joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420c33
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
xor ebx, ebx
push edi
mov edi, ecx
push 5
pop eax
push ebx
mov dword [edi], eax
mov dword [edi + 4], eax
mov word [edi + 8], 1
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
push 0x5b
mov dword [edi + 0xc], 4
call esi
push ebx
push 0x10
mov byte [edi + 0x29], al
call esi
push ebx
push 0xa0
mov byte [edi + 0x26], al
call esi
push ebx
push 0xa1
mov byte [edi + 0x27], al
call esi
push ebx
push 0x11
mov byte [edi + 0x28], al
call esi
push ebx
push 0x12
mov byte [edi + 0x24], al
call esi
mov byte [edi + 0x25], al
pop edi
pop esi
pop ebx
ret

Function at 0x421461
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov al, byte [0x4c8283]
push ebx
push esi
push edi
mov esi, ecx
mov byte [ebp - 1], al
push 0x8000
push esi
mov edi, edx
call fcn.004251f6
pop ecx
push eax
call fcn.00425024
cmp dword [edi + 0xc], 0xb
mov ebx, eax
pop ecx
pop ecx
je 0x4569b7
lea ecx, [ebp - 0x18]
call fcn.00405a78
mov ecx, edi
call fcn.00409851
lea eax, [ebp - 0x18]
push eax
push dword [edi + 8]
call fcn.004059d5
push dword [ebp - 0x18]
push 0x493d40
push esi
call fcn.004253f5
add esp, 0xc
mov dword [ebp - 8], eax
cmp byte [ebp - 1], 0
jne 0x4569d7
lea ecx, [ebp - 0x18]
call fcn.004058c4
mov edi, dword [ebp - 8]
push esi
call fcn.004255ba
pop ecx
cmp ebx, 0xffffffff
je 0x4214ff
push ebx
push esi
call fcn.004251f6
pop ecx
push eax
call fcn.00425024
pop ecx
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x4000
jmp 0x4214e7
push esi
mov ecx, edi
call fcn.00468c9e
push eax
push 1
call fcn.00468c5b
push eax
call fcn.00425373
add esp, 0x10
mov edi, eax
jmp 0x4214da
mov ecx, edi
call fcn.00409851
mov eax, dword [edi + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x4214cf
Function at 0x43659c
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4c1d50]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0042a969
mov dword [ebp - 0x14], eax
cmp dword [0x4c70e8], esi
jne 0x43668f
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x43661c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x43676f
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x43676f
push 0x4a2dd0
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43676f
push eax
call ebx
push 0x4a2ddc
push edi
mov dword [0x4c70e8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4c70ec], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4c70f0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4c70f8], eax
test eax, eax
je 0x43668c
push 0x4a2e1c
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4c70f4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4366b4
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4366a7
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x4366c9
push 4
pop eax
jmp 0x436771
cmp dword [ebp - 0x14], esi
je 0x4366c9
push dword [0x4c70e8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4366ae
mov eax, dword [0x4c70f4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x436727
cmp dword [0x4c70f8], edi
je 0x436727
push eax
call ebx
push dword [0x4c70f8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x436727
test eax, eax
je 0x436727
call ecx
test eax, eax
je 0x43671c
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x43671c
test byte [ebp - 8], 1
jne 0x436727
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x436757
mov eax, dword [0x4c70ec]
cmp eax, edi
je 0x436754
push eax
call ebx
test eax, eax
je 0x436754
call eax
mov esi, eax
test esi, esi
je 0x436754
mov eax, dword [0x4c70f0]
cmp eax, edi
je 0x436754
push eax
call ebx
test eax, eax
je 0x436754
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4c70e8]
call ebx
test eax, eax
je 0x43676f
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x436771
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042d106
mov esp, ebp
pop ebp
ret
Function at 0x45836d
Capabilities:
Connect network resource
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x10], ebx
mov edi, edx
