joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fc938
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x108], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4fcb0d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
cmp dword [esi + 0x2c], 0
jne 0x4fcaf4
mov eax, dword [esi + 0x24]
call fcn.004041b8
test eax, eax
jne 0x4fc98d
mov eax, dword [esi + 0x28]
call fcn.004041b8
test eax, eax
jne 0x4fc98d
mov eax, esi
call fcn.004fcbac
jmp 0x4fcaf4
cmp dword [esi + 0x94], 0
jne 0x4fc9c4
lea eax, [ebp - 0x101]
mov edx, dword [esi + 0x24]
call fcn.0040a4d4
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x569698]
mov eax, dword [eax + 0x38]
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [esi + 0x94], eax
cmp dword [esi + 0x98], 0
jne 0x4fc9fb
lea eax, [ebp - 0x101]
mov edx, dword [esi + 0x28]
call fcn.0040a4d4
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x569698]
mov eax, dword [eax + 0x38]
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [esi + 0x98], eax
mov ecx, dword [esi + 0x98]
mov edx, dword [esi + 0x94]
mov eax, esi
call fcn.004fcbec
mov ebx, eax
test bl, bl
jne 0x4fcaa9
mov eax, dword [esi + 0x24]
call fcn.004041b8
test eax, eax
jne 0x4fca33
mov eax, dword [esi + 0xb0]
call fcn.004041b8
test eax, eax
je 0x4fcaa9
mov eax, dword [esi + 0xb0]
call fcn.004041b8
test eax, eax
je 0x4fca55
lea eax, [ebp - 0x101]
mov edx, dword [esi + 0xb0]
call fcn.0040a4d4
jmp 0x4fca81
push dword [esi + 0x24]
push 0x4fcb28
push dword [esi + 0x28]
lea eax, [ebp - 0x108]
mov edx, 3
call fcn.00404278
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 0x101]
call fcn.0040a4d4
push 7
lea eax, [ebp - 0x101]
push eax
call sub.kernel32.dll_WinExec
cmp eax, 0x20
jb 0x4fcaa9
mov ecx, dword [esi + 0x98]
mov edx, dword [esi + 0x94]
mov eax, esi
call fcn.004fcbec
mov ebx, eax
test bl, bl
jne 0x4fcab6
mov eax, esi
call fcn.004fcbac
jmp 0x4fcaf4
mov eax, dword [esi + 0x4c]
test eax, eax
je 0x4fcac5
mov dword [esi + 0x9c], eax
jmp 0x4fcacf
mov dword [esi + 0x9c], 1
mov eax, esi
call fcn.004fcc64
test al, al
je 0x4fcaf4
mov eax, esi
mov bx, 0xffef
call fcn.00403374
xor ecx, ecx
xor edx, edx
mov eax, esi
call fcn.004fced4
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fcb14
lea eax, [ebp - 0x108]
call fcn.00403f38
ret
Function at 0x506800
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040436c
xor eax, eax
push ebp
push 0x506858
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00409dd8
push 0
mov eax, dword [ebp - 4]
call fcn.0040437c
push eax
call sub.kernel32.dll_SetFileAttributesA
mov eax, dword [ebp - 4]
call fcn.00409ef4
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50685f
lea eax, [ebp - 4]
call fcn.00403f38
ret

Function at 0x506af4
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x158], ecx
mov dword [ebp - 0x15c], ecx
mov dword [ebp - 0x154], ecx
mov esi, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
call fcn.0040436c
xor eax, eax
push ebp
push 0x506cf0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403f38
mov al, byte [0x506d00]
push eax
lea eax, [ebp - 0x154]
push eax
mov ecx, 0x506d0c
mov edx, 0x506d18
mov eax, dword [ebp - 8]
call fcn.0040d930
mov edx, dword [ebp - 0x154]
lea eax, [ebp - 8]
call fcn.00403fd0
lea eax, [ebp - 0x150]
push eax
mov eax, dword [ebp - 8]
call fcn.0040437c
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x506cca
test byte [ebp - 0x150], 0x10
jne 0x506cc4
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x13c]
push eax
call sub.kernel32.dll_FileTimeToLocalFileTime
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 2]
push eax
lea eax, [ebp - 0x10]
push eax
call sub.kernel32.dll_FileTimeToDosDateTime
test eax, eax
je 0x506cc4
cmp dword [ebp - 4], 0xffffffff
setne al
test al, al
je 0x506cc4
lea edx, [ebp - 0x158]
mov eax, dword [ebp - 8]
call fcn.0040a044
push dword [ebp - 0x158]
lea eax, [ebp - 0x15c]
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.00404168
push dword [ebp - 0x15c]
push 0x506d24
mov eax, esi
mov edx, 3
call fcn.00404278
jmp 0x506ca1
mov eax, dword [0x567568]
mov eax, dword [eax]
call fcn.0045184c
test byte [ebp - 0x150], 0x10
jne 0x506ca1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x13c]
