joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e8b40
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6acce2
mov eax, dword fs:[0]
push eax
sub esp, 0x468
mov eax, dword [0x778400]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x468], eax
mov dword [ebp - 0x460], 0x22c
lea eax, [ebp - 0x460]
push eax
mov ecx, dword [ebp - 0x468]
push ecx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x4e8ba2
xor eax, eax
jmp 0x4e8cf4
lea edx, [ebp - 0x460]
push edx
mov eax, dword [ebp - 0x468]
push eax
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x4e8cf2
lea ecx, [ebp - 0x43c]
mov dword [ebp - 0x474], ecx
mov edx, dword [ebp - 0x474]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00672162
add esp, 8
test eax, eax
jne 0x4e8ced
mov ecx, dword [ebp - 0x458]
mov dword [ebp - 0x46c], ecx
cmp dword [ebp + 0xc], 0
je 0x4e8ce6
lea ecx, [ebp - 0x234]
call fcn.00419520
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x46c]
push edx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x464], eax
cmp dword [ebp - 0x464], 0
je 0x4e8c8b
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x208
push 0
lea ecx, [ebp - 0x21a]
push ecx
call fcn.0066eb10
add esp, 0xc
push 0x104
lea edx, [ebp - 0x21c]
push edx
push 0
mov eax, dword [ebp - 0x464]
push eax
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x4e8c7e
lea ecx, [ebp - 0x21c]
push ecx
lea ecx, [ebp - 0x234]
call fcn.00415810
mov edx, dword [ebp - 0x464]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x234]
call fcn.00419090
movzx eax, al
test eax, eax
jne 0x4e8cd4
push 0
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x234]
call fcn.00444e80
mov dword [ebp - 0x470], eax
cmp dword [ebp - 0x470], 0xffffffff
jne 0x4e8cd4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x234]
call fcn.00419320
jmp 0x4e8ba2
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x234]
call fcn.00419320
mov eax, 1
jmp 0x4e8cf4
jmp 0x4e8ba2
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0066c98d
mov esp, ebp
pop ebp
ret
Function at 0x4e8d10
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6acd15
mov eax, dword fs:[0]
push eax
sub esp, 0x46c
mov eax, dword [0x778400]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x46c], eax
mov dword [ebp - 0x460], 0x22c
lea eax, [ebp - 0x460]
push eax
mov ecx, dword [ebp - 0x46c]
push ecx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x4e8d72
xor eax, eax
jmp 0x4e8ef7
lea edx, [ebp - 0x460]
push edx
mov eax, dword [ebp - 0x46c]
push eax
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x4e8ef5
lea ecx, [ebp - 0x43c]
mov dword [ebp - 0x474], ecx
mov edx, dword [ebp - 0x474]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00672162
add esp, 8
test eax, eax
jne 0x4e8ef0
mov ecx, dword [ebp - 0x458]
mov dword [ebp - 0x470], ecx
cmp dword [ebp + 0xc], 0
je 0x4e8eb6
lea ecx, [ebp - 0x234]
call fcn.00419520
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x470]
push edx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x464], eax
cmp dword [ebp - 0x464], 0
je 0x4e8e5b
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x208
push 0
lea ecx, [ebp - 0x21a]
push ecx
call fcn.0066eb10
add esp, 0xc
push 0x104
lea edx, [ebp - 0x21c]
push edx
push 0
mov eax, dword [ebp - 0x464]
push eax
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x4e8e4e
lea ecx, [ebp - 0x21c]
push ecx
lea ecx, [ebp - 0x234]
call fcn.00415810
mov edx, dword [ebp - 0x464]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x234]
call fcn.00419090
movzx eax, al
test eax, eax
jne 0x4e8ea4
push 0
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x234]
call fcn.00444e80
mov dword [ebp - 0x478], eax
cmp dword [ebp - 0x478], 0xffffffff
jne 0x4e8ea4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x234]
call fcn.00419320
jmp 0x4e8d72
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x234]
call fcn.00419320
mov edx, dword [ebp - 0x470]
push edx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x468], eax
push 0
mov eax, dword [ebp - 0x468]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 0x468]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x4e8ef7
jmp 0x4e8d72
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0066c98d
mov esp, ebp
pop ebp
ret
Function at 0x4e8f10
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6acd50
mov eax, dword fs:[0]
push eax
sub esp, 0x2cc
mov eax, dword [0x778400]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x28]
call fcn.00418f80
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.004188e0
sub eax, 1
push eax
lea ecx, [ebp - 0x28]
