn.00405530
ret
Function at 0x48b0fc
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc7c
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
mov eax, ebx
call fcn.0040a274
test al, al
jne 0x48b122
mov byte [ebp - 1], 0
jmp 0x48b2f2
lea eax, [ebp - 0x119]
mov edx, edi
call fcn.0040a930
lea eax, [ebp - 0x21e]
mov edx, ebx
call fcn.0040a930
lea eax, [ebp - 0x323]
mov edx, esi
call fcn.0040a930
xor eax, eax
push ebp
push 0x48b2eb
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x384]
xor ecx, ecx
mov edx, 0xc
call fcn.00403af4
mov dword [ebp - 0x384], 0xc
xor eax, eax
mov dword [ebp - 0x380], eax
mov dword [ebp - 0x37c], 0xffffffff
push 0
push pe_nt_image_headers32
push 4
lea eax, [ebp - 0x384]
push eax
push 3
push 0xc0000000
lea eax, [ebp - 0x21e]
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x48b1bf
mov byte [ebp - 1], 0
call fcn.00404f70
jmp 0x48b2f2
push 0
push pe_nt_image_headers32
push 2
lea eax, [ebp - 0x384]
push eax
push 3
push 0xc0000000
lea eax, [ebp - 0x323]
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x48b1f9
mov byte [ebp - 1], 0
call fcn.00404f70
jmp 0x48b2f2
lea eax, [ebp - 0x368]
xor ecx, ecx
mov edx, 0x44
call fcn.00403af4
mov dword [ebp - 0x368], 0x44
mov dword [ebp - 0x33c], 0x101
mov word [ebp - 0x338], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x32c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x330], eax
lea eax, [ebp - 0x378]
push eax
lea eax, [ebp - 0x368]
push eax
push 0
push 0
push 0x110
push 0xffffffffffffffff
push 0
push 0
lea eax, [ebp - 0x119]
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x48b296
push 0xffffffffffffffff
mov eax, dword [ebp - 0x378]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x378]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x374]
mov dword [ebp - 0xc], eax
jmp 0x48b2a1
mov byte [ebp - 1], 0
call fcn.00404f70
jmp 0x48b2f2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48b2f2
cmp dword [ebp - 0x14], 0
je 0x48b2bd
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle_1
cmp dword [ebp - 0x10], 0
je 0x48b2cc
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
cmp dword [ebp - 0xc], 0
je 0x48b2db
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
cmp dword [ebp - 8], 0
je 0x48b2ea
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x48b3a8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059cc
mov eax, dword [ebp - 8]
call fcn.004059cc
xor eax, eax
push ebp
push 0x48b457
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x48b435
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0040a274
test al, al
je 0x48b3fa
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
call sub.kernel32.dll_DeleteFileA
mov dl, 1
mov eax, dword [0x41783c]
call fcn.00404620
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x74]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48b43c
mov eax, dword [ebp - 0xc]
call fcn.00404650
ret

Function at 0x48b464
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48b5b0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00405530
mov eax, 0x320
call fcn.00402f00
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x48b4ba
mov eax, 0x48b5c8
call fcn.0048a380
lea eax, [ebp - 0x10]
push eax
push 0x320
mov eax, dword [ebp - 0xc]
push eax
push 3
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x48b4e0
mov eax, 0x48b5e8
call fcn.0048a380
mov eax, 0xff
call fcn.00402f00
mov ebx, eax
mov eax, 0xff
call fcn.00402f00
mov esi, eax
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
dec edi
test edi, edi
jl 0x48b57f
inc edi
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], 0xff
mov dword [ebp - 0x18], 0xff
lea eax, [ebp - 0x18]
push eax
push ebx
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0xc]
lea eax, [edx + eax*4 + 4]
push eax
push 0
call sub.advapi32.dll_LookupPrivilegeNameA
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
push esi
push ebx
push 0
call sub.advapi32.dll_LookupPrivilegeDisplayNameA
mov eax, dword [ebp - 4]
push dword [eax]
lea eax, [ebp - 0x24]
mov edx, ebx
call fcn.00405728
push dword [ebp - 0x24]
push 0x48b60c
lea eax, [ebp - 0x28]
mov edx, esi
call fcn.00405728
push dword [ebp - 0x28]
push 0x48b618
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.004058e0
inc dword [ebp - 0x14]
dec edi
jne 0x48b50a
mov eax, ebx
call fcn.00402f1c
mov eax, esi
call fcn.00402f1c
mov eax, dword [ebp - 0xc]
call fcn.00402f1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48b5b7
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00405554
ret
Function at 0x48b61c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 4], ecx
mov esi, edx
xor edx, edx
push ebp
push 0x48b6dc
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 8]
push edx
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x10d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea edx, [ebp - 4]
lea eax, [ebp - 0x10d]
call fcn.0040aab0
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x48b678
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0x114]
push eax
mov ecx, 1
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00405a44
mov eax, dword [ebp - 0x114]
mov edx, 0x48b6f4
call fcn.00405974
je 0x48b6b1
mov eax, esi
mov ecx, 0x48b6f4
mov edx, dword [ebp - 4]
call fcn.00405864
jmp 0x48b6bb
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00405584
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48b6e3
lea eax, [ebp - 0x114]
call fcn.00405530
lea eax, [ebp - 4]
call fcn.00405530
ret

Function at 0x48b838
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0x48b943
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x320
call fcn.00402f00
mov edi, eax
lea eax, [ebp - 4]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x48b87c
push 1
call sub.kernel32.dll_Sleep_2
lea eax, [ebp - 8]
push eax
push 0x320
push edi
push 3
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x48b89c
push 1
call sub.kernel32.dll_Sleep_2
mov eax, 0xff
call fcn.00402f00
mov ebx, eax
mov eax, 0xff
call fcn.00402f00
mov dword [ebp - 0x10], eax
mov esi, dword [edi]
dec esi
test esi, esi
jl 0x48b917
inc esi
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], 0xff
mov dword [ebp - 0x14], 0xff
lea eax, [ebp - 0x14]
push eax
push ebx
mov eax, dword [ebp - 0xc]
lea eax, [eax + eax*2]
lea eax, [edi + eax*4 + 4]
push eax
push 0
call sub.advapi32.dll_LookupPrivilegeNameA
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x10]
push eax
push ebx
push 0
call sub.advapi32.dll_LookupPrivilegeDisplayNameA
lea eax, [ebp - 0x20]
mov edx, ebx
call fcn.00405728
mov eax, dword [ebp - 0x20]
mov dl, 1
call fcn.0048b6f8
inc dword [ebp - 0xc]
dec esi
jne 0x48b8c4
mov eax, ebx
call fcn.00402f1c
mov eax, dword [ebp - 0x10]
call fcn.00402f1c
mov eax, edi
call fcn.00402f1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48b94a
lea eax, [ebp - 0x20]
call fcn.00405530
ret