joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53d194
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x53d19c
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x53d356
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xff
call fcn.00402730
mov dword [ebp - 4], eax
mov dl, 1
mov eax, dword [0x417bc0]
call fcn.0040337c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x53d327
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.004043d8
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0xc]
mov ecx, 0x53d36c
call fcn.004044ec
mov eax, dword [ebp - 0xc]
call fcn.00409288
test al, al
je 0x53d2be
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x68]
lea ecx, [ebp - 8]
xor edx, edx
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea ecx, [ebp - 0x18]
mov edx, 0x53d38c
mov eax, dword [ebp - 8]
call fcn.004c51ac
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 8]
call fcn.00404278
lea eax, [ebp - 0x1c]
push eax
mov ecx, 4
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00404700
mov eax, dword [ebp - 0x1c]
call fcn.00408ebc
mov ebx, eax
lea eax, [ebp - 0x20]
push eax
mov ecx, 2
mov edx, 5
mov eax, dword [ebp - 8]
call fcn.00404700
mov eax, dword [ebp - 0x20]
call fcn.00408ebc
mov esi, eax
lea eax, [ebp - 0x24]
push eax
mov ecx, 2
mov edx, 7
mov eax, dword [ebp - 8]
call fcn.00404700
mov eax, dword [ebp - 0x24]
call fcn.00408ebc
mov edi, eax
mov ecx, edi
mov edx, esi
mov eax, ebx
call fcn.0040ac20
fstp qword [0xbce458]
wait
jmp 0x53d309
call fcn.0040ae54
fstp qword [0xbce458]
wait
call fcn.0040ae54
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x28]
mov eax, 0x53d3b8
call fcn.0040bafc
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 8]
mov edx, 0x53d38c
call fcn.004c508c
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x74]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53d32e
mov eax, dword [ebp - 0x10]
call fcn.004033ac
mov eax, dword [ebp - 4]
call fcn.00402750
ret

Function at 0x53d3c4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor edx, edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x53d454
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea edx, [ebp - 4]
lea eax, [ebp - 0x109]
call fcn.00409938
lea eax, [ebp - 0x110]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404700
mov edx, dword [ebp - 0x110]
mov eax, ebx
mov ecx, 0x53d468
call fcn.004044ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53d45b
lea eax, [ebp - 0x110]
call fcn.004041e0
lea eax, [ebp - 4]
call fcn.004041e0
ret
Function at 0x53e738
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xffffffac
mov ebx, eax
push 0x51
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov eax, ebx
mov edx, esp
mov ecx, 0x51
call fcn.00404450
add esp, 0x54
pop ebx
ret

Function at 0x53e760
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.00409938
add esp, 0x108
pop ebx
ret

