joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54504a90
Capabilities:
Encode data using base64

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edx, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
mov eax, edx
shr eax, 4
xor eax, ebx
and eax, 0xf0f0f0f
xor ebx, eax
shl eax, 4
xor edx, eax
mov eax, ebx
shr eax, 4
xor eax, edx
and eax, 0x1010101
xor edx, eax
shl eax, 4
xor ebx, eax
mov eax, ebx
shr eax, 9
xor eax, ebx
and eax, 0x550055
mov ecx, eax
shl ecx, 9
xor ecx, eax
xor ebx, ecx
mov eax, edx
shr eax, 9
xor eax, edx
and eax, 0x550055
mov ecx, eax
shl ecx, 9
xor ecx, eax
xor edx, ecx
mov eax, ebx
shr eax, 0x12
xor eax, ebx
and eax, 0x3333
mov ecx, eax
shl ecx, 0x12
xor ecx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
and eax, 0x3333
xor ebx, ecx
mov ecx, eax
shl ecx, 0x12
xor ecx, eax
xor edx, ecx
mov eax, edx
shr eax, 0x10
xor eax, edx
and eax, 0xff
mov ecx, eax
shl ecx, 0x10
xor ecx, eax
mov eax, dword [esp + 0x24]
xor edx, ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], 1
mov dword [esp + 0x10], 0x10
jmp 0x54504b50
and ebx, 0xfffffff
and edx, 0xfffffff
test dword [esp + 0x24], 0x7efc
mov ecx, ebx
mov eax, edx
je 0x54504b78
shl ecx, 0x1a
shr ebx, 2
shl eax, 0x1a
shr edx, 2
jmp 0x54504b82
shl ecx, 0x1b
shr ebx, 1
shl eax, 0x1b
shr edx, 1
or edx, eax
or ebx, ecx
mov ecx, ebx
shr ecx, 0x10
movzx esi, cl
mov eax, ebx
shr eax, 8
movzx eax, al
mov edi, eax
shr edi, 5
movzx ecx, bl
mov dword [esp + 0x14], ecx
and ecx, 0xc0
or ecx, edi
shr ecx, 2
mov edi, ebx
shr edi, 0x18
and edi, 0xe
or ecx, edi
mov ecx, dword [ecx*4 + 0x54532328]
mov edi, esi
shr edi, 5
and edi, 4
mov ebp, esi
and ebp, 0x40
or edi, ebp
shr edi, 1
shr eax, 1
and eax, 0x3f
and esi, 0x1d
or edi, esi
or ecx, dword [edi*4 + 0x54532228]
movzx edi, dl
or ecx, dword [eax*4 + 0x54532128]
mov eax, dword [esp + 0x14]
and eax, 0x3f
or ecx, dword [eax*4 + 0x54532028]
mov dword [esp + 0x14], edi
shr edi, 4
mov eax, edx
shr eax, 0x10
movzx esi, al
and edi, 8
mov ebp, esi
and ebp, 0xc0
or edi, ebp
shr edi, 2
mov eax, edx
shr eax, 8
movzx eax, al
mov ebp, edx
shr ebp, 0x18
and ebp, 0xd
or edi, ebp
mov ebp, eax
and eax, 0x3d
shl dword [esp + 0x24], 1
shr ebp, 6
and ebp, 2
or ebp, eax
mov eax, dword [edi*4 + 0x54532728]
or eax, dword [ebp*4 + 0x54532528]
mov edi, dword [esp + 0x14]
and edi, 0x3f
or eax, dword [edi*4 + 0x54532428]
and esi, 0x3f
or eax, dword [esi*4 + 0x54532628]
movzx esi, cx
mov edi, eax
shl edi, 0x10
or edi, esi
mov esi, dword [esp + 0x1c]
mov dword [esi], edi
and eax, 0xffff0000
shr ecx, 0x10
add esi, 4
or eax, ecx
mov dword [esi], eax
add esi, 4
sub dword [esp + 0x10], 1
mov dword [esp + 0x1c], esi
jne 0x54504b50
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