call fcn.004f1b60
movzx ecx, word [eax]
cmp ecx, 0x5c
je 0x4e8f74
push 0x5c
lea ecx, [ebp - 0x28]
call fcn.004efef0
lea edx, [ebp - 0x278]
push edx
push 0x6c0868
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x2a8]
push ecx
call fcn.00427830
add esp, 0xc
mov dword [ebp - 0x28c], eax
mov ecx, dword [ebp - 0x28c]
call fcn.0041b040
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x280], eax
lea ecx, [ebp - 0x2a8]
call fcn.00419320
cmp dword [ebp - 0x280], 0xffffffff
jne 0x4e8fe6
mov byte [ebp - 0x27a], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00419320
mov al, byte [ebp - 0x27a]
jmp 0x4e910b
mov edx, dword [ebp - 0x278]
and edx, 0x10
je 0x4e907a
push 0x6c0870
lea eax, [ebp - 0x24c]
push eax
call fcn.00672162
add esp, 8
test eax, eax
je 0x4e9078
push 0x6c0874
lea ecx, [ebp - 0x24c]
push ecx
call fcn.00672162
add esp, 8
test eax, eax
je 0x4e9078
lea edx, [ebp - 0x24c]
push edx
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x2d8]
push ecx
call fcn.00427830
add esp, 0xc
mov dword [ebp - 0x288], eax
mov edx, dword [ebp - 0x288]
mov dword [ebp - 0x284], edx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x284]
call fcn.0041b040
push eax
call fcn.004e8f10
add esp, 4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2d8]
call fcn.00419320
jmp 0x4e90b7
lea eax, [ebp - 0x24c]
push eax
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x2c0]
push edx
call fcn.00427830
add esp, 0xc
mov dword [ebp - 0x290], eax
mov ecx, dword [ebp - 0x290]
call fcn.0041b040
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x2c0]
call fcn.00419320
lea eax, [ebp - 0x278]
push eax
mov ecx, dword [ebp - 0x280]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4e8fe6
mov edx, dword [ebp - 0x280]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x28]
call fcn.0041b040
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov byte [ebp - 0x279], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00419320
mov al, byte [ebp - 0x279]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0066c98d
mov esp, ebp
pop ebp
ret
Function at 0x4e9320
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x778400]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x20c], ax
push 0x206
push 0
lea ecx, [ebp - 0x20a]
push ecx
call fcn.0066eb10
add esp, 0xc
mov edx, dword [ebp + 8]
mov dword [ebp - 0x210], edx
cmp dword [ebp - 0x210], 3
ja case.default.0x4e936a
mov eax, dword [ebp - 0x210]
jmp dword [eax*4 + 0x4e9408]
lea ecx, [ebp - 0x20c]
push ecx
call fcn.004ecac0
add esp, 4
jmp 0x4e93c4
lea edx, [ebp - 0x20c]
push edx
call fcn.004ecb90
add esp, 4
jmp 0x4e93c4
lea eax, [ebp - 0x20c]
push eax
call fcn.004ecbf0
add esp, 4
jmp 0x4e93c4
lea ecx, [ebp - 0x20c]
push ecx
call fcn.004ecb20
add esp, 4
jmp 0x4e93c4
lea edx, [ebp - 0x20c]
push edx
call fcn.004ecc50
add esp, 4
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4e93d9
xor al, al
jmp 0x4e93f9
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0066c98d
mov esp, ebp
pop ebp
ret

Function at 0x4e94a0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x778400]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 8], 0
xor eax, eax
mov word [ebp - 7], ax
mov byte [ebp - 5], al
mov ecx, 1
imul edx, ecx, 0
mov al, byte [ebp + 8]
mov byte [ebp + edx - 8], al
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 8], 0x3a
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 8], 0x5c
mov eax, 1
imul ecx, eax, 3
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], 4
jae 0x4e94f8
jmp 0x4e94fd
call fcn.0066e9b7
mov edx, dword [ebp - 0x24]
mov byte [ebp + edx - 8], 0
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
jne 0x4e9525
xor eax, eax
xor edx, edx
jmp 0x4e9551
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
call fcn.0067291e
divsd xmm0, qword [0x744518]
divsd xmm0, qword [0x744518]
call fcn.0067280f
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0066c98d
mov esp, ebp
pop ebp
ret
Function at 0x4e9980
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6ace97
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x778400]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
lea ecx, [ebp - 0x50]
call fcn.00419d50
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x30]
push edx
lea eax, [ebp - 0x28]
push eax
call fcn.00448780
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x50]
call fcn.00419eb0
lea ecx, [ebp - 0x28]
call fcn.0041af60
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x2c], 1
lea ecx, [ebp - 0x28]
call fcn.00419eb0
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0066c98d