mov dword [ebp - 8], ebx
call fcn.00407627
lea ecx, [ebp - 0x20]
call fcn.00407627
lea ecx, [ebp - 0x40]
call fcn.00407627
push 0x4bb3b8
lea ecx, [ebp - 0x30]
call fcn.00407b8c
push esi
lea ecx, [ebp - 0x30]
call fcn.00407c6b
push str.CLSID
lea ecx, [ebp - 0x30]
call fcn.00407c6b
lea ecx, [ebp - 0x20]
call fcn.00407d4c
test edi, edi
je 0x4583f0
push 0x5c
pop eax
cmp word [edi], ax
je 0x4583f0
cmp word [edi + 2], ax
je 0x4583f0
push 0x4bb3ec
lea ecx, [ebp - 0x20]
call fcn.00407b8c
push edi
lea ecx, [ebp - 0x20]
call fcn.00407c6b
cmp dword [ebp + 0xc], ebx
je 0x458441
push 0x20
lea eax, [ebp - 0x60]
push ebx
push eax
call fcn.004238f0
add esp, 0xc
mov dword [ebp - 0x5c], ebx
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x40]
push eax
call fcn.00408007
push str.IPC_
lea ecx, [ebp - 0x40]
call fcn.00407c6b
mov eax, dword [ebp - 0x40]
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x60]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.MPR.dll_WNetAddConnection2W]
mov esi, eax
test esi, esi
js 0x4584cd
lea eax, [ebp - 0x10]
push eax
push reloc.WSOCK32.dll_bind
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
mov esi, eax
test esi, esi
jne 0x4584cd
lea eax, [ebp - 8]
push eax
push 0x20019
push ebx
push dword [ebp - 0x30]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
test esi, esi
jne 0x4584c8
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x1fe
push eax
lea eax, [ebp - 0x26c]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x4584c3
mov eax, dword [ebp - 0xc]
xor ecx, ecx
push dword [ebp + 8]
shr eax, 1
mov dword [ebp - 0xc], eax
mov word [ebp + eax*2 - 0x26c], cx
lea eax, [ebp - 0x26c]
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
mov esi, eax
push dword [ebp - 8]
call edi
push dword [ebp - 0x10]
call edi
lea ecx, [ebp - 0x40]
call fcn.004058c4
lea ecx, [ebp - 0x20]
call fcn.004058c4
lea ecx, [ebp - 0x30]
call fcn.004058c4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x461c81
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov esi, dword [ebp + 8]
test esi, esi
js 0x461d06
jne 0x461c95
push 0
jmp 0x461d00
cmp esi, 0xf
jae 0x461cff
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x461cff
mov dword [ebp + 8], esi
fild dword [ebp + 8]
test esi, esi
jns 0x461cb8
fadd qword [0x4bdad8]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fstp qword [ebp - 0x28]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
sbb eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
fild qword [ebp - 0x18]
fstp qword [ebp - 0x20]
call fcn.00421087
fdivr qword [ebp - 0x20]
fcomp qword [ebp - 0x28]
fnstsw ax
test ah, 5
jnp 0x461cc1
jmp 0x461d06
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x461e60
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
xor eax, eax
mov dword [esi + 4], eax
mov byte [esi + 0xa], al
mov eax, dword [ebp + 8]
mov dword [esi], 0xff
mov word [esi + 8], ax
test ax, ax
jne 0x461e84
xor al, al
jmp 0x461ec9
push eax
call dword [sym.imp.USER32.dll_VkKeyScanW]
movzx eax, ax
cmp ax, 0xffff
je 0x461e80
push ebx
mov ebx, eax
mov byte [esi], al
push 0
movzx eax, al
push eax
sar ebx, 8
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov byte [esi + 7], al
test bl, 1
je 0x461eb4
mov byte [esi + 1], 1
test bl, 2
je 0x461ebd
mov byte [esi + 3], 1
test bl, 4
pop ebx
je 0x461ec7
mov byte [esi + 4], 1
mov al, 1
pop esi
pop ebp
ret 4

Function at 0x4639f4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
call fcn.004638f3
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
add dword [esi + 0x10], eax
adc dword [esi + 0x14], 0
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x463fc4
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [ecx]
mov dword [esp], eax
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
mov eax, dword [ecx + 8]
push ebx
mov dword [esp + 0xc], eax
mov eax, dword [ecx + 0xc]
lea ecx, [esp + 4]
push esi
push 0x491ac0
mov dword [esp + 0x18], eax
inc dword [eax]
call fcn.004076e6
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x464091
