joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c2078
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x4c2080
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4c2272
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x4c2288
mov eax, esi
call fcn.004bfe08
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.0040460c
lea ecx, [ebp - 0x10]
mov edx, 0x4c229c
mov eax, esi
call fcn.004bfe08
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.0040460c
lea ecx, [ebp - 0x14]
mov edx, 0x4c22b4
mov eax, esi
call fcn.004bfe08
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.0040460c
lea ecx, [ebp - 0x18]
mov edx, 0x4c22d0
mov eax, esi
call fcn.004bfe08
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.0040460c
lea ecx, [ebp - 0x1c]
mov edx, 0x4c22ec
mov eax, esi
call fcn.004bfe08
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.0040460c
lea ecx, [ebp - 0x24]
mov edx, 0x4c2304
mov eax, esi
call fcn.004bfe08
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.0040906c
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.004094cc
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x4c231c
mov eax, esi
call fcn.004bfe08
mov eax, dword [ebp - 0x28]
call fcn.004bef20
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x4c232c
mov eax, esi
call fcn.004bfe08
mov eax, dword [ebp - 0x2c]
call fcn.004bef20
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x4c2344
mov eax, esi
call fcn.004bfe08
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.004094cc
inc eax
je 0x4c2215
lea ecx, [ebp - 0x34]
mov edx, 0x4c2344
mov eax, esi
call fcn.004bfe08
mov eax, dword [ebp - 0x34]
call fcn.00409490
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040ad78
fstp qword [ebp - 0x3c]
wait
call fcn.0040b13c
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x4c2230
lea ecx, [ebp - 0x40]
mov edx, 0x4c2344
mov eax, esi
call fcn.004bfe08
mov eax, dword [ebp - 0x40]
call fcn.004bef20
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x4c2354
mov eax, esi
call fcn.004bfe08
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.0040460c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c2279
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.004045dc
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.004045dc
ret
Function at 0x4d194c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a74
xor eax, eax
push ebp
push 0x4d1a15
push dword fs:[eax]
mov dword fs:[eax], esp
mov cl, 1
mov dl, 1
mov eax, dword [0x4d17e0]
call fcn.0041f2ec
mov ebx, eax
mov byte [ebx + 0xf], 1
lea eax, [ebx + 0x38]
mov edx, dword [ebp - 4]
call fcn.0040460c
xor eax, eax
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x40], esi
call sub.kernel32.dll_GetTickCount
mov edi, eax
mov byte [ebx + 0x3c], 1
mov byte [ebx + 0x3d], 0
mov eax, ebx
call fcn.0041f638
jmp 0x4d19dc
call sub.kernel32.dll_GetTickCount
sub eax, edi
lea edx, [esi + 0x7d0]
cmp eax, edx
ja 0x4d19e2
cmp byte [ebp + 8], 0
jne 0x4d19d5
mov eax, dword [0x540b3c]
mov eax, dword [eax]
call fcn.00448084
push 1
call sub.kernel32.dll_Sleep
cmp byte [ebx + 0x3c], 1
je 0x4d19b2
cmp byte [ebx + 0x3c], 2
sete byte [ebp - 9]
cmp byte [ebp - 9], 0
je 0x4d19fb
mov eax, dword [ebp - 8]
mov edx, dword [ebx + 0x34]
call fcn.0040460c
mov byte [ebx + 0x3d], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d1a1c
lea eax, [ebp - 4]
call fcn.004045b8
ret
Function at 0x4d3268
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffeb8
mov ebx, ecx
mov ebp, edx
mov esi, eax
xor edi, edi
push edi
lea eax, [esp + 8]
push eax
mov ecx, 0x4d348c
mov edx, 0x4d3490
mov eax, esi
call fcn.004d2f60
test al, al
jne 0x4d329c
xor eax, eax
jmp 0x4d3480
lea eax, [esp + 0xac]
xor ecx, ecx
mov edx, 0x9c
call fcn.00407bfc
mov word [esp + 0xd0], 0x9c
mov word [esp + 0xd2], 0
lea eax, [esp + 0xac]