Function at 0x54504ca0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
ror ecx, 4
mov eax, edx
xor eax, ecx
and eax, 0xf0f0f0f
xor edx, eax
xor eax, ecx
ror eax, 0xc
mov ecx, edx
xor ecx, eax
and ecx, 0xffff0000
xor edx, ecx
xor ecx, eax
ror ecx, 0x12
mov eax, edx
xor eax, ecx
and eax, 0x33333333
xor edx, eax
xor eax, ecx
ror eax, 0x16
mov ecx, edx
xor ecx, eax
and ecx, 0xff00ff00
xor edx, ecx
xor ecx, eax
ror ecx, 9
mov esi, dword [esp + 0x1c]
mov edi, ecx
mov eax, edx
xor eax, edi
and eax, 0x55555555
mov ecx, eax
xor ecx, edi
xor eax, edx
rol ecx, 2
rol eax, 1
mov edi, eax
mov dword [esp + 0x1c], 8
mov edx, dword [esi]
mov dword [esp + 0x14], ecx
xor edx, edi
and edx, 0x3f3f3f3f
add esi, 4
mov eax, edi
ror eax, 4
xor eax, dword [esi]
add esi, 4
and eax, 0x3f3f3f3f
mov ecx, eax
shr ecx, 0x10
movzx ebp, cl
mov ebx, eax
shr ebx, 0x18
mov ebx, dword [ebx*4 + 0x54531f28]
or ebx, dword [ebp*4 + 0x54531d28]
mov ecx, eax
shr ecx, 8
movzx ebp, cl
or ebx, dword [ebp*4 + 0x54531b28]
mov ebp, edx
shr ebp, 0x18
or ebx, dword [ebp*4 + 0x54531e28]
mov ecx, edx
shr ecx, 0x10
movzx ebp, cl
or ebx, dword [ebp*4 + 0x54531c28]
mov ecx, edx
shr ecx, 8
movzx ebp, cl
or ebx, dword [ebp*4 + 0x54531a28]
mov ecx, dword [esp + 0x14]
movzx eax, al
or ebx, dword [eax*4 + 0x54531928]
movzx edx, dl
or ebx, dword [edx*4 + 0x54531828]
mov edx, dword [esi]
xor ecx, ebx
xor edx, ecx
mov eax, ecx
and edx, 0x3f3f3f3f
add esi, 4
ror eax, 4
xor eax, dword [esi]
mov dword [esp + 0x14], ecx
and eax, 0x3f3f3f3f
mov ecx, eax
shr ecx, 0x10
movzx ebp, cl
mov ebx, eax
shr ebx, 0x18
mov ebx, dword [ebx*4 + 0x54531f28]
or ebx, dword [ebp*4 + 0x54531d28]
mov ecx, eax
shr ecx, 8
movzx ebp, cl
or ebx, dword [ebp*4 + 0x54531b28]
mov ebp, edx
shr ebp, 0x18
or ebx, dword [ebp*4 + 0x54531e28]
mov ecx, edx
shr ecx, 0x10
movzx ebp, cl
or ebx, dword [ebp*4 + 0x54531c28]
mov ecx, edx
shr ecx, 8
movzx ebp, cl
or ebx, dword [ebp*4 + 0x54531a28]
mov ecx, dword [esp + 0x14]
movzx eax, al
or ebx, dword [eax*4 + 0x54531928]
movzx edx, dl
or ebx, dword [edx*4 + 0x54531828]
add esi, 4
xor edi, ebx
sub dword [esp + 0x1c], 1
jne 0x54504d15
ror ecx, 1
ror edi, 2
mov eax, edi
xor eax, ecx
and eax, 0x55555555
xor ecx, eax
xor eax, edi
rol eax, 9
mov edx, eax
xor edx, ecx
and edx, 0xff00ff00
xor ecx, edx
xor edx, eax
rol edx, 0x16
mov eax, edx
xor eax, ecx
and eax, 0x33333333
xor ecx, eax
xor eax, edx
rol eax, 0x12
mov edx, eax
xor edx, ecx
and edx, 0xffff0000
xor ecx, edx
xor edx, eax
rol edx, 0xc
mov eax, edx
mov esi, eax
xor esi, ecx
and esi, 0xf0f0f0f
mov edx, esi
xor edx, eax
xor esi, ecx
pop edi
xor eax, eax
or eax, esi
pop esi
rol edx, 4
xor ecx, ecx
pop ebp
or edx, ecx
pop ebx
ret 0xc
Function at 0x54505070
Capabilities:
List user accounts