Function at 0x53e828
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe84
push ebx
xor ecx, ecx
mov dword [ebp - 0x17c], ecx
mov dword [ebp - 0x18], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404690
xor eax, eax
push ebp
push 0x53e9e1
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x17c]
mov eax, dword [0x559800]
mov eax, dword [eax]
call fcn.004917a8
mov eax, dword [ebp - 0x17c]
lea edx, [ebp - 0x18]
call fcn.004094c8
lea eax, [ebp - 0x24]
xor ecx, ecx
mov edx, 0xc
call fcn.00402d20
mov dword [ebp - 0x24], 0xc
mov dword [ebp - 0x1c], 0xffffffff
xor eax, eax
mov dword [ebp - 0x20], eax
push 0
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
call sub.kernel32.dll_CreatePipe
lea eax, [ebp - 0x168]
xor ecx, ecx
mov edx, 0x44
call fcn.00402d20
mov dword [ebp - 0x168], 0x44
mov dword [ebp - 0x13c], 0x101
mov word [ebp - 0x138], bx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x128], eax
lea eax, [ebp - 0x178]
push eax
lea eax, [ebp - 0x168]
push eax
mov eax, dword [ebp - 0x18]
call fcn.004046a0
push eax
push 0
push 0x20
push 0xffffffffffffffff
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 4]
call fcn.004046a0
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x53e931
mov dword [ebp - 8], 0xffffffff
jmp 0x53e9b8
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
jmp 0x53e969
lea eax, [ebp - 0x124]
xor ecx, ecx
mov edx, pe_nt_image_headers32
call fcn.00402d20
push 0
lea eax, [ebp - 0x14]
push eax
push pe_nt_image_headers32
lea eax, [ebp - 0x124]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadFile
test eax, eax
jne 0x53e93c
mov eax, dword [0x559800]
mov eax, dword [eax]
call fcn.00490fec
push 0xffffffffffffffff
mov eax, dword [ebp - 0x178]
push eax
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x178]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x178]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x174]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53e9e8
lea eax, [ebp - 0x17c]
call fcn.004041e0
lea eax, [ebp - 0x18]
call fcn.004041e0
lea eax, [ebp - 4]
call fcn.004041e0
ret
Function at 0x53e9f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x53e9f8
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x53eb65
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x53eb40
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0040ae80
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 4]
mov eax, 0x53eb7c
call fcn.0040bafc
lea edx, [ebp - 0x1c]
mov eax, dword [0x559800]
mov eax, dword [eax]
call fcn.004917a8
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.00409494
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 8]
mov ecx, 0x53eb94
call fcn.004044ec
mov eax, dword [ebp - 8]
call fcn.00409298
test al, al
jne 0x53ea76
mov eax, dword [ebp - 8]
call fcn.00409718
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x2c]
mov ecx, 1
mov eax, 0x53eba8
call fcn.00409e28
mov eax, dword [ebp - 8]
call fcn.0053ece0
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov edx, 0x53ebc4
call fcn.004044ec
push 0
mov eax, dword [ebp - 0x10]
call fcn.004046a0
push eax
call sub.kernel32.dll_WinExec
lea eax, [ebp - 0x14]
mov edx, 0x53ebd8
call fcn.00404278
push dword [ebp - 0x14]
push dword [ebp - 8]
push 0x53ec1c
push 0x53ec1c
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404560
push dword [ebp - 0x14]
push 0x53ec28
push 0x53ec1c
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404560
lea eax, [ebp - 0x14]
mov edx, 0x53ec84
call fcn.004044a8
push 0
mov eax, dword [ebp - 0x14]
call fcn.004046a0
mov edx, eax
mov ecx, 0x53ecd8
mov eax, dword [0x559800]
mov eax, dword [eax]
call fcn.00491328
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x53eb4a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53eb6c
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.00404204
ret
Function at 0x53ece0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x160], edx
mov dword [ebp - 0x164], edx
mov dword [ebp - 0x15c], edx
mov dword [ebp - 0x158], edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0x150], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404690
lea esi, [ebp - 0x14c]
xor eax, eax
push ebp
push 0x53eedb
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x150]
push eax
mov eax, dword [ebp - 4]
call fcn.004044a0
mov edx, eax
mov ecx, 1
mov eax, dword [ebp - 4]
call fcn.00404700
mov eax, dword [ebp - 0x150]
mov edx, 0x53eef4
call fcn.004045ec
jne 0x53ed7b
mov eax, dword [ebp - 4]
call fcn.004044a0
mov edx, eax
lea eax, [ebp - 4]
mov ecx, 1
call fcn.00404740
mov dl, 1
mov eax, dword [0x417bc0]
call fcn.0040337c
mov dword [ebp - 0xc], eax
push esi
lea eax, [ebp - 0x154]
mov ecx, 0x53ef00
mov edx, dword [ebp - 4]
call fcn.004044ec
mov eax, dword [ebp - 0x154]
call fcn.004046a0
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
setne al
jmp 0x53ee43
mov eax, dword [0x559800]
mov eax, dword [eax]
call fcn.00490fec
lea eax, [ebp - 8]
lea edx, [esi + 0x2c]
mov ecx, 0x104
call fcn.00404450
mov eax, dword [esi]
cmp eax, 0x20
jne 0x53ee36
push dword [ebp - 4]
push 0x53eef4
push dword [ebp - 8]
lea eax, [ebp - 0x158]
mov edx, 3
call fcn.00404560
mov eax, dword [ebp - 0x158]
call fcn.00409288
test al, al
je 0x53ee36
lea edx, [ebp - 0x15c]
mov eax, dword [ebp - 8]
call fcn.0040863c
mov edx, dword [ebp - 0x15c]
mov eax, 0x53ef10
call fcn.004047e4
test eax, eax
jle 0x53ee36
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push esi
push ebx
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x53edbc
push ebx
call sub.kernel32.dll_FindClose_1
xor esi, esi
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
cmp ebx, 0
jl 0x53eea8
inc esi
cmp esi, 6
jl 0x53eea2
push dword [ebp - 4]
push 0x53eef4
lea ecx, [ebp - 0x164]
mov edx, ebx
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0xc]
push dword [ebp - 0x164]
lea eax, [ebp - 0x160]
mov edx, 3
call fcn.00404560
mov eax, dword [ebp - 0x160]
call fcn.004093d8
dec ebx
cmp ebx, 0xffffffff
jne 0x53ee63
mov eax, dword [ebp - 0xc]
call fcn.004033ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53eee2
lea eax, [ebp - 0x164]
mov edx, 6
call fcn.00404204
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404204
ret
Function at 0x53ef14
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x53efaa
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.0053e738
lea eax, [ebp - 8]
call fcn.0053e760
push 1
push 0x53efc0
push dword [ebp - 4]
push 0x53efd4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404560
mov eax, dword [ebp - 0xc]
call fcn.004046a0
push eax
call sub.kernel32.dll_WinExec
push 1
push 0x53efc0
push dword [ebp - 4]
push 0x53eff0
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404560
mov eax, dword [ebp - 0x10]
call fcn.004046a0
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53efb1
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404204
ret

Function at 0x53f0b0
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov ebx, eax
mov byte [ebp - 1], 0
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x53f15e
push 0xf01ff
mov eax, ebx
call fcn.004046a0
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x53f15e
xor eax, eax
push ebp
push 0x53f13b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
push eax
push 1
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_ControlService
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x53f15e
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5401bc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404690
xor eax, eax
push ebp
push 0x540244
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x22], eax
mov dword [ebp - 0x1e], 3
lea eax, [ebp - 0x28]
mov ecx, 0x54025c
mov edx, dword [ebp - 4]
call fcn.004044ec
mov eax, dword [ebp - 0x28]
call fcn.004046a0
mov dword [ebp - 0x1a], eax
xor eax, eax
mov dword [ebp - 0x16], eax
mov word [ebp - 0x12], 0x450
lea eax, [ebp - 0x22]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
jne 0x540224
mov bl, 1
jmp 0x540226
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54024b
lea eax, [ebp - 0x28]
call fcn.004041e0
lea eax, [ebp - 4]
call fcn.004041e0
ret

Function at 0x540260
Capabilities:
Create process on windows
Delete file
Move file
Self delete
Set file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x5403fa
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0xc]
mov edx, 0x540410
call fcn.00404278
push 0x34
mov eax, dword [ebp - 0xc]
call fcn.004046a0
mov edx, eax
mov ecx, 0x54045c
mov eax, dword [0x559800]
mov eax, dword [eax]
call fcn.00491328
cmp eax, 6
jne 0x5402b5
mov byte [ebp - 0x11], 1
mov eax, esi
call fcn.0041b048
mov edi, eax
dec edi
test edi, edi
jl 0x5403d7
inc edi
xor ebx, ebx
cmp byte [0xbce468], 5
je 0x5403d7
mov edx, ebx
mov eax, esi
call fcn.00493c64
mov eax, dword [eax + 0x1c]
mov edx, 0x540474
call fcn.004045ec
jne 0x5403cf
mov dword [ebp - 0x10], 0x80
mov eax, dword [ebp - 0x10]
push eax
mov edx, ebx
mov eax, esi
call fcn.00493c64
mov eax, dword [eax + 0x28]
call fcn.004046a0
push eax
call sub.kernel32.dll_SetFileAttributesA
mov edx, ebx
mov eax, esi
call fcn.00493c64
mov eax, dword [eax + 0x28]
call fcn.004093d8
test al, al
jne 0x5403cf
mov edx, ebx
mov eax, esi
call fcn.00493c64
cmp dword [eax + 0x28], 0
je 0x5403cf
push 0x540480
mov edx, ebx
mov eax, esi
call fcn.00493c64
mov eax, dword [eax + 0x28]
lea edx, [ebp - 0x18]
call fcn.0053e78c
push dword [ebp - 0x18]
push 0x540498
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404560
push 4
push 0
mov edx, ebx
mov eax, esi
call fcn.00493c64
mov eax, dword [eax + 0x28]
call fcn.004046a0
push eax
call sub.kernel32.dll_MoveFileExA
push 0
mov eax, dword [ebp - 4]
call fcn.004046a0
push eax
call sub.kernel32.dll_WinExec
mov edx, ebx
mov eax, esi
call fcn.00493c64
mov edx, dword [eax + 0x28]
lea eax, [ebp - 8]
call fcn.00404278
cmp byte [ebp - 0x11], 0
je 0x5403c7
mov edx, ebx
mov eax, esi
call fcn.00493c64
mov eax, dword [eax + 0x28]
call fcn.004093d8
jmp 0x5403cf
mov eax, dword [ebp - 8]
call fcn.005401bc
inc ebx
dec edi
jne 0x5402ca
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x540401
lea eax, [ebp - 0x18]
call fcn.004041e0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404204
ret
Function at 0x5404a4
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x540553
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov dword [ebp - 0x18], 1
lea eax, [ebp - 0x14]
push eax
push ebx
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov esi, eax
lea eax, [ebp - 0x1c]
mov edx, ebx
call fcn.004043d8
mov eax, dword [ebp - 0x1c]
mov edx, 0x54056c
call fcn.004045ec
jne 0x540516
lea eax, [ebp - 0x14]
push eax
push ebx
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov esi, eax
mov dword [ebp - 0xc], 2
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
push 0x10
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle
mov ebx, esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54055a
lea eax, [ebp - 0x1c]
call fcn.004041e0
ret