push eax
mov eax, dword [0x53e21c]
push eax
push 0
call sub.user32.dll_EnumDisplaySettingsA
mov dword [esp + 0xd4], 0x1c0000
test ebx, ebx
je 0x4d3320
or dword [esp + 0xd4], 0x20
mov eax, dword [ebx]
lea edx, [esp + 0xd8]
mov dword [edx], eax
mov eax, dword [ebx + 4]
lea edx, [esp + 0xd8]
mov dword [edx + 4], eax
mov eax, dword [ebx + 8]
sub eax, dword [ebx]
mov dword [esp + 0x118], eax
mov eax, dword [ebx + 0xc]
sub eax, dword [ebx + 4]
mov dword [esp + 0x11c], eax
lea eax, [esp + 0xac]
xor ecx, ecx
mov edx, 0x20
call fcn.00403098
mov edx, 0x4d34a0
mov eax, esi
call fcn.004d317c
mov ebx, eax
test ebx, ebx
jne 0x4d334c
xor eax, eax
jmp 0x4d3480
push 0x4d34ac
push ebx
call sub.advapi32.dll_RegDeleteValueA
push 0x4d34c0
push ebx
call sub.advapi32.dll_RegDeleteValueA
test ebp, ebp
je 0x4d336f
mov dword [esp], 3
jmp 0x4d3374
xor eax, eax
mov dword [esp], eax
push 4
lea eax, [esp + 4]
push eax
push 4
push 0
push 0x4d34d0
push ebx
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x4d3395
xor eax, eax
jmp 0x4d3480
mov dword [esp], 1
push 4
lea eax, [esp + 4]
push eax
push 4
push 0
push 0x4d34e4
push ebx
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x4d33bd
xor eax, eax
jmp 0x4d3480
mov dword [esp], 1
push 4
lea eax, [esp + 4]
push eax
push 4
push 0
push 0x4d3500
push ebx
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x4d33e5
xor eax, eax
jmp 0x4d3480
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_GetThreadDesktop
mov ebp, eax
xor edi, edi
test ebp, ebp
je 0x4d3412
push 0x2000000
push 0
push 0
call sub.user32.dll_OpenInputDesktop
mov edi, eax
test edi, edi
je 0x4d3412
push edi
call sub.user32.dll_SetThreadDesktop
cmp dword [esp + 0x114], 0x18
jne 0x4d3427
mov dword [esp + 0x114], 0x20
push 0
push 1
push 0
lea eax, [esp + 0xb8]
push eax
lea eax, [esp + 0x18]
push eax
call sub.user32.dll_ChangeDisplaySettingsExA
push esi
push edi
lea edi, [esi + 4]
lea esi, [esp + 0xb4]
mov ecx, 0x27
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [esi + 0xa0]
lea edx, [esp + 8]
mov ecx, 0x20
call fcn.00404820
push ebp
call sub.user32.dll_SetThreadDesktop
test edi, edi
je 0x4d3478
push edi
call sub.user32.dll_CloseDesktop
push ebx
call sub.advapi32.dll_RegCloseKey_1
mov al, 1
add esp, 0x148
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4d3514
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffeb8
mov ebx, eax
lea eax, [ebx + 0xa0]
call fcn.004045b8
xor esi, esi
push esi
lea eax, [esp + 8]
push eax
mov ecx, 0x4d365c
mov edx, 0x4d3660
mov eax, ebx
call fcn.004d2f60
test al, al
je 0x4d3651
lea eax, [esp + 0xac]
xor ecx, ecx
mov edx, 0x9c
call fcn.00407bfc
mov word [esp + 0xd0], 0x9c
mov word [esp + 0xd2], 0
lea eax, [esp + 0xac]
push eax
mov eax, dword [0x53e21c]
push eax
push 0
call sub.user32.dll_EnumDisplaySettingsA
mov dword [esp + 0xd4], 0x1c0000
mov byte [esp + 0xac], 0
mov edx, 0x4d3670
mov eax, ebx
call fcn.004d317c
mov ebx, eax
test ebx, ebx
je 0x4d3651
xor eax, eax
mov dword [esp], eax
push 4
lea eax, [esp + 4]
push eax
push 4
push 0
push 0x4d367c
push ebx
call sub.advapi32.dll_RegSetValueExA
push 0x4d3690
push ebx
call sub.advapi32.dll_RegDeleteValueA
push 0x4d36a4
push ebx
call sub.advapi32.dll_RegDeleteValueA
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_GetThreadDesktop
mov edi, eax
xor esi, esi
test edi, edi
je 0x4d360e
push 0x2000000
push 0
push 0
call sub.user32.dll_OpenInputDesktop
mov esi, eax
test esi, esi
je 0x4d360e
push esi
call sub.user32.dll_SetThreadDesktop
cmp dword [esp + 0x114], 0x18
jne 0x4d3623
mov dword [esp + 0x114], 0x20
push 0
push 1
push 0
lea eax, [esp + 0xb8]
push eax
lea eax, [esp + 0x18]
push eax
call sub.user32.dll_ChangeDisplaySettingsExA
push edi
call sub.user32.dll_SetThreadDesktop
test esi, esi
je 0x4d364b
push esi
call sub.user32.dll_CloseDesktop
push ebx
call sub.advapi32.dll_RegCloseKey_1
add esp, 0x148
pop edi
pop esi
pop ebx
ret
Function at 0x4d3904
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
xor eax, eax
push ebp
push 0x4d3b2b
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0x53e23c], eax
xor eax, eax
mov dword [0x548388], eax
xor eax, eax
mov dword [0x54838c], eax
xor eax, eax
mov dword [0x548390], eax
xor eax, eax
mov dword [0x548394], eax
xor eax, eax
mov dword [0x548384], eax
xor eax, eax
mov dword [0x548398], eax
xor eax, eax
mov dword [0x54839c], eax
xor eax, eax
mov dword [0x5483a0], eax
xor eax, eax
mov dword [0x5483a4], eax
cmp dword [0x53e240], 0
je 0x4d3b0d
push 0x4d3b38
mov eax, dword [0x53e240]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x548388], eax
push 0x4d3b40
mov eax, dword [0x53e240]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x54838c], eax
push 0x4d3b48
mov eax, dword [0x53e240]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x548390], eax
push 0x4d3b50
mov eax, dword [0x53e240]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x548394], eax
push 0x4d3b58
mov eax, dword [0x53e240]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x548384], eax
push 0x4d3b60
mov eax, dword [0x53e240]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x548398], eax
push 0x4d3b70
mov eax, dword [0x53e240]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x54839c], eax
push 0x4d3b7c
mov eax, dword [0x53e240]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5483a0], eax
push 0x4d3b8c
mov eax, dword [0x53e240]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5483a4], eax
cmp dword [0x548388], 0
je 0x4d3b0d
cmp dword [0x54838c], 0
je 0x4d3b0d
cmp dword [0x548390], 0
je 0x4d3b0d
cmp dword [0x548394], 0
je 0x4d3b0d
cmp dword [0x548384], 0
je 0x4d3b0d
cmp dword [0x53e244], 0xffffffff
jne 0x4d3aa9
push 0
push 1
mov edx, dword [0x540c9c]
mov edx, dword [edx]
lea eax, [ebp - 8]
mov ecx, 0x4d3ba8
call fcn.004048d8
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.00404e90
mov eax, dword [ebp - 4]
mov edx, 0x4d3bbc
call fcn.0046d740
mov dword [0x53e244], eax
cmp dword [0x53e244], 2
jge 0x4d3ac1
push 0x58
push 0x6f401
call dword [0x548394]
jmp 0x4d3ad5
cmp dword [0x53e244], 2
jne 0x4d3ad5
push 0x51a7b0e
call dword [0x54838c]
mov dword [0x53e23c], 1
cmp dword [0x548398], 0
je 0x4d3b0d
cmp dword [0x54839c], 0
je 0x4d3b0d
cmp dword [0x5483a0], 0
je 0x4d3b0d
cmp dword [0x5483a4], 0
je 0x4d3b0d
mov dword [0x53e23c], 2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d3b32
lea eax, [ebp - 8]
call fcn.004045b8
lea eax, [ebp - 4]
call fcn.00404cf0
ret
Function at 0x4d58f0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov ebx, eax
mov byte [ebp - 1], 0
push 0x4d59b8
push 0xffffffffffffffff
push 4
call sub.kernel32.dll_OpenFileMappingA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4d59ae
xor eax, eax
push ebp
push 0x4d59a7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xa7e
push 0
push 0
push 4
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4d5990
xor eax, eax
push ebp
push 0x4d5989
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
xor ecx, ecx
mov edx, 0xa7e
call fcn.00403098
mov edx, ebx
mov eax, dword [ebp - 0xc]
mov ecx, 0xa7e
call fcn.00402974
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d5990
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_UnmapViewOfFile
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d59ae
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
mov al, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d8d28
Capabilities:
Reference cloudflare dns server

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4d8d30
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x4d8f36
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push edi