Disassembly:
sub esp, 0x10
push ebx
push ebp
xor ebx, ebx
push esi
mov esi, dword [esp + 0x20]
push edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
lea ecx, [ecx]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0xffffffffffffffff
lea eax, [esp + 0x20]
push eax
push 2
push 3
push ebx
call sub.NETAPI32.dll_NetUserEnum
mov ebp, eax
cmp ebp, ebx
je 0x545050d3
cmp ebp, 0xea
je 0x545050d3
push 1
push str.GetUser__NetUserEnum
push esi
call fcn.54516210
add esp, 0xc
jmp 0x54505162
mov edi, dword [esp + 0x10]
cmp edi, ebx
je 0x54505152
cmp dword [esp + 0x14], 0
jbe 0x54505152
test edi, edi
je 0x54505144
mov ecx, dword [edi]
push ecx
push str.__10S_t
push esi
call fcn.54516060
mov eax, dword [edi + 0xc]
add esp, 0xc
sub eax, 0
je 0x54505123
sub eax, 1
je 0x5450511c
sub eax, 1
je 0x54505110
push str._Unknow_
jmp 0x54505128
push str._Administrator_
push str.__10s_t_r_n
jmp 0x5450512d
push str._User_
jmp 0x54505128
push str._Guest_
push str.__7s_t_r_n
push esi
call fcn.54516060
add ebx, 1
add esp, 0xc
add edi, 0x74
cmp ebx, dword [esp + 0x14]
jb 0x545050e2
jmp 0x54505152
push str.An_Access_Violation_Has_Occurred_r_n
push esi
call fcn.54516060
add esp, 8
push str._r_nList_System_Accounts_Completed_r_n
push esi
call fcn.54516060
add esp, 8
xor ebx, ebx
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x54505176
push eax
call sub.NETAPI32.dll_NetApiBufferFree
xor eax, eax
mov dword [esp + 0x10], eax
cmp ebp, 0xea
je 0x54505090
pop edi
pop esi
pop ebp
cmp eax, ebx
pop ebx
je 0x54505190
push eax
call sub.NETAPI32.dll_NetApiBufferFree
mov eax, 1
add esp, 0x10
ret

Function at 0x545051a0
Capabilities:
Delete user account

Disassembly:
sub esp, 0x84
mov eax, dword [0x5454141c]
xor eax, esp
mov dword [esp + 0x80], eax
push esi
mov esi, dword [esp + 0x90]
push edi
push 0x80
lea eax, [esp + 0xc]
push 0
push eax
mov edi, 1
call fcn.54516b80
push 0x7e
lea ecx, [esp + 0x18]
push esi
push ecx
call fcn.54517bbe
add esp, 0x18
lea edx, [esp + 8]
push edx
push 0
call sub.NETAPI32.dll_NetUserDel
test eax, eax
push esi
je 0x54505222
mov eax, dword [esp + 0x94]
push str.Fail_To_Delete_User__s__r_n
push eax
call fcn.54516060
add esp, 0xc
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.54516b6f
add esp, 0x84
ret
mov ecx, dword [esp + 0x94]
push str.Delete_User__s_Successfully_r_n
push ecx
call fcn.54516060
mov ecx, dword [esp + 0x94]
add esp, 0xc
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.54516b6f
add esp, 0x84
ret
Function at 0x545054b0
Capabilities:
Add user account
Add user account to group

Disassembly:
push 0xffffffffffffffff
push 0x5452f9bb
mov eax, dword fs:[0]
push eax
sub esp, 0x2c4
mov eax, dword [0x5454141c]
xor eax, esp
mov dword [esp + 0x2c0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5454141c]
xor eax, esp
push eax
lea eax, [esp + 0x2d8]
mov dword fs:[0], eax
mov esi, dword [esp + 0x2e8]
mov eax, dword [esi + 4]
push eax
lea ecx, [esp + 0x24]
call fcn.54514f70
xor ebp, ebp
lea ecx, [esp + 0x20]
mov dword [esp + 0x2e0], ebp
call fcn.54514e50
lea ecx, [esp + 0x20]
mov ebx, eax
call fcn.54514e60
cmp ebx, 5
mov esi, dword [esi]
mov edi, eax
mov dword [esp + 0x1c], esi
jge 0x54505552
push str.user_add__priv___username___password__r_n_r_npriv:_r_nGUEST_0_r_nUSER__1_r_nADMIN_2_r_n_r_nexample:_user_add_2_aaa_hello_r_n
push esi
call fcn.54516060
add esp, 8
lea ecx, [esp + 0x20]
mov dword [esp + 0x2e0], 0xffffffff
call fcn.54514e30
xor eax, eax
jmp 0x5450567a
mov dword [esp + 0x18], ebp
mov ecx, dword [edi + 8]
push ecx
call fcn.545172d6
add esp, 4
sub eax, ebp
je 0x54505579
sub eax, 1
je 0x54505572
mov ebx, str.Administrators
jmp 0x5450557e
mov ebx, str.Users
jmp 0x5450557e
mov ebx, str.Guests
push 0x80
lea edx, [esp + 0x54]
push ebp
push edx
call fcn.54516b80
push 0x204
lea eax, [esp + 0xe0]
push ebp
push eax
call fcn.54516b80
mov ecx, dword [edi + 0xc]
push 0x7e
push ecx
lea edx, [esp + 0x70]
push edx
call fcn.54517bbe
mov eax, dword [edi + 0x10]
push 0x202
push eax
lea ecx, [esp + 0xfc]
push ecx
call fcn.54517bbe
lea edx, [esp + 0x80]
add esp, 0x30
mov ecx, edx
mov dword [esp + 0x30], edx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0xd4]
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x38], eax
mov eax, 1
push ecx
push eax
push ebp
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], ebp
mov dword [esp + 0x54], ebp
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], ebp
call sub.NETAPI32.dll_NetUserAdd
mov esi, eax
cmp esi, ebp
je 0x5450561e
cmp esi, 0x8b0
jne 0x54505640
mov edx, dword [edi + 0x10]
mov eax, dword [edi + 0xc]
push edx
push eax
call fcn.54505310
add esp, 8
push 1
lea ecx, [esp + 0x18]
push ecx
push 3
push ebx
push ebp
call sub.NETAPI32.dll_NetLocalGroupAddMembers
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, dword [esp + 0x1c]
push 1
push str.Add_User
push edx
call fcn.54516210
xor eax, eax
add esp, 0xc
cmp esi, ebp
sete al
lea ecx, [esp + 0x20]
mov dword [esp + 0x2e0], 0xffffffff
mov esi, eax
call fcn.54514e30
mov eax, esi
mov ecx, dword [esp + 0x2d8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2c0]
xor ecx, esp
call fcn.54516b6f
add esp, 0x2d0
ret
Function at 0x54505fe0
Capabilities:
Create thread

Disassembly:
push ecx
push 8
call fcn.54516c18
add esp, 4
test eax, eax
jne 0x54505ff1
pop ecx
ret
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx]
push esi
mov dword [eax], edx
mov ecx, dword [ecx + 4]
lea edx, [esp + 4]
push edx
push 0
push eax
mov dword [eax + 4], ecx
mov eax, dword [esp + 0x18]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x54506030
push 0x3e8
push esi
call dword [0x545428ac]
push esi
call dword [0x54542850]
mov eax, 1
pop esi
pop ecx
ret