Function at 0x540580
Capabilities:
Acquire debug privileges
Terminate process

Disassembly:
push ebx
push esi
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.0053b2c0
test al, al
je 0x540595
mov bl, 1
jmp 0x5405bc
push 0x5405c4
call fcn.005404a4
push esi
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov esi, eax
push 1
push esi
call sub.kernel32.dll_TerminateProcess
test eax, eax
je 0x5405bc
mov bl, 1
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x540908
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
xor edx, edx
mov dword [ebp - 0x114], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404690
xor eax, eax
push ebp
push 0x5409a0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x10d]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea edx, [ebp - 8]
lea eax, [ebp - 0x10d]
call fcn.00409938
push dword [ebp - 8]
push 0x5409b4
push dword [ebp - 4]
lea eax, [ebp - 0x114]
mov edx, 3
call fcn.00404560
mov eax, dword [ebp - 0x114]
call fcn.004093d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5409a7
lea eax, [ebp - 0x114]
call fcn.004041e0
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404204
ret
Function at 0x5409b8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
xor edx, edx
mov dword [ebp - 0x114], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404690
xor eax, eax
push ebp
push 0x540a50
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x10d]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 8]
lea eax, [ebp - 0x10d]
call fcn.00409938
push dword [ebp - 8]
push 0x540a64
push dword [ebp - 4]
lea eax, [ebp - 0x114]
mov edx, 3
call fcn.00404560
mov eax, dword [ebp - 0x114]
call fcn.004093d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x540a57
lea eax, [ebp - 0x114]
call fcn.004041e0
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404204
ret
Function at 0x5419ac
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
mov ebx, eax
push 0x51
lea eax, [ebp - 0x51]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov eax, ebx
lea edx, [ebp - 0x51]
mov ecx, 0x51
call fcn.00404450
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5419d4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
lea eax, [ebp - 0x105]
call fcn.00409938
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x542cd4
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffecc
push ebx
xor edx, edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x542deb
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x542dca
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x44]
call sub.kernel32.dll_GetCurrentProcess
mov cl, 1
mov edx, 0x542e00
call fcn.00542b70
xor edx, edx
mov eax, 2
call fcn.0049292c
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x542dc3
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x44]
mov dword [ebp - 0x130], 0x128
lea edx, [ebp - 0x130]
mov eax, dword [ebp - 4]
call fcn.0049294c
jmp 0x542da8
lea edx, [ebp - 8]
mov eax, dword [ebp - 0x128]
call fcn.00542c2c
cmp dword [ebp - 8], 0
je 0x542d77
mov edx, dword [ebp - 8]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x542d9a
lea eax, [ebp - 0x134]
lea edx, [ebp - 0x10c]
mov ecx, 0x104
call fcn.00404450
mov edx, dword [ebp - 0x134]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x130]
mov eax, dword [ebp - 4]
call fcn.0049296c
test eax, eax
jne 0x542d57
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x542dca
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x542df2
lea eax, [ebp - 0x134]
call fcn.004041e0
lea eax, [ebp - 8]
call fcn.004041e0
ret

Function at 0x543038
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
call fcn.00543008
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5430cf
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, ebx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.005431d4
test al, al
jne 0x5430b6
mov ecx, ebx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00543028
mov ebx, eax
test ebx, ebx
je 0x5430ac
lea eax, [ebp - 0x28]
push eax
push 1
push ebx
call sub.advapi32.dll_ControlService
push ebx
call sub.advapi32.dll_DeleteService
test eax, eax
je 0x5430a5
mov dword [ebp - 8], 2
jmp 0x5430ac
mov dword [ebp - 8], 1
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00542fec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5430d6
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00543018
ret