joyce8/EMBER2024-capa huggingface dataset:
Function at 0x555480
Capabilities:
Manipulate safe mode programs

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f9ec2
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0
call fcn.005d6aa0
cmp byte [ebp + 8], 0
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
push 0
je 0x555527
push str.Service
push 1
push 0x62439c
push str.HKLMSYSTEMCurrentControlSetControlSafeBootMinimalmsiserver
call fcn.005d5be0
push 0
push str.Service
push 1
push 0x62439c
push str.HKLMSYSTEMCurrentControlSetControlSafeBootNetworkmsiserver
lea ecx, [ebp - 0x14]
movzx esi, al
call fcn.005d5be0
movzx eax, al
add esi, eax
cmp byte [ebp + 0xc], 0
je 0x55556e
push 0
push 0
test esi, esi
mov eax, str.Successfully_enabled
mov ecx, str.Failed_to_enable
push str._the_Windows_Installer_service_in_Safe_Mode_and_Safe_Mode_With_Networking.
cmove eax, ecx
push eax
jmp 0x555567
push str.HKLMSYSTEMCurrentControlSetControlSafeBootMinimalmsiserver
call fcn.005d55d0
push 0
push str.HKLMSYSTEMCurrentControlSetControlSafeBootNetworkmsiserver
lea ecx, [ebp - 0x14]
movzx esi, al
call fcn.005d55d0
movzx eax, al
add esi, eax
cmp byte [ebp + 0xc], 0
je 0x55556e
push 0
push 0
test esi, esi
mov ecx, str.Successfully_disabled
mov eax, str.Failed_to_disable
push str._the_Windows_Installer_service_in_Safe_Mode_and_Safe_Mode_With_Networking.
cmove ecx, eax
push ecx
mov ecx, edi
call fcn.0057b7e0
lea ecx, [ebp - 0x14]
call fcn.005d69e0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 8
Function at 0x5562a0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fa098
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push str.Uninstalling_RogueKiller...
push 0xffffffffffffffff
call fcn.0057b610
push 0
push 1
mov ecx, ebx
call fcn.005494d0
sub esp, 8
mov dword [ebp - 0x2c], 0
xorps xmm0, xmm0
mov ecx, ebx
movq qword [ebp - 0x34], xmm0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.RogueKiller
sub esp, 8
call fcn.0057c120
add esp, 4
lea ecx, [ebp - 0x34]
push eax
call fcn.005dc520
sub esp, 8
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x34]
movq qword [ebp - 0x28], xmm0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.unins000.exe
call fcn.005dc190
push eax
lea ecx, [ebp - 0x28]
call fcn.005dc520
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x1c]
movq qword [ebp - 0x1c], xmm0
call fcn.005dc5e0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x5563a4
push eax
push eax
push eax
push str.Failed_to_uninstall_RogueKiller._Uninstaller_not_found.
mov ecx, ebx
call fcn.0057b7e0
xor ebx, ebx
jmp 0x55647e
push 5
lea ecx, [ebp - 0x34]
call fcn.005dc190
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.__SILENT__SUPPRESSMSGBOXES
lea ecx, [ebp - 0x28]
call fcn.005da780
mov ecx, eax
call fcn.005dc190
push eax
mov ecx, ebx
call fcn.005793c0
mov esi, eax
or eax, 0xffffffff
test esi, esi
cmove esi, eax
mov dword [ebp - 0x3c], esi
mov byte [ebp - 4], 3
push esi
mov dword [ebp - 0x38], 0
call dword [sym.imp.KERNEL32.dll_GetProcessId]
mov edi, eax
mov ecx, ebx
push str.__WaitWindow2_10__2__0__TUninstallProgressForm__RogueKiller____WaitWindow2_5__66__150__32770__Uninstall___WaitControlState__CLASS:Button__INSTANCE:1___7__5___ClickControl__CLASS:Button__INSTANCE:1____WaitWindowState_16_1_10_
lea eax, [ebp - 0x1c]
push eax
push str.RogueKillerUninstall
call fcn.005403a0
push ecx
push 0
push 0
lea ecx, [ebp - 0x1c]
call fcn.005dc190
push eax
push edi
mov ecx, ebx
call fcn.00577ba0
cmp eax, 0xffffffff
je 0x55646b
lea eax, [ebp - 0x38]
mov ecx, ebx
push eax
push esi
call fcn.0057a270
test al, al
je 0x55646b
cmp dword [ebp - 0x38], 0
mov ecx, str.Failed_to_uninstall_RogueKiller._Uninstaller_not_found.