mov esp, ebp
pop ebp
ret
Function at 0x4e9e80
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x778400]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.004ed210
test eax, eax
je 0x4e9ea2
call fcn.004ed2b0
test eax, eax
jne 0x4e9ee0
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x6c0c00
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0x20
jle 0x4e9ed1
mov dword [ebp - 0x68], 1
jmp 0x4e9ed8
mov dword [ebp - 0x68], 0
mov eax, dword [ebp - 0x68]
jmp 0x4e9fd6
call fcn.004ed140
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jne 0x4e9ef5
xor eax, eax
jmp 0x4e9fd6
mov ecx, dword [0x781d0c]
and ecx, 1
jne 0x4e9f1f
mov edx, dword [0x781d0c]
or edx, 1
mov dword [0x781d0c], edx
push 0x6c0c24
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x781d08], eax
cmp dword [0x781d08], 0
jne 0x4e9f39
mov eax, dword [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4e9fd6
push str.CreateProcessWithTokenW
mov ecx, dword [0x781d08]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jne 0x4e9f62
mov edx, dword [ebp - 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4e9fd6
mov dword [ebp - 0x48], 0x44
push 0x40
push 0
lea eax, [ebp - 0x44]
push eax
call fcn.0066eb10
add esp, 0xc
mov dword [ebp - 0x58], 0
xor ecx, ecx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
lea edx, [ebp - 0x58]
push edx
lea eax, [ebp - 0x48]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 0
push 0x20
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push 1
mov ecx, dword [ebp - 0x5c]
push ecx
call dword [ebp - 0x64]
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
je 0x4e9fc9
mov edx, dword [ebp - 0x58]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x5c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0066c98d
mov esp, ebp
pop ebp
ret
Function at 0x4eb6a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x778400]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x210], 0
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push 5
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.Downloads
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp dword [ebp + 0x14], 0
je 0x4eb717
lea edx, [ebp - 0x20c]
push edx
call fcn.00503b50
add esp, 4
cmp dword [ebp + 0x10], 0
je 0x4eb72e
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [ebp - 0x20c]
push edx
mov ecx, dword [ebp + 8]
call fcn.00418f80
mov eax, dword [ebp - 0x210]
or eax, 1
mov dword [ebp - 0x210], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0066c98d
mov esp, ebp
pop ebp
ret
Function at 0x4eb7e0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
mov eax, dword [0x778400]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x130], 0
lea eax, [ebp - 0x130]
push eax
push 0x64
push 0
call sub.NETAPI32.dll_NetWkstaGetInfo
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0
jne 0x4eb892
mov ecx, dword [ebp - 0x130]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x14c], edx
mov eax, dword [ebp - 0x130]
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x148], ecx
mov edx, dword [ebp - 0x14c]
mov dword [ebp - 0x134], edx
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x138], eax
mov ecx, dword [ebp - 0x130]
push ecx
call sub.NETAPI32.dll_NetApiBufferFree
mov edx, dword [ebp - 0x148]
push edx
mov eax, dword [ebp - 0x14c]
push eax
push 0x6c08d0
call fcn.004e64c0
add esp, 0xc
jmp 0x4eb94b
push 0x6c08e8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0
je 0x4eb913
push 0x6c08f4
mov ecx, dword [ebp - 0x13c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0
je 0x4eb913
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
call dword [ebp - 0x140]
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
push str.Window_Version_:__d__d
call fcn.004e64c0
add esp, 0xc
mov ecx, dword [ebp - 0x13c]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [ebp - 8]
mov dword [ebp - 0x134], edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x134], 0
jne 0x4eb94b
mov dword [ebp - 0x12c], 0x11c
lea ecx, [ebp - 0x12c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov edx, dword [ebp - 0x128]
mov dword [ebp - 0x134], edx
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x134], 6
jbe 0x4eb95d
mov eax, 1
jmp 0x4eb991
cmp dword [ebp - 0x134], 6
jne 0x4eb98f
cmp dword [ebp - 0x138], 1
jb 0x4eb97b
mov dword [ebp - 0x144], 1
jmp 0x4eb985
mov dword [ebp - 0x144], 0
mov eax, dword [ebp - 0x144]
jmp 0x4eb991
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0066c98d
mov esp, ebp
pop ebp
ret

Function at 0x4ebe10
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
push str.Do_Restart_...