push eax
call sub.kernel32.dll_FileTimeToLocalFileTime
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 2]
push eax
lea eax, [ebp - 0x10]
push eax
call sub.kernel32.dll_FileTimeToDosDateTime
test eax, eax
je 0x506ca1
cmp dword [ebp - 4], 0xffffffff
setne al
test al, al
je 0x506cc4
push dword [esi]
lea edx, [ebp - 0x160]
mov eax, dword [ebp - 8]
call fcn.0040a044
push dword [ebp - 0x160]
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.00404168
push dword [ebp - 0x164]
push 0x506d24
mov eax, esi
mov edx, 4
call fcn.00404278
lea eax, [ebp - 0x150]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x506c19
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x12
jne 0x506c19
push ebx
call sub.kernel32.dll_FindClose_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x506cf7
lea eax, [ebp - 0x164]
mov edx, 5
call fcn.00403f5c
lea eax, [ebp - 8]
call fcn.00403f38
ret
Function at 0x5117dc
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x5117e5
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov ebx, ecx
mov esi, edx
xor eax, eax
push ebp
push 0x511a21
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4783fc]
call fcn.004784fc
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5119ff
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov eax, dword [esi + 8]
mov edx, 1
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x10]
mov edx, 0x511a38
call fcn.004042c8
je 0x51189e
lea ecx, [ebp - 0x14]
mov eax, dword [esi + 8]
mov edx, 1
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x14]
mov edx, 0x511a48
call fcn.004042c8
je 0x51189e
lea ecx, [ebp - 0x18]
mov eax, dword [esi + 8]
mov edx, 1
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x18]
mov edx, 0x511a58
call fcn.004042c8
je 0x51189e
lea ecx, [ebp - 0x1c]
mov eax, dword [esi + 8]
mov edx, 1
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x1c]
mov edx, 0x511a68
call fcn.004042c8
jne 0x5118ad
mov edx, 0x80000001
mov eax, dword [ebp - 4]
call fcn.0047859c
jmp 0x5118ba
mov edx, 0x80000002
mov eax, dword [ebp - 4]
call fcn.0047859c
mov eax, esi
call fcn.00461e84
test al, al
je 0x51191e
lea ecx, [ebp - 0x20]
mov eax, dword [esi + 8]
mov edx, 1
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x20]
mov eax, 0x511a7c
call fcn.004044a4
test eax, eax
jle 0x511902
lea eax, [ebp - 8]
mov edx, 0x511a88
call fcn.00403fd0
lea eax, [ebp - 0xc]
mov edx, 0x511ac8
call fcn.00403fd0
jmp 0x511975
lea eax, [ebp - 8]
mov edx, 0x511b0c
call fcn.00403fd0
lea eax, [ebp - 0xc]
mov edx, 0x511b44
call fcn.00403fd0
jmp 0x511975
lea ecx, [ebp - 0x24]
mov eax, dword [esi + 8]
mov edx, 1
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x24]
mov eax, 0x511a7c
call fcn.004044a4
test eax, eax
jle 0x51195b
lea eax, [ebp - 8]
mov edx, 0x511ac8
call fcn.00403fd0
lea eax, [ebp - 0xc]
mov edx, 0x511a88
call fcn.00403fd0
jmp 0x511975
lea eax, [ebp - 8]
mov edx, 0x511b44
call fcn.00403fd0
lea eax, [ebp - 0xc]
mov edx, 0x511b0c
call fcn.00403fd0
mov cl, 1
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00478604
test al, al
je 0x5119e9
test bl, bl
jne 0x5119a7
lea ecx, [ebp - 0x28]
mov eax, dword [esi + 8]
xor edx, edx
mov edi, dword [eax]
call dword [edi + 0xc]
mov ecx, dword [ebp - 0x28]
mov edx, dword [esi + 0x24]
mov eax, dword [ebp - 4]
call fcn.00478b54
jmp 0x5119b2
mov edx, dword [esi + 0x24]
mov eax, dword [ebp - 4]
call fcn.004788a0
mov eax, dword [ebp - 4]
call fcn.0047856c
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00478604
test al, al
je 0x5119de
mov edx, dword [esi + 0x24]
mov eax, dword [ebp - 4]
call fcn.004788a0
mov eax, dword [ebp - 4]
call fcn.0047856c
test bl, bl
je 0x5119e9
mov eax, esi
call fcn.00461e28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x511a06
mov eax, dword [ebp - 4]
call fcn.00403198
ret
Function at 0x51b594
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040436c
xor eax, eax
push ebp
push 0x51b734
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
xor eax, eax
push ebp
push 0x51b6f7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x567278]
xor edx, edx
mov dword [eax], edx
mov dword [eax + 4], edx
mov word [eax + 8], dx
mov eax, dword [0x5677f0]