push 0
push 0
mov eax, str.Successfully_uninstalled_RogueKiller.
cmovne eax, ecx
mov ecx, ebx
push 0
push eax
call fcn.0057b7e0
xor ebx, ebx
cmp dword [ebp - 0x38], ebx
sete bl
jmp 0x55646e
or ebx, 0xffffffff
cmp esi, 0xffffffff
je 0x55647e
test esi, esi
je 0x55647e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x1c]
call fcn.005dc430
lea ecx, [ebp - 0x28]
call fcn.005dc430
lea ecx, [ebp - 0x34]
call fcn.005dc430
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret
Function at 0x5583a0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.MalwarebytesAnti_Malware
sub esp, 8
mov ebx, ecx
call fcn.0057c120
mov esi, dword [ebp + 8]
add esp, 4
mov ecx, esi
push eax
call fcn.005dc200
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.mbam.exe
mov ecx, esi
call fcn.005dc190
mov edi, dword [ebp + 0xc]
mov ecx, edi
push eax
call fcn.005dc200
mov ecx, edi
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x558493
cmp byte [ebx + 0x104], al
je 0x55847b
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str.MalwarebytesAnti_Malware
sub esp, 8
mov ecx, ebx
call fcn.0057c080
add esp, 4
mov ecx, esi
push eax
call fcn.005dc200
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.mbam.exe
mov ecx, esi
call fcn.005dc190
push eax
mov ecx, edi
call fcn.005dc200
mov ecx, edi
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x558493
mov ecx, esi
call fcn.005dc400
mov ecx, edi
call fcn.005dc400
xor al, al
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
pop edi
pop esi
mov al, 1
pop ebx
pop ecx
pop ebp
ret 8
Function at 0x55b940
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fa6a1
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x55ba81
xorps xmm0, xmm0
mov dword [ebp - 0x30], 0
lea ecx, [ebp - 0x38]
movq qword [ebp - 0x38], xmm0
call fcn.005dc5e0
push 1
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
push esi
movq qword [ebp - 0x20], xmm0
call fcn.005dc570
xorps xmm0, xmm0
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x2c]
movq qword [ebp - 0x2c], xmm0
call fcn.005dc5e0
push 0
push 1
push 1
push 0
push 0x62438c
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
call fcn.005daa70
test eax, eax
je 0x55ba08
push 0x400
push 0
push 0
push 0x400
lea ecx, [ebp - 0x20]
call fcn.005db9a0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push 0x80
lea ecx, [ebp - 0x2c]
call fcn.005db320
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
push 0x62438c
lea ecx, [ebp - 0x2c]
call fcn.005dc190
push eax
push 0x62438c
push str.DefaultInstall
push str._rundll32.exe_setupapi_InstallHinfSection
push dword [edi + 0x44]
lea ecx, [ebp - 0x38]
call fcn.005dc200
push 0
push dword [edi + 0x44]
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.0057b4f0
lea ecx, [ebp - 0x2c]
mov esi, eax
call fcn.005dc430
lea ecx, [ebp - 0x20]
call fcn.005dc430
lea ecx, [ebp - 0x38]
call fcn.005dc430
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 0xc
Function at 0x55ec70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5faa59
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push str.Running_unattended_disk_cleanup...