call fcn.004e64c0
add esp, 4
call fcn.004ebd20
test eax, eax
jne 0x4ebe36
push str.Get_privilege_fail__
call fcn.004e64c0
add esp, 4
push 0
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
pop ebp
ret
Function at 0x4ec7d0
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6ad3fe
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x778400]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 0x14], 0
je 0x4ec886
call fcn.004ec780
test eax, eax
je 0x4ec886
push str.ProgramW6432
call fcn.0067255d
add esp, 4
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x4ec874
lea ecx, [ebp - 0x28]
call fcn.00419520
mov dword [ebp - 4], 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x30], esp
mov eax, dword [ebp - 0x2c]
push eax
call fcn.00419d50
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0x28]
push ecx
call fcn.004ec550
add esp, 0x1c
lea ecx, [ebp - 0x28]
call fcn.0041b040
push eax
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00419320
jmp 0x4ec884
push 0
push 0x26
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
jmp 0x4ec896
push 0
push 0x26
mov ecx, dword [ebp + 8]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp dword [ebp + 0x10], 0
je 0x4ec8b6
mov ecx, dword [ebp + 8]
push ecx
call fcn.00503b50
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0066c98d
mov esp, ebp
pop ebp
ret

Function at 0x4ecb90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x778400]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 2
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x4ecbd2
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [ebp - 0xc]
jmp 0x4ecbd4
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0066c98d
mov esp, ebp
pop ebp
ret
Function at 0x4ed040
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x778400]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x20c], ax
push 0x206
push 0
lea ecx, [ebp - 0x20a]
push ecx
call fcn.0066eb10
add esp, 0xc
mov edx, dword [ebp + 8]
mov dword [ebp - 0x210], edx
cmp dword [ebp - 0x210], 3
ja case.default.0x4ed08a
mov eax, dword [ebp - 0x210]
jmp dword [eax*4 + 0x4ed12c]
lea ecx, [ebp - 0x20c]
push ecx
call fcn.004ecac0
add esp, 4
jmp 0x4ed0e4
lea edx, [ebp - 0x20c]
push edx
call fcn.004ecb90
add esp, 4
jmp 0x4ed0e4
lea eax, [ebp - 0x20c]
push eax
call fcn.004ecbf0
add esp, 4
jmp 0x4ed0e4
lea ecx, [ebp - 0x20c]
push ecx
call fcn.004ecb20
add esp, 4
jmp 0x4ed0e4
lea edx, [ebp - 0x20c]
push edx
call fcn.004ecc50
add esp, 4
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4ed0f9
xor al, al
jmp 0x4ed11b
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call fcn.004e8f10
add esp, 4
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0066c98d
mov esp, ebp
pop ebp
ret

Function at 0x4ed140
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x778400]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4ed174
xor eax, eax
jmp 0x4ed1f8
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [ebp - 0xc], 0
jne 0x4ed18c
xor eax, eax
jmp 0x4ed1f8
mov edx, dword [ebp - 0xc]
push edx
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4ed1aa
xor eax, eax
jmp 0x4ed1f8
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 2
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push 1
push 2
push 0
push 0xf01ff
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0066c98d
mov esp, ebp
pop ebp
ret
Function at 0x4ed210
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x778400]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x120], 0x11c
push pe_nt_image_headers32
push 0
lea eax, [ebp - 0x11c]
push eax
call fcn.0066eb10
add esp, 0xc
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x4ed273
mov dword [ebp - 0x120], 0x114
lea edx, [ebp - 0x120]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x4ed273
xor eax, eax
jmp 0x4ed298
cmp dword [ebp - 0x11c], 6
jb 0x4ed288
mov dword [ebp - 0x124], 1
jmp 0x4ed292
mov dword [ebp - 0x124], 0
mov eax, dword [ebp - 0x124]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0066c98d
mov esp, ebp
pop ebp
ret

Function at 0x4ed2b0
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x778400]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x10], 0
mov byte [ebp - 0xc], 0
mov byte [ebp - 0xb], 0
mov byte [ebp - 0xa], 0
mov byte [ebp - 9], 0
mov byte [ebp - 8], 0
mov byte [ebp - 7], 5
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea ecx, [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x4ed33f
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x14]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x4ed328
mov dword [ebp - 0x18], 0
cmp dword [ebp - 0x10], 0
je 0x4ed335
mov dword [ebp - 0x18], 1
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0066c98d
mov esp, ebp
pop ebp
ret