mov eax, dword [eax]
mov eax, dword [eax + 0x374]
mov dl, 1
call fcn.004558e4
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040a10c
mov eax, dword [ebp - 0xc]
call fcn.005365a0
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00409dd8
push 0
mov eax, dword [ebp - 4]
call fcn.0040437c
push eax
call sub.kernel32.dll_SetFileAttributesA
mov eax, dword [ebp - 4]
call fcn.00506800
xor edx, edx
jmp 0x51b6d0
mov eax, dword [0x567568]
mov eax, dword [eax]
call fcn.0045184c
xor eax, eax
push ebp
push 0x51b667
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0040a10c
mov eax, dword [ebp - 0x10]
call fcn.005365a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51b671
push 0
mov eax, dword [ebp - 4]
call fcn.0040437c
push eax
call sub.kernel32.dll_SetFileAttributesA
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00409dd8
mov eax, dword [ebp - 4]
call fcn.00506800
mov eax, dword [ebp - 4]
call fcn.00506a1c
mov edx, eax
xor dl, 1
mov eax, dword [0x567278]
fld xword [eax]
fcomp dword [0x51b748]
fnstsw ax
sahf
jbe 0x51b6d0
mov eax, dword [0x5677f0]
mov eax, dword [eax]
mov eax, dword [eax + 0x374]
xor edx, edx
call fcn.004558e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51b711
cmp dl, 1
jne 0x51b630
mov eax, dword [0x5677f0]
mov eax, dword [eax]
mov eax, dword [eax + 0x374]
xor edx, edx
call fcn.004558e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51b701
mov eax, dword [ebp - 4]
call fcn.00506a1c
test al, al
jne 0x51b711
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51b73b
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00403f5c
lea eax, [ebp - 4]
call fcn.00403f38
ret
Function at 0x51b74c
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040436c
xor eax, eax
push ebp
push 0x51b844
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040a10c
mov eax, dword [ebp - 0xc]
call fcn.005365a0
push 0x1388
call sub.kernel32.dll_Sleep
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00409dd8
push 0
mov eax, dword [ebp - 4]
call fcn.0040437c
push eax
call sub.kernel32.dll_SetFileAttributesA
mov eax, dword [ebp - 4]
call fcn.00506800
mov eax, dword [ebp - 4]
call fcn.00506a1c
test al, al
je 0x51b7f6
mov eax, dword [ebp - 4]
call fcn.00530270
test bl, bl
je 0x51b821
push 0x40
push 0x51b854
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, 0x51b874
call fcn.00404204
mov eax, dword [ebp - 0x10]
call fcn.0040437c
push eax
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0x51b821
test bl, bl
je 0x51b821
push 0x40
push 0x51b854
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 4]
mov edx, 0x51b8a8
call fcn.00404204
mov eax, dword [ebp - 0x14]
call fcn.0040437c
push eax
push 0
call sub.user32.dll_MessageBoxA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51b84b
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00403f5c
lea eax, [ebp - 4]
call fcn.00403f38
ret
Function at 0x51b8c8
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x51b8d0
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040436c
xor eax, eax
push ebp
push 0x51ba4d
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov dl, 1
mov eax, dword [0x569758]
call fcn.00413f14
mov eax, dword [0x569758]
mov edx, dword [eax]
call dword [edx + 0x7c]
mov eax, dword [ebp - 4]
call fcn.00409d0c
test al, al
je 0x51ba21
lea eax, [ebp - 0x10]
call fcn.0052e1c4
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x51ba64
call fcn.00404204
mov al, byte [0x51ba70]
push eax
lea eax, [ebp - 0xc]
push eax
xor ecx, ecx
mov edx, 0x51ba7c
mov eax, dword [ebp - 4]
call fcn.0040d930
mov al, byte [0x51ba70]
push eax
lea eax, [ebp - 0x14]
push eax
xor ecx, ecx
mov edx, 0x51ba88
mov eax, dword [ebp - 0xc]
call fcn.0040d930
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0xc]
call fcn.00403fd0
push 0
push dword [ebp - 8]
push 0x51ba7c
push dword [ebp - 0xc]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404278
mov eax, dword [ebp - 0x18]
call fcn.0040437c
push eax
mov eax, dword [ebp - 4]
call fcn.0040437c
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
je 0x51ba21
call fcn.0040b240
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x20]
call fcn.0040be58
push dword [ebp - 0x20]