call sub.IPHLPAPI.DLL_GetAdaptersInfo_1
cmp eax, 0x6f
jne 0x4d8f0b
mov eax, dword [ebp - 0x14]
call fcn.00408d98
mov edi, eax
mov ebx, edi
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.IPHLPAPI.DLL_GetAdaptersInfo_1
test eax, eax
jne 0x4d8f04
test ebx, ebx
je 0x4d8f04
lea esi, [ebx + 0x1ac]
lea eax, [ebx + 0x1d4]
mov dword [ebp - 0x10], eax
test esi, esi
je 0x4d8efa
lea eax, [ebp - 0x20]
lea edx, [esi + 4]
mov ecx, 0x10
call fcn.00404820
mov eax, dword [ebp - 0x20]
mov edx, 0x4d8f4c
call fcn.004049d0
je 0x4d8efa
lea eax, [ebp - 0x24]
lea edx, [esi + 0x14]
mov ecx, 0x10
call fcn.00404820
mov eax, dword [ebp - 0x24]
mov edx, 0x4d8f5c
call fcn.004049d0
je 0x4d8efa
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
add edx, 4
mov ecx, 0x10
call fcn.00404820
mov eax, dword [ebp - 0x28]
mov edx, 0x4d8f4c
call fcn.004049d0
je 0x4d8efa
mov al, byte [0x4d8f6c]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
lea edx, [ebx + 8]
mov ecx, 0x104
call fcn.00404820
mov ecx, dword [ebp - 0x2c]
mov edx, 0x4d8f78
mov eax, 0x4d8f8c
call fcn.0040d9ec
lea ecx, [ebp - 0x18]
mov edx, 0x4d900c
mov eax, dword [ebp - 0x1c]
call fcn.0046c538
cmp dword [ebp - 0x18], 0
je 0x4d8efa
cmp byte [ebp - 1], 0
je 0x4d8e75
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
add edx, 4
mov ecx, 0x10
call fcn.00404820
jmp 0x4d8f04
mov eax, 0x5498b0
mov edx, dword [ebp - 0x18]
call fcn.0040460c
mov eax, 0x5498b4
lea edx, [esi + 4]
mov ecx, 0x10
call fcn.00404820
mov eax, 0x5498b8
lea edx, [esi + 0x14]
mov ecx, 0x10
call fcn.00404820
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0x10]
add edx, 4
mov ecx, 0x10
call fcn.00404820
mov eax, dword [ebp - 0xc]
mov edx, 0x4d901c
call fcn.004049d0
je 0x4d8f04
mov eax, 0x5498bc
mov edx, dword [ebp - 0xc]
call fcn.0040460c
lea eax, [ebp - 0x30]
mov edx, dword [0x5408e8]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0x30]
mov ecx, dword [0x5498bc]
mov edx, 0x4d902c
call fcn.0046dba4
jmp 0x4d8f04
mov ebx, dword [ebx]
test ebx, ebx
jne 0x4d8d8e
mov eax, edi
call fcn.004027dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d8f3d
lea eax, [ebp - 0x30]
call fcn.00404cf0
lea eax, [ebp - 0x2c]
mov edx, 6
call fcn.004045dc
lea eax, [ebp - 0xc]
call fcn.004045b8
ret
Function at 0x4d9034
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a74
xor eax, eax
push ebp
push 0x4d9172
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.004045b8
xor edi, edi
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push edi
push 0
push 0x1e
push 0
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
cmp eax, 0x6f
jne 0x4d915c
mov eax, dword [ebp - 0x10]
call fcn.00408d98
mov edi, eax
mov esi, edi
lea eax, [ebp - 0x10]
push eax
push edi
push 0
push 0x1e
push 0
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
test eax, eax
jne 0x4d9155
test esi, esi
je 0x4d9155
mov ebx, dword [esi + 0x10]
cmp dword [ebp - 8], 2
jne 0x4d90fc
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 4]
call fcn.00404adc
push eax
call sub.Ntdll.dll_RtlIpv4StringToAddressA
test ebx, ebx
je 0x4d914a
mov eax, dword [ebx + 0xc]
cmp word [eax], 2
jne 0x4d90f3
mov eax, dword [eax + 4]
cmp eax, dword [ebp - 0x2c]
jne 0x4d90f3
mov edx, dword [ebp - 0xc]
lea eax, [esi + 0x2c]
call fcn.004715a0
jmp 0x4d9155
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4d90d5
jmp 0x4d914a
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
call fcn.00404adc
push eax
call sub.Ntdll.dll_RtlIpv6StringToAddressA
test ebx, ebx
je 0x4d914a
mov eax, dword [ebx + 0xc]
cmp word [eax], 0x17
jne 0x4d9143
lea edx, [ebp - 0x28]
mov eax, dword [ebx + 0xc]
add eax, 8
mov ecx, 0x10
call fcn.00471e90
test eax, eax
jne 0x4d9143
mov edx, dword [ebp - 0xc]
lea eax, [esi + 0x2c]
call fcn.004715a0
jmp 0x4d9155
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4d9116
mov esi, dword [esi + 8]
test esi, esi
jne 0x4d90b0
mov eax, edi
call fcn.004027dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d9179
lea eax, [ebp - 4]
call fcn.004045b8
ret
Function at 0x4d98c0
Capabilities:
Create process on windows
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0xc], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4d9a24
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x53f320], 0x7d9
cmp si, 2
jne 0x4d991a
lea eax, [ebp - 0x20]
mov edx, dword [0x5408e8]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0xc]
mov edx, 0x4d9a3c
call fcn.0046da74
jmp 0x4d9946
cmp si, 8
je 0x4d9926
cmp si, 1
jne 0x4d9946
lea eax, [ebp - 0x24]
mov edx, dword [0x5408e8]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0xc]
mov edx, 0x4d9a4c
call fcn.0046da74
cmp dword [ebp - 0xc], 0
je 0x4d9961
push 1
lea eax, [ebp - 0xc]
call fcn.00404adc
push eax
call sub.kernel32.dll_WinExec
jmp 0x4d99f9
test si, 2
jne 0x4d9976
test si, 1
jne 0x4d9976
test si, 8
je 0x4d99df
lea eax, [ebp - 4]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x4d99df
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x28]
mov eax, 0x29
call fcn.004ab8e8
mov eax, dword [ebp - 0x28]
call fcn.00404a84
push eax
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle_1
test bl, bl
je 0x4d99e7
or si, 4
push 0
movzx eax, si
push eax
call sub.user32.dll_ExitWindowsEx
xor eax, eax
mov dword [0x53f320], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d9a2b
lea eax, [ebp - 0x28]
call fcn.004045b8
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00404d08
lea eax, [ebp - 0xc]
call fcn.004045b8
ret
Function at 0x4da798
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov byte [ebp - 1], cl
mov edi, edx
mov esi, eax
mov dword [0x53f320], 0x7e1
xor ebx, ebx
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00403098
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 0x101
mov ax, word [ebp + 8]
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push edi
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push esi
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x4da812
cmp byte [ebp - 1], 0
je 0x4da810
push 0x64
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x4da819
mov bl, 1
xor eax, eax
mov dword [0x53f320], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4e0270
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x4e03b1
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x54988c], 0
je 0x4e0361
mov dl, 1
mov eax, dword [0x414bcc]
call fcn.0040377c
mov edi, eax
mov edx, dword [0x549880]
mov eax, 0x4e03c8
call fcn.00404bc8
test eax, eax
jle 0x4e02e9
push 0x4e03d4
push dword [0x549880]
push 0x4e03e0
push dword [0x549884]
lea eax, [ebp - 8]
mov edx, 4
call fcn.0040494c
mov edx, dword [ebp - 8]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4e0316
push 0x4e03ec
push dword [0x549880]
push 0x4e03c8
push dword [0x549884]
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.0040494c
mov edx, dword [ebp - 0xc]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [0x540c9c]
mov edx, dword [edx]
lea eax, [ebp - 4]
mov ecx, 0x4e03fc
call fcn.004048d8
mov edx, dword [ebp - 4]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x74]
push 1
mov eax, dword [0x549888]
call fcn.00404a84
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00404a84
push eax
push 0x4e0408
mov eax, esi
call fcn.0045de44
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4e0396
push 1
mov eax, dword [0x549888]
call fcn.00404a84
push eax
mov eax, dword [0x549884]
call fcn.00404a84
push eax
mov eax, dword [0x549880]
call fcn.00404a84
push eax
push 0x4e0408
mov eax, esi
call fcn.0045de44
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e03b8
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004045dc
ret