push 0xffffffffffffffff
call fcn.0057b610
push 0
push 1
mov ecx, ebx
call fcn.005494d0
sub esp, 8
mov dword [ebp - 0x18], 0
xorps xmm0, xmm0
lea ecx, [ebp - 0x20]
movq qword [ebp - 0x20], xmm0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.cleanmgr.exe__SystemDrive___verylowdisk
push dword [ebx + 0x44]
call fcn.005dc520
push 5
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
push dword [ebx + 0x44]
call fcn.005dc190
push eax
mov ecx, ebx
call fcn.00579420
push 0
push 0
push 0
push 7
mov edi, eax
mov ecx, ebx
push 0x1e
push edi
mov dword [ebp - 0x28], edi
call fcn.00547500
push 0
push 0
mov ecx, ebx
call fcn.005494d0
test eax, eax
jne 0x55ee45
push eax
push eax
push eax
push 7
push 0xb4
push edi
mov ecx, ebx
call fcn.00547500
push 0
push 0
mov ecx, ebx
mov esi, eax
call fcn.005494d0
test eax, eax
jne 0x55ee45
push eax
push eax
push esi
push 0x5c6c90
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x24], esi
test esi, esi
jne 0x55ed7a
or esi, 0xffffffff
or eax, esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x24], eax
push 0
push 0
push 0
push 7
push 0x1c20
push edi
mov ecx, ebx
mov byte [ebp - 4], 1
call fcn.00547500
push 0
push 0
push eax
push 0x5c6c90
push 0
push 0
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
mov eax, dword [ebp - 0x24]
cmp eax, 0xffffffff
je 0x55edbf
test eax, eax
je 0x55edbf
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
mov ecx, ebx
test edi, edi
push 0
cmove edi, eax
push 0
mov dword [ebp - 0x14], edi
call fcn.005494d0
test eax, eax
jne 0x55ee30
mov esi, dword [ebp - 0x28]
cmp dword [ebp - 0x2c], eax
jne 0x55ee0a
test esi, esi
je 0x55ee0a
mov ecx, esi
call fcn.005cc910
test al, al
je 0x55ee0a
push 0
push 0
mov ecx, ebx
call fcn.005494d0
test eax, eax
jne 0x55ee30
mov ecx, esi
call fcn.005cc910
test al, al
jne 0x55edf0
push 0
push 0
mov ecx, str.Failed_to_execute_unattended_Windows_full_disk_cleanup.
test esi, esi
mov eax, str.Successfully_executed_unattended_Windows_disk_cleanup.
cmove eax, ecx
mov ecx, ebx
push 0
push eax
call fcn.0057b7e0
xor ebx, ebx
test esi, esi
setne bl
jmp 0x55ee33
or ebx, 0xffffffff
cmp edi, 0xffffffff
je 0x55ee48
test edi, edi
je 0x55ee48
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x55ee48
or ebx, 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.005dc430
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret
Function at 0x55fb20
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fac19
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push str.Preparing_to_update_Windows...
push 0xffffffffffffffff
call fcn.0057b610
push 0
push 1
mov ecx, edi
call fcn.005494d0
test eax, eax
je 0x55fb70
or eax, 0xffffffff
jmp 0x55fcba
push 0
push 0
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], edi
push eax
push 0x53fea0
push 0
push 0
mov byte [ebp - 0x24], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
or eax, 0xffffffff
test esi, esi
cmove esi, eax
mov dword [ebp - 0x2c], esi
xor edx, edx
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.005cca30
test al, al
je 0x55fc03
nop
push 0
push 0
mov ecx, edi
call fcn.005494d0
test eax, eax
je 0x55fbeb
cmp byte [ebp - 0x24], 0
jne 0x55fbfa
push str.Cancelling__please_wait...
push 0xffffffffffffffff
mov ecx, edi
call fcn.0057b610
push 0
push 1
mov ecx, edi
call fcn.005494d0
push 1
mov ecx, edi
mov byte [ebp - 0x24], 1
call fcn.00554030
xor edx, edx
mov ecx, esi
call fcn.005cca30
test al, al
jne 0x55fbb0
jmp 0x55fc03
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp byte [ebp - 0x24], 0
jne 0x55fca5
mov ebx, dword [ebp - 0x14]
cmp ebx, 0xffffffff
je 0x55fca5
cmp ebx, 0xfffffffe
jne 0x55fc40
push 0
push 0
push 0
push str.Failed_to_update_Windows_this_time.
mov ecx, edi
call fcn.0057b7e0
mov edi, dword [ebp - 0x14]
jmp 0x55fca8
test ebx, ebx
jne 0x55fc58
push ebx
push ebx
push ebx
push str.Update_Windows:_No_updates_were_available_this_time.
mov ecx, edi
call fcn.0057b7e0
mov edi, dword [ebp - 0x14]
jmp 0x55fca8
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x20]
movq qword [ebp - 0x20], xmm0
call fcn.005dc5e0
push ebx
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.005db290
push 0
push str._Windows_updates_installed.