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 2
jne 0x464028
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x46402d
jmp 0x464095
cmp eax, 3
jne 0x464099
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x18], esi
mov dword [esp + 0x24], eax
push 0x491ac0
inc dword [eax]
call fcn.00407c8f
cmp eax, 0xffffffff
je 0x464086
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x20]
call fcn.00407cec
lea ecx, [esp + 0x18]
call fcn.00463fc4
test al, al
je 0x464084
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne al
mov bl, al
lea ecx, [esp + 0x18]
call fcn.004058c4
jmp 0x46409b
test al, 0x10
je 0x464099
mov bl, 1
jmp 0x46409b
xor bl, bl
lea ecx, [esp + 8]
call fcn.004058c4
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46437c
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4c9428]
sub esp, 0x1c
cmp byte [eax + 0x25], 0
jne 0x464394
mov eax, 0x80004005
jmp 0x464408
push ebx
push esi
xor esi, esi
mov eax, 0x80
push esi
push eax
push 3
push esi
push 3
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4643f7
push edi
xor eax, eax
mov dword [ebp - 0x10], 7
lea edi, [ebp - 0x1c]
mov dword [ebp - 0xc], esi
stosd dword es:[edi], eax
push esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 4]
push eax
push 0xc
lea eax, [ebp - 0x1c]
push eax
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0x2d1400
push ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
test esi, esi
jne 0x4643fe
mov eax, 0x80004005
jmp 0x464406
xor eax, eax
cmp byte [ebp - 0x14], al
setne al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4649f1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x254
push esi
mov esi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x464a2c
lea ecx, [esp + 8]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x464a21
or eax, eax
jmp 0x464a2c
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 8]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x464a31
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0x18]
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
push eax
push edi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
test esi, esi
jne 0x464a56
xor al, al
jmp 0x464bfe
push esi
call fcn.004218c6
pop ecx
push eax
mov dword [ebp - 4], eax
xor eax, eax
push esi
push eax
push edi
mov dword [ebp - 0xc], eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
mov esi, dword [ebp + 8]
push esi
call fcn.0042370c
xor ecx, ecx
add eax, 0x1a
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004218c6
mov edi, eax
push 0x491ac0
push edi
call fcn.004238cc
push 0x491ac0
push esi
call fcn.0042405c
add esp, 0x18
test eax, eax
je 0x464b42
push str.StringFileInfo_
push edi
call fcn.0042389d
push 0x491ac0
push esi
call fcn.00424497
add esp, 0x10
test eax, eax
jne 0x464b39
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push str.VarFileInfoTranslation
push dword [ebp - 4]
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x464b15
mov eax, dword [ebp - 0x10]
lea ecx, [edi + 0x20]
push 0
mov esi, dword [eax]
push esi
push 4
pop edx
call fcn.00420602
push 0
shr esi, 0x10
lea ecx, [edi + 0x28]
push esi
push 4
pop edx
call fcn.00420602
mov esi, dword [ebp + 8]
add esp, 0x10
jmp 0x464b22
push str.04090000
push edi
call fcn.0042389d
pop ecx
pop ecx
push 0x491ac0
push edi
call fcn.0042389d
push esi
push edi
call fcn.0042389d
add esp, 0x10
jmp 0x464b42
push esi
push edi
call fcn.0042389d
pop ecx
pop ecx
push str.DefaultLangCodepage
push esi
call fcn.00423a0d
pop ecx
pop ecx
test eax, eax
jne 0x464b7d
push 8
lea eax, [edi + 0x20]
push eax
push ebx
call fcn.00424bcb
push dword [ebp - 4]
xor eax, eax
mov word [ebx + 0x10], ax
call fcn.0042193c
push edi
call fcn.0042193c
add esp, 0x14
mov al, 1
jmp 0x464bfe
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push edi
push dword [ebp - 4]
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x464beb
push 0x491ac0
push esi
call fcn.0042405c
pop ecx
pop ecx
test eax, eax
jne 0x464bcd
mov eax, dword [ebp - 8]
mov edx, dword [eax + 8]
mov ecx, dword [eax + 0xc]
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
movzx eax, dx
push eax
shr edx, 0x10
push edx
push str._u._u._u._u
push ebx
call fcn.004241a8
add esp, 0x18
jmp 0x464be7
push 0x200
push dword [ebp - 8]
push ebx
call fcn.00424bcb
add esp, 0xc
xor eax, eax
mov word [ebx + 0x400], ax
mov byte [ebp - 0xc], 1
push dword [ebp - 4]
call fcn.0042193c
push edi
call fcn.0042193c
mov al, byte [ebp - 0xc]
pop ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x464c4e
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x298
lea eax, [ebp - 0x298]
push esi
push edi
push eax
push 0x101
mov edi, edx
mov esi, ecx
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
jne 0x464d11
push 0x100
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.WSOCK32.dll_gethostname]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
je 0x464d11
mov edx, dword [eax + 0xc]
xor ecx, ecx
cmp dword [edx], ecx
je 0x464cae
mov eax, edx
lea eax, [eax + 4]
inc ecx
cmp dword [eax], 0
jne 0x464ca5
cmp esi, ecx
jle 0x464cc1
push str.0.0.0.0
push edi
call fcn.004238cc
pop ecx
pop ecx
jmp 0x464d09
push 4
push dword [edx + esi*4 - 4]
lea eax, [ebp - 4]
push eax
call fcn.00421950
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.WSOCK32.dll_inet_ntoa]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.00424e50
or edx, 0xffffffff
lea ecx, [ebp - 0x108]
call fcn.00465a99
mov esi, eax
push esi
push edi
call fcn.004238cc
push esi
call fcn.0042193c
add esp, 0x14
call dword [sym.imp.WSOCK32.dll_WSACleanup]
jmp 0x464d1e
push 0x491910
push edi
call fcn.004238cc
pop ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x464f5e
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
mov word [ebp - 0xc], 0x500
lea eax, [ebp - 8]
mov dword [ebp - 0x10], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov ecx, eax
mov dword [ebp - 4], ecx
test ecx, ecx
je 0x464fb7
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 8]
neg eax
sbb eax, eax
and dword [ebp - 4], eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
xor eax, eax
cmp ecx, 1
pop ebx
sete al
mov esp, ebp
pop ebp
ret

Function at 0x46502e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x465041
test al, 0x10
je 0x465041
mov al, 1
ret
xor al, al
ret
Function at 0x465090
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov eax, ecx
xor esi, esi
mov dword [ebp - 4], eax
mov byte [0x4c82b7], 0
mov ebx, edx
test edi, edi
je 0x4650e2
mov byte [0x4c82b8], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0xc], eax
xor ecx, ecx
lea eax, [ebp + 0x10]
mov dword [ebp - 8], edi
push eax
push ecx
lea eax, [ebp - 0xc]
push eax
push 0x465572
push ecx
push ecx
call fcn.0042499e
mov esi, eax
add esp, 0x18
mov eax, dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov edi, eax
test esi, esi
je 0x46510d
push 0xffffffffffffffff
push esi
mov byte [0x4c82b8], 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x4c82b7], 1
jne 0x46511b
or eax, 0xffffffff
jmp 0x46511d
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4652be
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x20450
call fcn.00432450
push ebx
push esi
lea eax, [esp + 0x10458]
mov esi, edx
push eax
mov edx, 0x7fff
call fcn.00464c05
pop ecx
lea eax, [esp + 0x458]
mov edx, 0x7fff
push eax
mov ecx, esi
call fcn.00464c05
pop ecx
lea ecx, [esp + 0x10458]
call fcn.0046502e
test al, al
jne 0x465311
xor al, al
jmp 0x46551f
lea ecx, [esp + 0x458]
call fcn.0046502e
xor esi, esi
test al, al
je 0x4653ed
cmp byte [ebp + 8], 0
je 0x46530a
lea eax, [esp + 0x458]
push eax
lea eax, [esp + 0x1045c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x465389
lea eax, [esp + 0x458]
push eax
lea eax, [esp + 0x1045c]
push eax
call fcn.0042405c
pop ecx
pop ecx
test eax, eax
je 0x465382
lea eax, [esp + 0x458]
push eax
lea eax, [esp + 0x1045c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne al
jmp 0x46551f
mov al, 1
jmp 0x46551f
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x254]
push eax
push esi
lea eax, [esp + 0x10464]
push esi
push eax
call fcn.00424c0b
add esp, 0x14
lea eax, [esp + 0x458]
push 0x491ac0
push eax
call fcn.0042389d
lea eax, [esp + 0x258]
push eax
lea eax, [esp + 0x464]
push eax
call fcn.0042389d
add esp, 0x10
cmp word [esp + 0x48], si
je 0x4653ed
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x45c]
push eax
call fcn.0042389d
pop ecx
pop ecx
lea eax, [esp + 0x458]
push eax
lea ecx, [esp + 0xc]
call fcn.00407da1
lea eax, [esp + 0x10458]
push eax
lea ecx, [esp + 0x3c]
call fcn.00407da1
lea edx, [esp + 8]
lea ecx, [esp + 0x38]
call fcn.00464fc4
lea ecx, [esp + 0x38]
mov bl, al
call fcn.004058c4
lea ecx, [esp + 8]
call fcn.004058c4
test bl, bl
je 0x465487
push 1
lea edx, [esp + 0x45c]
lea ecx, [esp + 0x1045c]
call fcn.00463c0b
pop ecx
test al, al
je 0x46530a
lea eax, [esp + 0x10458]
push eax
lea ecx, [esp + 0xc]
call fcn.00407da1
mov dl, 1
lea ecx, [esp + 8]
call fcn.00465720
mov bl, al
lea ecx, [esp + 8]
neg bl
sbb bl, bl
call fcn.004058c4
inc bl
sete al
jmp 0x46551f
lea eax, [esp + 0x458]
push eax
lea eax, [esp + 0x1045c]
push eax
call fcn.0042405c
pop ecx
pop ecx
test eax, eax
je 0x46530a
lea eax, [esp + 0x10458]
push eax
call fcn.0042370c
pop ecx
xor ecx, ecx
mov word [esp + eax*2 + 0x1045a], cx
lea eax, [esp + 0x458]
push eax
call fcn.0042370c
pop ecx
xor ecx, ecx
mov dword [esp + 0x2e], esi
mov dword [esp + 0x32], esi
mov word [esp + eax*2 + 0x45a], cx
lea eax, [esp + 0x10458]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x458]
mov dword [esp + 0x24], eax
mov eax, 0x614
mov word [esp + 0x28], ax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x2e], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], 1
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
neg eax
sbb al, al
inc al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x465720
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10020
call fcn.00432450
mov ecx, dword [ecx]
lea eax, [ebp - 0x10020]
push ebx
mov bl, dl
mov edx, 0x7fff
push eax
call fcn.00464c05
pop ecx
lea ecx, [ebp - 0x10020]
call fcn.0046502e
test al, al
je 0x4657b5
lea eax, [ebp - 0x10020]
push eax
test bl, bl
jne 0x46576b
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
jmp 0x4657b5
call fcn.0042370c
pop ecx
xor ecx, ecx
mov dword [ebp - 0x1c], 3
mov word [ebp + eax*2 - 0x1001e], cx
lea eax, [ebp - 0x10020]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xa], eax
mov dword [ebp - 6], eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 0x20], eax
mov eax, 0x614
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
neg eax
sbb al, al
inc al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4657ba
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov ebx, ecx
mov esi, edx
push str.SeShutdownPrivilege
lea ecx, [ebp - 0x10]
call fcn.00463b47
push ecx
lea ecx, [ebp - 0x10]
call fcn.0045930c
test al, al
jne 0x4657e4
xor esi, esi
jmp 0x465831
cmp ebx, 0x20
je 0x465823
cmp ebx, 0x40
je 0x46581f
test bl, 0xb
jne 0x4657fe
push 0
push ebx
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x46582f
xor ecx, ecx
test bl, 0x14
je 0x465806
inc ecx
xor eax, eax
test bl, 2
je 0x46580e
inc eax
push esi
push eax
push ecx
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownExW]
jmp 0x46582f
xor eax, eax
jmp 0x465826
xor eax, eax
inc eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetSystemPowerState]
mov esi, eax
lea ecx, [ebp - 0x10]
call fcn.00458d5c
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x465841
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov esi, ecx
test esi, esi
js 0x4658bf
jne 0x465854
push 0
jmp 0x4658b9
cmp esi, 0xf
jae 0x4658b8
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x4658b8
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
sbb eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
fild qword [ebp - 0x18]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
fild qword [ebp - 0x28]
fstp qword [ebp - 0x20]
fdiv qword [ebp - 0x20]
fmul qword [0x4a6bf0]
call fcn.0043bed6
cmp eax, esi
jb 0x465871
jmp 0x4658bf
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
pop esi
mov esp, ebp
pop ebp
ret