push 0x51ba94
push dword [ebp - 4]
push 0x51baa0
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 4]
call fcn.004b05d4
lea eax, [ebp - 0x34]
lea edx, [ebp - 0x24]
call fcn.004b0730
push dword [ebp - 0x24]
push 0x51baac
mov eax, dword [ebp - 4]
call fcn.00506960
lea edx, [ebp - 0x38]
call fcn.00409a68
push dword [ebp - 0x38]
push 0x51baac
push dword [ebp - 0xc]
push 0x51baac
lea eax, [ebp - 0x1c]
mov edx, 0xa
call fcn.00404278
mov edx, dword [ebp - 0x1c]
mov eax, dword [0x569758]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov bl, 1
test bl, bl
je 0x51ba2a
call fcn.0051b0e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51ba54
lea eax, [ebp - 0x38]
call fcn.00403f38
lea eax, [ebp - 0x24]
mov edx, 9
call fcn.00403f5c
ret
Function at 0x51d448
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffe70
mov ebp, edx
mov ebx, eax
push esp
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, ebp
call fcn.00403f38
mov eax, ebx
call fcn.0040437c
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x51d49d
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x51d491
push dword [edi]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, ebp
call fcn.004040f0
inc ebx
mov edi, dword [esi + ebx*4]
test edi, edi
jne 0x51d480
call sub.wsock32.dll_WSACleanup
add esp, 0x190
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x51d4a8
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040436c
xor eax, eax
push ebp
push 0x51d54e
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.0040437c
push eax
call sub.kernel32.dll_CreateFileA_1
mov edi, eax
test edi, edi
je 0x51d538
push 0
push edi
call sub.kernel32.dll_GetFileSize_1
mov esi, eax
test esi, esi
je 0x51d538
push 0
push 0
push 0
push edi
call sub.kernel32.dll_SetFilePointer_1
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.004044ec
push 0
lea eax, [ebp - 0xc]
push eax
push esi
mov eax, dword [ebp - 8]
call fcn.00404388
push eax
push edi
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x51d532
mov bl, 1
push edi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51d555
lea eax, [ebp - 4]
call fcn.00403f38
ret
Function at 0x5271e4
Capabilities:
Persist via winlogon helper dll registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040436c
mov eax, dword [ebp - 8]
call fcn.0040436c
xor eax, eax
push ebp
push 0x527271
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
push 1
mov ecx, dword [ebp - 4]
mov edx, 0x527284
mov eax, 0x80000002
call fcn.005268a0
mov eax, dword [ebp - 8]
push eax
push 1
mov ecx, dword [ebp - 4]
mov edx, 0x5272cc
mov eax, 0x80000002
call fcn.005268a0
mov eax, dword [ebp - 8]
push eax
push 1
mov ecx, dword [ebp - 4]
mov edx, 0x52731c
mov eax, 0x80000002
call fcn.005268a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x527278
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403f5c
ret
Function at 0x5301e8
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffdc
mov eax, dword [0x567908]
cmp dword [eax], 2
jne 0x53024e
push esp
push 0x20
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
lea eax, [esp + 8]
push eax
push 0x53025c
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [esp + 0x14], 1
mov eax, dword [esp + 8]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 2
lea eax, [esp + 0x10]
push eax
push 0
push 0
lea eax, [esp + 0x20]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
push 1
push 2
call sub.user32.dll_ExitWindowsEx
add esp, 0x24
ret
Function at 0x534530
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef4
mov ebx, eax
push esp
push 5
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.00404168
add esp, 0x10c
pop ebx
ret

Function at 0x5365a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040436c
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x536715
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
xor edx, edx
mov eax, 2
call fcn.00468070
mov ebx, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, ebx
call fcn.00468090
jmp 0x5366da
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00404168
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.0040a10c
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00409674