ret
add byte fs:[ebp + 0x5e8e04d], cl
lds eax, [edi]
add byte [eax + 0x68], dl
insb byte es:[edi], dx
ret
add byte fs:[ebx - 0x44b71731], cl
add dword [eax], eax
lea ecx, [ebp - 0x20]
call fcn.005dc430
mov edi, dword [ebp - 0x14]
jmp 0x55fca8
or edi, 0xffffffff
cmp esi, 0xffffffff
je 0x55fcb8
test esi, esi
je 0x55fcb8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret
Function at 0x55fce0
Capabilities:
Manipulate boot configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fac4d
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov cl, byte [ebp + 8]
sub esp, 8
xor edx, edx
mov byte [ebp - 0x21], cl
test cl, cl
mov dword [ebp - 0x18], 0
mov eax, str.__remove
lea ecx, [ebp - 0x20]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
cmove eax, edx
xorps xmm0, xmm0
push eax
push str._bcdedit.exe__bootsequence_memdiag
push dword [esi + 0x44]
movq qword [ebp - 0x20], xmm0
call fcn.005dc520
push 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
push dword [esi + 0x44]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.0057b4f0
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x55fd77
or ebx, eax
jmp 0x55fdbc
mov dl, byte [ebp - 0x21]
xor ebx, ebx
test ecx, ecx
sete bl
test dl, dl
je 0x55fd91
mov eax, str.Successfully_cancelled
mov edi, str.Failed_to_cancel
jmp 0x55fd9b
mov eax, str.Successfully_scheduled
mov edi, str.Failed_to_schedule
test ecx, ecx
mov ecx, str._the_memory_diagnostics_to_run_on_the_next_boot.
push 0
cmovne eax, edi
mov edi, str._the_memory_diagnostics_from_running_on_the_next_boot.
test dl, dl
push 0
cmovne ecx, edi
push ecx
push eax
mov ecx, esi
call fcn.0057b7e0
lea ecx, [ebp - 0x20]
call fcn.005dc430
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 4
Function at 0x560240
Capabilities:
Manipulate boot configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fad2d
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
movsd xmm0, qword [0x6edac8]
comisd xmm0, xmmword [esi]
jbe 0x560283
or eax, 0xffffffff
jmp 0x560341
push str.Restoring_the_standard_boot_menu...
push 0xffffffffffffffff
call fcn.0057b610
push 0
push 1
mov ecx, esi
call fcn.005494d0
test eax, eax
jne 0x56033f
movsd xmm0, qword [0x6edac8]
comisd xmm0, xmmword [esi]
ja 0x56033f
sub esp, 8
mov dword [ebp - 0x14], eax
xorps xmm0, xmm0
lea ecx, [ebp - 0x1c]
movq qword [ebp - 0x1c], xmm0
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str.current_bootmenupolicy_standard
push str._bcdedit.exe__set
push dword [esi + 0x44]
call fcn.005dc520
push 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
push dword [esi + 0x44]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.0057b4f0
mov edi, eax
cmp edi, 0xffffffff
jne 0x56030f
lea ecx, [ebp - 0x1c]
or ebx, eax
call fcn.005dc430
mov eax, ebx
jmp 0x560341
push 0
push 0
mov ecx, str.Failed_to_restore_the_standard_boot_menu.
test edi, edi
mov eax, str.Successfully_restored_the_standard_boot_menu.
cmovne eax, ecx
mov ecx, esi
push 0
push eax
call fcn.0057b7e0
xor ebx, ebx
lea ecx, [ebp - 0x1c]
test edi, edi
sete bl
call fcn.005dc430
mov eax, ebx
jmp 0x560341
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret
Function at 0x560360
Capabilities:
Manipulate boot configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fad61
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
movsd xmm0, qword [0x6edac8]
comisd xmm0, xmmword [esi]
jbe 0x5603a3
or eax, 0xffffffff
jmp 0x560461
push str.Enabling_the_legacy__F8__boot_menu...
push 0xffffffffffffffff
call fcn.0057b610
push 0
push 1
mov ecx, esi
call fcn.005494d0
test eax, eax
jne 0x56045f
movsd xmm0, qword [0x6edac8]
comisd xmm0, xmmword [esi]
ja 0x56045f
sub esp, 8
mov dword [ebp - 0x14], eax
xorps xmm0, xmm0
lea ecx, [ebp - 0x1c]
movq qword [ebp - 0x1c], xmm0
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str.current_bootmenupolicy_legacy
push str._bcdedit.exe__set
push dword [esi + 0x44]
call fcn.005dc520
push 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
push dword [esi + 0x44]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.0057b4f0
mov edi, eax
cmp edi, 0xffffffff
jne 0x56042f
lea ecx, [ebp - 0x1c]
or ebx, eax
call fcn.005dc430
mov eax, ebx
jmp 0x560461
push 0
push 0
mov ecx, str.Failed_to_enable_the_legacy__F8__boot_menu.