Function at 0x54506120
Capabilities:
Create thread

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
lea eax, [esp]
push eax
push 0
push ecx
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x54506146
push eax
call dword [0x54542850]
pop ecx
ret

Function at 0x54506150
Capabilities:
Create thread

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
lea eax, [esp]
push eax
push 0
push ecx
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [0x54542850]
pop ecx
ret
Function at 0x54506810
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, ecx
mov eax, dword [ebp + 0xb8]
test eax, eax
push esi
lea ecx, [ebp + 0xa8]
push edi
mov dword [esp + 0x10], ebp
lea edi, [ebp + 0xb0]
mov dword [esp + 0x14], ecx
je 0x545068d9
mov ebx, dword [esp + 0x30]
mov esi, 8
sub esi, eax
cmp esi, ebx
jbe 0x5450684c
mov esi, ebx
test esi, esi
mov edx, eax
jbe 0x5450689f
mov ebx, edi
mov edi, dword [esp + 0x28]
lea eax, [edx + ecx]
sub ebx, ecx
add edx, esi
mov dword [esp + 0x18], esi
mov esi, dword [esp + 0x2c]
mov dword [esp + 0x1c], edx
jmp 0x54506870
mov dl, byte [esi]
mov byte [ebx + eax], dl
mov cl, byte [eax]
xor cl, dl
mov byte [edi], cl
mov ecx, 1
sub dword [esp + 0x30], ecx
add esi, 1
add edi, ecx
add eax, ecx
sub dword [esp + 0x18], ecx
jne 0x54506870
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x30]
jmp 0x545068a7
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
cmp edx, 8
jne 0x545068c9
mov edx, dword [ebp + 0xb0]
mov eax, dword [ebp + 0xb4]
mov dword [ecx], edx
mov dword [ecx + 4], eax
mov dword [ebp + 0xb8], 0
jmp 0x545068cf
mov dword [ebp + 0xb8], edx
test ebx, ebx
je 0x545069ea
jmp 0x545068e1
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
mov eax, dword [ebp + 0xbc]
mov edx, dword [ebp + 0xc0]
mov ebx, dword [ecx]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], edx
xor eax, eax
xor edx, edx
cmp dword [esp + 0x30], eax
mov dword [esp + 0x1c], ebx
mov ebx, dword [ecx + 4]
je 0x5450697b
jmp 0x54506910
mov eax, dword [esp + 0x28]
cmp eax, 1
mov ecx, dword [esp + 0x1c]
je 0x54506928
sub dword [esp + 0x2c], 1
jne 0x54506937
mov dword [esp + 0x2c], eax
lea edx, [ebp + 0x24]
push edx
push ebx
push ecx
mov ecx, ebp
call fcn.54504ca0
jmp 0x5450694f
mov ebp, ebx
shld ebp, ecx, 7
mov eax, ebx
shr eax, 0x19
shl ecx, 7
xor edx, edx
or eax, ecx
or edx, ebp
mov ebp, dword [esp + 0x10]
cmp dword [esp + 0x30], 8
jb 0x5450697b
mov ecx, dword [esi]
mov ebx, dword [esi + 4]
mov ebp, ebx
xor ebp, edx
mov dword [esp + 0x1c], ecx
xor ecx, eax
mov dword [edi + 4], ebp
mov ebp, dword [esp + 0x10]
mov dword [edi], ecx
add esi, 8
add edi, 8
sub dword [esp + 0x30], 8
jne 0x54506910
mov ecx, dword [esp + 0x2c]
mov dword [ebp + 0xbc], ecx
mov ecx, dword [esp + 0x30]
test ecx, ecx
jne 0x545069a4
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
mov dword [eax + 4], ebx
mov dword [eax], edx
pop ebx
add esp, 0x14
ret 0xc
mov ebx, dword [esp + 0x14]
mov dword [ebx], eax
xor eax, eax
test ecx, ecx
mov dword [ebx + 4], edx
jbe 0x545069e4
lea edx, [ebp + 0xb0]
mov eax, ebx
sub edx, ebx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x2c], ecx
mov cl, byte [esi]
mov byte [eax + edx], cl
mov bl, byte [eax]
xor bl, cl
mov byte [edi], bl
add esi, 1
add edi, 1
add eax, 1
sub dword [esp + 0x30], 1
jne 0x545069c5
mov eax, dword [esp + 0x2c]
mov dword [ebp + 0xb8], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0xc
Function at 0x54506dd0
Capabilities:
Get hostname

Disassembly:
sub esp, 0x12c
mov eax, dword [0x5454141c]
xor eax, esp
mov dword [esp + 0x128], eax
push esi
push 0x80
push 0x54542c58
call dword [sym.imp.WS2_32.dll_gethostname]
mov esi, dword [esp + 0x134]
push 0x54542c58
push str._r_n_s__r_n
push esi
call fcn.54516060
add esp, 0xc
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x1b58
push 0x7530
push esi
call fcn.54515050
push 0xffffffffffffffff
push 0x128
lea eax, [esp + 0x18]
push eax
push esi
call fcn.54515580
add esp, 0x1c
test eax, eax
je 0x54506e6b
lea ecx, [esp + 4]
push ecx
push esi
call fcn.54506aa0
add esp, 8
test eax, eax
je 0x54506e6b
push 0xffffffffffffffff
push 0x128
lea edx, [esp + 0xc]
push edx
push esi
call fcn.54515580
add esp, 0x10
test eax, eax
jne 0x54506e40
push esi
mov ecx, 0x5454311c
call fcn.54516910
push 2
push esi
call dword [sym.imp.WS2_32.dll_shutdown]
push esi
call fcn.54515350
mov ecx, dword [esp + 0x130]
add esp, 4
pop esi
xor ecx, esp
mov eax, 1
call fcn.54516b6f
add esp, 0x12c
ret

Function at 0x54506eb0
Capabilities:
Create thread

Disassembly:
sub esp, 0x10c
mov eax, dword [0x5454141c]
xor eax, esp
mov dword [esp + 0x108], eax
mov ecx, dword [esp + 0x118]
mov eax, dword [esp + 0x114]
push esi
push ecx
push eax
call fcn.545153b0
mov esi, eax
add esp, 8
test esi, esi
jbe 0x54506f07
cmp byte [esp + 0x114], 0
je 0x54506f65
lea edx, [esp + 8]
push edx
call fcn.54503480
add esp, 4
test eax, eax
jne 0x54506f1f
push esi
call fcn.54515350
add esp, 4
xor eax, eax
pop esi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.54516b6f
add esp, 0x10c
ret
push 0
push 0
push esi
push 0
call fcn.54503890
add esp, 0x10
test eax, eax
je 0x54506efe
lea eax, [esp + 8]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x54506f40
sub eax, edx
push eax
lea eax, [esp + 0xc]
push eax
push esi
call fcn.54515520
push 0xf4
push esi
call fcn.54515640
add esp, 0x14
lea ecx, [esp + 4]
push ecx
push 0
push esi
push fcn.54506dd0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x54506f87
push eax
call dword [0x54542850]
mov ecx, dword [esp + 0x10c]
pop esi
xor ecx, esp
mov eax, 1
call fcn.54516b6f
add esp, 0x10c
ret
Function at 0x54507480
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x130
mov eax, dword [0x5454141c]
xor eax, esp
mov dword [esp + 0x12c], eax
push ebx
mov ebx, dword [esp + 0x138]
push esi
push edi
xor edi, edi
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x5450751d
lea eax, [esp + 0x10]
push eax
push esi
mov dword [esp + 0x18], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x545074f5
lea ecx, [esp + 0x34]
push ecx
push ebx
call fcn.545240e4
add esp, 8
test eax, eax
je 0x545074e8
lea edx, [esp + 0x10]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x545074c5
jmp 0x545074f5
mov eax, dword [esp + 0x18]
mov dword [esp + 0xc], eax
mov edi, 1
push esi
call dword [0x54542850]
cmp edi, 1
jne 0x5450751d
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x12c]
xor ecx, esp
call fcn.54516b6f
add esp, 0x130
ret
mov ecx, dword [esp + 0x138]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.54516b6f
add esp, 0x130
ret

Function at 0x54507600
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x134
mov eax, dword [0x5454141c]
xor eax, esp
mov dword [esp + 0x130], eax
push ebx
mov ebx, dword [esp + 0x13c]
push esi
push edi
xor edi, edi
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x545076c4
lea eax, [esp + 0x14]
push eax
push esi
mov dword [esp + 0x1c], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x5450769c
push ebp
mov ebp, dword [esp + 0x14c]
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x5450767d
cmp dword [esp + 0x14], ebp
jne 0x5450767d
lea eax, [esp + 0x3c]
push eax
push ebx
call fcn.545240e4
add esp, 8
test eax, eax
je 0x5450768e
lea ecx, [esp + 0x18]
push ecx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x54507651
jmp 0x5450769b
mov edx, dword [esp + 0x20]
mov dword [esp + 0x10], edx
mov edi, 1
pop ebp
push esi
call dword [0x54542850]
cmp edi, 1
jne 0x545076c4
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x130]
xor ecx, esp
call fcn.54516b6f
add esp, 0x134
ret
mov ecx, dword [esp + 0x13c]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.54516b6f
add esp, 0x134
ret
Function at 0x54507bd0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x60
mov eax, dword [esp + 0x64]
push ebp
push esi
xor ebp, ebp
push eax
push ebp
push 0x400
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
call dword [0x5454285c]
mov esi, eax
test esi, esi
jne 0x54507c13
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenProcess_____d_n
call fcn.54517f46
add esp, 8
jmp 0x54507d66
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea ecx, [esp + 0xc]
push ecx
push 0x60000
push esi
call edi
test eax, eax
jne 0x54507c44
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenProcessToken_____d_n
call fcn.54517f46
add esp, 8
jmp 0x54507d65
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x14]
push edx
push 0xf01ff
push eax
call fcn.545078e0
add esp, 0xc
test eax, eax
jne 0x54507c71
push str.ModifySecurity___error_n
call fcn.54517f46
add esp, 4
jmp 0x54507d65
lea ecx, [esp + 0x10]
push ecx
push 0xf01ff
push esi
call edi
test eax, eax
jne 0x54507c9b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenProcessToken_____d_n
call fcn.54517f46
add esp, 8
jmp 0x54507d65
mov edx, dword [esp + 0x78]
push edx
lea eax, [esp + 0x14]
push eax
call fcn.545076e0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push ecx
push edx
call fcn.545078a0
push 0x44
lea eax, [esp + 0x3c]
push 0
push eax
call fcn.54516b80
mov ecx, dword [esp + 0x98]
add esp, 0x1c
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [esp + 0x50], ecx
mov ecx, dword [esp + 0x94]
push ecx
push 0
push edx
mov dword [esp + 0x54], 0x44
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
test eax, eax
jne 0x54507d22
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateProcessAsUser_____d_n
call fcn.54517f46
add esp, 8
jmp 0x54507d65
mov eax, dword [esp + 0x80]
test eax, eax
je 0x54507d4a
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [eax], ecx
mov ecx, dword [esp + 0x20]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x24]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
jmp 0x54507d60
mov eax, dword [esp + 0x18]
push eax
call dword [0x54542850]
mov ecx, dword [esp + 0x1c]
push ecx
call dword [0x54542850]
mov ebp, 1
pop edi
mov eax, dword [esp + 8]
test eax, eax
je 0x54507d75
push eax
call dword [0x54542850]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x54507d84
push eax
call dword [0x54542850]
test esi, esi
je 0x54507d8f
push esi
call dword [0x54542850]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x54507d9e
push eax
call dword [0x545428d8]
pop esi
mov eax, ebp
pop ebp
add esp, 0x60
ret