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00409674
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.004042c8
je 0x5366ba
lea eax, [ebp - 0x144]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00404168
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00409674
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00409674
mov edx, dword [ebp - 0x148]
pop eax
call fcn.004042c8
jne 0x5366d1
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov esi, eax
mov edx, edi
mov eax, ebx
call fcn.004680b0
test eax, eax
jne 0x53661b
test esi, esi
jne 0x5366e9
or esi, 0xffffffff
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53671c
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.00403f5c
lea eax, [ebp - 4]
call fcn.00403f38
ret

Function at 0x536728
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, eax
push 0x800
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov eax, ebx
mov edx, esp
mov ecx, 0x800
call fcn.00404168
add esp, 0x800
pop ebx
ret

Function at 0x536838
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, eax
push 0x800
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov eax, ebx
mov edx, esp
mov ecx, 0x800
call fcn.00404168
add esp, 0x800
pop ebx
ret
Function at 0x1e4b9c7
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x11c
cmp dword [esp + 0x128], 0
je 0x1e4bb8c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x130]
xor ebp, ebp
push edi
mov dword [esp + 0x1c], ebp
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x1e4bb88
mov edx, esi
mov eax, dword [edx]
mov ebx, dword [esp + 0x130]
add eax, ebx
mov dword [esp + 0x18], eax
mov eax, dword [edx + 0x10]
add eax, ebx
lea edi, [ecx + ebx]
mov dword [esp + 0x20], eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
mov dword [esp + 0x10], ebx
test ebx, ebx
jne 0x1e4ba32
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
mov dword [esp + 0x10], eax
push 0x104
lea eax, [esp + 0x2c]
push 0
push eax
call fcn.01e44142
add esp, 0xc
test ebx, ebx
je 0x1e4bb32
mov eax, dword [esp + 0x18]
and dword [esp + 0x14], 0
mov eax, dword [eax]
test eax, eax
je 0x1e4bb1b
mov esi, dword [esp + 0x10]
xor edi, edi
mov ebp, dword [esp + 0x130]
test eax, eax
jns 0x1e4ba77
movzx ebx, ax
jmp 0x1e4ba7c
lea ebx, [ebp + 2]
add ebx, eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [esp + 0x20]
mov dword [edi + ecx], eax
test eax, eax
jne 0x1e4baf3
cmp dword [0x1e50eac], 1
jne 0x1e4baf3
push 0x104
push eax
lea eax, [esp + 0x30]
push eax
call fcn.01e44142
lea eax, [esp + 0x34]
push eax
call fcn.01e4bc74
lea eax, [esp + 0x38]
push 0x1e43204
push eax
call fcn.01e44170
lea eax, [esp + 0x40]
push ebx
push eax
call fcn.01e44170
add esp, 0x20
lea eax, [esp + 0x24]
push 0
push eax
lea eax, [esp + 0x30]
push eax
call fcn.01e44197
pop ecx
push eax
lea eax, [esp + 0x34]
push eax
push dword [0x1e50e58]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
inc ecx
mov edi, ecx
mov dword [esp + 0x14], ecx
shl edi, 2
mov eax, dword [edi + eax]
test eax, eax
jne 0x1e4ba70
mov esi, dword [esp + 0x134]
mov ebp, dword [esp + 0x1c]
inc ebp
imul edx, ebp, 0x14
mov dword [esp + 0x1c], ebp
add edx, esi
mov ecx, dword [edx + 0xc]
test ecx, ecx
jne 0x1e4b9f9
jmp 0x1e4bb88
lea eax, [esp + 0x28]
push eax
call fcn.01e4bc74
lea eax, [esp + 0x2c]
mov dword [esp], 0x1e431e8
push eax
call fcn.01e44170
lea eax, [esp + 0x30]
push edi
push eax
call fcn.01e44170
add esp, 0x10
cmp dword [0x1e50eac], 1
jne 0x1e4bb88
push 0
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
call fcn.01e44197
pop ecx
push eax
lea eax, [esp + 0x34]
push eax
push dword [0x1e50e58]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebp
pop ebx
xor eax, eax
add esp, 0x11c
ret
Function at 0x1e4bbc2
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push 0x208
lea eax, [ebp - 0x410]
push eax
call fcn.01e4bc40
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1e50d24], eax
push 0
push 0
push 0
push 2
push 0
push dword [0x1e50d24]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [0x1e50d28], eax
push 0
push 0
push 0
push 4
push dword [0x1e50d28]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
add eax, dword [0x1e50eb4]
mov esp, ebp
pop ebp
ret