test edi, edi
mov eax, str.Successfully_enabled_the_legacy__F8__boot_menu.
cmovne eax, ecx
mov ecx, esi
push 0
push eax
call fcn.0057b7e0
xor ebx, ebx
lea ecx, [ebp - 0x1c]
test edi, edi
sete bl
call fcn.005dc430
mov eax, ebx
jmp 0x560461
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret
Function at 0x560bb0
Capabilities:
Access the windows event log
Clear windows event logs

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fae61
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x28], ebx
push str.Clearing_all_Windows_event_logs...
push 0xffffffffffffffff
call fcn.0057b610
push 0
push 1
mov ecx, ebx
call fcn.005494d0
xor ebx, ebx
mov dword [ebp - 0x24], str.Application
mov dword [ebp - 0x20], str.Security
xor esi, esi
mov dword [ebp - 0x1c], str.Setup
mov dword [ebp - 0x18], str.System
mov dword [ebp - 0x14], str.Internet_Explorer
nop
push dword [ebp + esi*4 - 0x24]
push 0
call dword [sym.imp.ADVAPI32.dll_OpenEventLogW]
mov edi, eax
test edi, edi
je 0x560c44
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_ClearEventLogW]
push edi
add ebx, eax
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
inc esi
cmp esi, 5
jl 0x560c20
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x1c]
movq qword [ebp - 0x1c], xmm0
call fcn.005dc5e0
push ebx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0
call fcn.005db320
push 0
push str._system_event_logs.
lea ecx, [ebp - 0x1c]
call fcn.005dc190
mov ecx, dword [ebp - 0x28]
push eax
push 0x64b378
call fcn.0057b7e0
lea ecx, [ebp - 0x1c]
call fcn.005dc430
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret
Function at 0x564cd0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fb1e4
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0
push 0
lea eax, [ebp + 8]
push eax
push 0x58c3e0
ret
pop eax
add byte [edx], ch
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
or eax, 0xffffffff
test esi, esi
cmove esi, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 0
cmp esi, eax
je 0x564d7d
test esi, esi
je 0x564d7d
xor edx, edx
mov ecx, esi
call fcn.005cca30
test al, al
je 0x564d5c
nop dword [eax]
push 5
push 1
mov ecx, edi
call fcn.005494d0
test eax, eax
jne 0x564d78
xor edx, edx
mov ecx, esi
call fcn.005cca30
test al, al
jne 0x564d40
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
xor ebx, ebx
cmp dword [ebp - 0x14], ebx
sete bl
jmp 0x564d88
or ebx, 0xffffffff
jmp 0x564d7f
xor ebx, ebx
cmp esi, 0xffffffff
je 0x564d8f
test esi, esi
je 0x564d8f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 4
Function at 0x564db0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fb220
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push str.Deleting_all_existing_system_restore_points...
push 0xffffffffffffffff
call fcn.0057b610
push 0
push 1
mov ecx, edi
call fcn.005494d0
push 0
push 0
lea eax, [ebp - 0x11]
mov byte [ebp - 0x11], 0
push eax
push 0x53fed0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
or eax, 0xffffffff
test esi, esi
cmove esi, eax
mov dword [ebp - 0x28], esi
mov dword [ebp - 4], 0
cmp esi, eax
je 0x564ef3
test esi, esi
je 0x564ef3
xor edx, edx
mov ecx, esi
call fcn.005cca30
test al, al
je 0x564e66
nop
push 0
push 0
mov ecx, edi
call fcn.005494d0
test eax, eax
je 0x564e59
cmp byte [ebp - 0x11], 0
jne 0x564e59
mov byte [ebp - 0x11], 1
xor edx, edx
mov ecx, esi
call fcn.005cca30
test al, al
jne 0x564e40
cmp byte [ebp - 0x11], 0
je 0x564e79
push esi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x564ef5
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x20]
movq qword [ebp - 0x20], xmm0
call fcn.005dc5e0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
push dword [ebp - 0x24]
call fcn.005db290
cmp dword [ebp - 0x24], 1
mov ecx, str.s_removed
mov eax, str._removed.
cmovne eax, ecx
lea ecx, [ebp - 0x20]
push eax
push str._restore_point
call fcn.005dc190
push eax
push str.Successfully_deleted_all_existing_restore_points.
mov ecx, edi
call fcn.0057b7e0
mov edi, dword [ebp - 0x24]
lea ecx, [ebp - 0x20]
call fcn.005dc430
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x564ef5
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret