joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44f9c0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x108
mov eax, dword [0x4baad8]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [0x4b503c]
push ebx
push esi
cmp eax, 0xffffffff
je 0x44fa40
push 0x4c1584
push eax
call fcn.0044e9c0
mov ecx, dword [0x4c0c6c]
push 1
push ecx
push eax
mov dword [0x4c1188], eax
mov dword [0x4c147c], 1
call fcn.0044f420
add esp, 0x14
xor ebx, ebx
mov dword [0x4b5040], eax
cmp eax, 0xffffffff
je 0x44fbca
mov edx, eax
imul edx, edx, 0x6dc
mov ecx, 0x4c0b68
lea esi, [edx + 0x4c2520]
sub esi, ecx
mov dl, byte [ecx]
mov byte [esi + ecx], dl
inc ecx
cmp dl, bl
jne 0x44fa31
jmp 0x44fbca
mov eax, dword [0x4c1188]
xor ebx, ebx
cmp byte [0x4c1378], bl
je 0x44fa79
cmp eax, ebx
jne 0x44fa7d
mov eax, dword [0x4c1584]
push eax
push 0x4c1378
call fcn.0044dfd0
add esp, 8
mov dword [0x4c1188], eax
cmp eax, ebx
je 0x44facf
mov dword [0x4c147c], 1
cmp eax, ebx
je 0x44facf
mov ecx, dword [0x4c0c6c]
push 1
push ecx
push eax
mov dword [0x4c147c], 1
call fcn.0044f420
add esp, 0xc
mov dword [0x4b5040], eax
cmp eax, 0xffffffff
je 0x44fbca
mov edx, eax
imul edx, edx, 0x6dc
mov ecx, 0x4c0b68
lea esi, [edx + 0x4c2520]
sub esi, ecx
lea esp, [esp]
mov dl, byte [ecx]
mov byte [esi + ecx], dl
inc ecx
cmp dl, bl
jne 0x44fac0
jmp 0x44fbca
push str..crx
push 0x4c0b68
lea eax, [esp + 0x10]
push 0x48b9ac
push eax
call fcn.00406d20
push ebx
lea ecx, [esp + 0x1c]
push 0x8000
push ecx
call fcn.0045ccb6
mov esi, eax
add esp, 0x1c
cmp esi, 0xffffffff
je 0x44fb50
mov ecx, dword [0x4c1584]
push ecx
push 0x4c0b68
call fcn.0044ec30
add esp, 8
test eax, eax
je 0x44fb35
push ecx
push 0x4c0b68
call fcn.0044eb20
mov ecx, dword [0x4c1584]
add esp, 8
mov dword [0x4c1188], eax
jmp 0x44fb3a
mov eax, dword [0x4c1188]
cmp eax, ebx
jne 0x44fb5f
push ecx
call fcn.0045acc7
add esp, 4
mov dword [0x4c1188], eax
cmp eax, ebx
jne 0x44fb6b
mov dword [0x4b5040], 0xffffffff
or eax, 0xffffffff
jmp 0x44fbca
mov dword [0x4c147c], 1
jmp 0x44fb71
mov ecx, dword [0x4c1584]
push ecx
push eax
push esi
call fcn.0045d2a5
push esi
mov dword [0x4c1584], eax
call fcn.0045c3da
mov edx, dword [0x4c147c]
mov eax, dword [0x4c0c6c]
mov ecx, dword [0x4c1188]
push edx
push eax
push ecx
call fcn.0044f420
add esp, 0x1c
mov dword [0x4b5040], eax
cmp eax, 0xffffffff
je 0x44fbca
mov edx, eax
imul edx, edx, 0x6dc
mov ecx, 0x4c0b68
lea esi, [edx + 0x4c2520]
sub esi, ecx
nop
mov dl, byte [ecx]
mov byte [esi + ecx], dl
inc ecx
cmp dl, bl
jne 0x44fbc0
mov ecx, dword [esp + 0x10c]
pop esi
mov dword [0x4c24bc], ebx
pop ebx
xor ecx, esp
call fcn.0045ab2a
add esp, 0x108
ret
Function at 0x44fbf0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x108
mov eax, dword [0x4baad8]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [0x4c1188]
push ebx
xor ebx, ebx
push esi
cmp byte [0x4c1378], bl
je 0x44fc3f
cmp eax, ebx
jne 0x44fc43
mov eax, dword [0x4c1584]
push eax
push 0x4c1378
call fcn.0044dfd0
add esp, 8
mov dword [0x4c1188], eax
cmp eax, ebx
je 0x44fc91
mov dword [0x4c147c], 1
cmp eax, ebx
je 0x44fc91
mov ecx, dword [0x4c0c6c]
push 1
push ecx
push eax
mov dword [0x4c147c], 1
call fcn.0044f420
add esp, 0xc
mov dword [0x4b5040], eax
cmp eax, 0xffffffff
je 0x44fd5c
mov edx, eax
imul edx, edx, 0x6dc
mov ecx, 0x4c0b68
lea esi, [edx + 0x4c2520]
sub esi, ecx
mov dl, byte [ecx]
mov byte [esi + ecx], dl
inc ecx
cmp dl, bl
jne 0x44fc82
jmp 0x44fd5c
push str..crx
push 0x4c0b68
lea eax, [esp + 0x10]
push 0x48b9ac
push eax
call fcn.00406d20
push ebx
lea ecx, [esp + 0x1c]
push 0x8000
push ecx
call fcn.0045ccb6
mov esi, eax
add esp, 0x1c
cmp esi, 0xffffffff
je 0x44fce5
mov eax, dword [0x4c1188]
cmp eax, ebx
jne 0x44fcf4
mov edx, dword [0x4c1584]
push edx
call fcn.0045acc7
add esp, 4
mov dword [0x4c1188], eax
cmp eax, ebx
jne 0x44fcfe
mov dword [0x4b5040], 0xffffffff
or eax, 0xffffffff
jmp 0x44fd5c
mov dword [0x4c147c], 1
mov ecx, dword [0x4c1584]
push ecx
push eax
push esi
call fcn.0045d2a5
push esi
mov dword [0x4c1584], eax
call fcn.0045c3da
mov edx, dword [0x4c147c]
mov eax, dword [0x4c0c6c]
mov ecx, dword [0x4c1188]
push edx
push eax
push ecx
call fcn.0044f420
add esp, 0x1c
mov dword [0x4b5040], eax
cmp eax, 0xffffffff
je 0x44fd5c
mov edx, eax
imul edx, edx, 0x6dc
mov ecx, 0x4c0b68
lea esi, [edx + 0x4c2520]
sub esi, ecx
mov dl, byte [ecx]
mov byte [esi + ecx], dl
inc ecx
cmp dl, bl
jne 0x44fd52
mov ecx, dword [esp + 0x10c]
pop esi
mov dword [0x4c24bc], ebx
pop ebx
xor ecx, esp
call fcn.0045ab2a
add esp, 0x108
ret

Function at 0x44fdc0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0
mov dword [0x4c24c4], 1
call dword [0x48b1c4]
push 0
push 0
push 0x44fd80
mov dword [0x4c1580], eax
call fcn.0045bfbe
add esp, 0xc
ret
Function at 0x451420
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4008
call fcn.0045ab40
mov eax, dword [0x4baad8]
xor eax, esp
mov dword [esp + 0x4004], eax
push ebx
mov ebx, dword [esp + 0x401c]
push ebp
mov ebp, dword [esp + 0x4014]
push esi
push edi
mov edi, dword [esp + 0x4024]
lea eax, [esp + 0x15]
mov esi, 0x1000
lea ebx, [ebx]
mov cl, byte [ebp]
mov byte [eax], cl
inc ebp
add eax, 2
sub esi, 1
jne 0x451460
lea esi, [esp + 0x14]
mov dword [esp + 0x10], 0x800
lea ebx, [ebx]
movzx ecx, byte [ebp + 0x800]
movzx eax, byte [ebp]
mov edx, ecx
sar edx, 4
xor dl, al
and dl, 0xf
xor dl, al
mov byte [esi], dl
and cl, 0xf
shl al, 4
add esi, 2
or cl, al
mov byte [esi], cl
add esi, 2
inc ebp
sub dword [esp + 0x10], 1
jne 0x451480
mov ebp, dword [esp + 0x4020]
lea ecx, [esp + 0x14]
mov esi, 0x20
lea eax, [esi - 0x20]
cdq
and edx, 0xfff
add eax, edx
movzx edx, word [ecx]
movsx edx, word [edx*2 + 0x4d1500]
sar eax, 0xc
mov eax, dword [ebp + eax*4]
imul edx, eax
mov dword [edi], edx
movzx edx, word [ecx + 2]
movsx edx, word [edx*2 + 0x4d1500]
imul edx, eax
mov dword [ebx], edx
add ecx, 2
add ecx, 2
lea eax, [esi - 0x10]
cdq
and edx, 0xfff
add eax, edx
movzx edx, word [ecx]
movsx edx, word [edx*2 + 0x4d1500]
sar eax, 0xc
mov eax, dword [ebp + eax*4]
imul edx, eax
mov dword [edi + 4], edx
movzx edx, word [ecx + 2]
movsx edx, word [edx*2 + 0x4d1500]
imul edx, eax
add ecx, 2
mov dword [ebx + 4], edx
mov eax, esi
cdq
and edx, 0xfff
add eax, edx
movzx edx, word [ecx + 2]
movsx edx, word [edx*2 + 0x4d1500]
add ecx, 2
sar eax, 0xc
mov eax, dword [ebp + eax*4]
imul edx, eax
mov dword [edi + 8], edx
movzx edx, word [ecx + 2]
movsx edx, word [edx*2 + 0x4d1500]
add ecx, 2
imul edx, eax
mov dword [ebx + 8], edx
lea eax, [esi + 0x10]
cdq
and edx, 0xfff
add eax, edx
movzx edx, word [ecx + 2]
movsx edx, word [edx*2 + 0x4d1500]
add ecx, 2
sar eax, 0xc
mov eax, dword [ebp + eax*4]
imul edx, eax
mov dword [edi + 0xc], edx
movzx edx, word [ecx + 2]
movsx edx, word [edx*2 + 0x4d1500]
add ecx, 2
imul edx, eax
mov dword [ebx + 0xc], edx
add esi, 0x40
add ecx, 2
add edi, 0x10
add ebx, 0x10
cmp esi, 0x8020
jl 0x4514c1
mov eax, 0x800
lea ebx, [ebx]
mov dword [edi], 0
mov dword [ebx], 0
add edi, 4
add ebx, 4
sub eax, 1
jne 0x4515d0
mov ecx, dword [esp + 0x4014]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0045ab2a
add esp, 0x4008
ret
Function at 0x452170
Capabilities:
Read file on windows

Disassembly:
cmp dword [esp + 0x10], 0
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov dword [ebp], 0
mov esi, 0x4f9510
jne 0x45218f
mov esi, 0x4f9504
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
mov dword [esi + 8], 0
test eax, eax
jne 0x4521ab
push edi
call fcn.004527a0
add esp, 4
push eax
mov dword [esi + 4], eax
call fcn.0045acc7
add esp, 4
mov dword [esi], eax
test eax, eax
jne 0x4521cc
push edi
call fcn.0045c3da
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebp
ret
mov ecx, dword [esi + 4]
push ecx
push eax
push edi
call fcn.0045d2a5
add esp, 0xc
cmp eax, dword [esi + 4]
je 0x4521f6
mov edx, dword [esi]
push edx
call fcn.0045abea
push edi
call fcn.0045c3da
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebp
ret
push edi
call fcn.0045c3da
add esp, 4
mov dword [ebp], esi
mov eax, dword [esi + 4]
pop edi
pop esi
pop ebp
ret

Function at 0x452590
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x104
mov eax, dword [0x4baad8]
xor eax, esp
mov dword [esp + 0x100], eax
push esi
mov esi, dword [esp + 0x10c]
call fcn.00452550
cmp dword [0x4f9520], 0
jne 0x452686
lea eax, [esp + 4]
push eax
push esi
call fcn.004076e0
push 0
lea ecx, [esp + 0x10]
push 0x8000
push ecx
call fcn.0045ccb6
mov esi, eax
add esp, 0x14
cmp esi, 0xffffffff
je 0x452686
push 4
push 0x4f9528
push esi
call fcn.0045d2a5
mov edx, dword [0x4f9528]
shl edx, 6
push edx
call fcn.0045acc7
add esp, 0x10
mov dword [0x4f9520], eax
test eax, eax
jne 0x452639
push esi
call fcn.0045c3da
add esp, 4
mov dword [0x4f9528], 0
pop esi
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.0045ab2a
add esp, 0x104
ret
mov ecx, dword [0x4f9528]
lea edx, [ecx*8]
push edx
push eax
push esi
call fcn.0045d2a5
mov eax, dword [0x4f9528]
mov ecx, dword [0x4f9520]
shl eax, 6
push eax
push ecx
push esi
call fcn.0045d2a5
push esi
call fcn.0045c3da
mov edx, dword [0x4f9528]
mov eax, dword [0x4f9520]
push 0x452540
push 0x40
push edx
push eax
call fcn.0045fdf0
add esp, 0x2c
mov ecx, dword [esp + 0x104]
pop esi
xor ecx, esp
call fcn.0045ab2a
add esp, 0x104
ret
Function at 0x452860
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
mov dword [esi], 0x4f9658
mov eax, dword [0x4f9650]
test eax, eax
jne 0x4528b2
push 0x4000
push eax
push 0x4f9658
call fcn.0045ab70
mov eax, dword [esp + 0x18]
mov dword [eax], 0
mov eax, dword [0x4ba558]
add esp, 0xc
cmp eax, 0xffffffff
je 0x4528a4
push eax
call fcn.0045c3da
add esp, 4
mov dword [0x4ba558], 0xffffffff
xor eax, eax
pop esi
ret
mov ecx, dword [0x4f9654]
push ebx
mov ebx, dword [esp + 0x10]
test ecx, ecx
jne 0x4528f2
cmp eax, 0x4000
jle 0x4528cd
mov eax, 0x4000
mov ecx, dword [0x4ba558]
push eax
push 0x4f9658
push ecx
call fcn.0045d2a5
add esp, 0xc
sub dword [0x4f9650], eax
mov dword [ebx], eax
pop ebx
mov eax, 1
pop esi
ret
cmp ecx, 2
jne 0x452951
cdq
sub eax, edx
sar eax, 1
cmp eax, 0x2000
jle 0x452908
mov eax, 0x2000
mov edx, dword [0x4ba558]
push eax
push 0x4fb658
push edx
call fcn.0045d2a5
mov ecx, dword [0x4fd670]
mov edx, dword [esi]
push ecx
push 0x4fd658
push 0x4fb658
push eax
push edx
mov dword [esp + 0x2c], eax
call fcn.004527e0
mov eax, dword [esp + 0x2c]
add eax, eax
add esp, 0x20
sub dword [0x4f9650], eax
mov dword [ebx], eax
pop ebx
mov eax, 1
pop esi
ret
cmp ecx, 5
jne 0x452990
mov eax, dword [ebx]
cmp eax, 0x4000
jg 0x452963
test eax, eax
jne 0x452968
mov eax, 0x4000
lea ecx, [esp + 0xc]
push ecx
push eax
push esi
push 0x4fd678
call fcn.004520e0
mov eax, dword [esp + 0x1c]
add esp, 0x10
sub dword [0x4f9650], eax
mov dword [ebx], eax
pop ebx
mov eax, 1
pop esi
ret
mov eax, dword [0x4fd670]
test eax, eax
je 0x4529ad
push edi
lea esi, [eax + 0x4f9658]
mov ecx, 0x10
mov edi, 0x4f9658
rep movsd dword es:[edi], dword [esi]
pop edi
mov dword [esp + 0xc], 0
call fcn.00451e70
mov edx, dword [0x4ba720]
mov esi, eax
mov eax, dword [esp + 0xc]
push edx
lea ecx, [eax + 0x4f9658]
push ecx
call fcn.00451b60
mov eax, dword [esp + 0x14]
add eax, 0x1fc0
add esp, 8
mov dword [esp + 0xc], eax
test esi, esi
je 0x4529ee
cmp eax, 0x2000
jb 0x4529b5
mov ecx, dword [0x4f9650]
mov dword [0x4fd670], eax
cmp eax, ecx
jbe 0x4529ff
mov eax, ecx
sub dword [0x4f9650], eax
mov dword [ebx], eax
pop ebx
mov eax, 1
pop esi
ret
Function at 0x488430
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
xor edx, edx
cmp ecx, edx
je 0x4884d0
push ebx
push ebp
push esi
mov esi, dword [ecx]
push edi
xor eax, eax
mov byte [esi + 0x16], dl
mov esi, dword [ecx]
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov byte [esi + 0x18], dl
mov esi, dword [ecx]
mov byte [esi + 0x19], dl
mov edi, dword [ecx + 4]
xor esi, esi
cmp edi, edx
jle 0x488482
mov ebp, dword [ecx]
xor edx, edx
mov ebx, eax
mov dl, byte [esi + ebp]
shr ebx, 0x18
xor edx, ebx
shl eax, 8
mov edx, dword [edx*4 + 0x4a98f0]
xor eax, edx
inc esi
cmp esi, edi
jl 0x488463
xor edx, edx
mov edi, dword [ecx + 0xc]
xor esi, esi
cmp edi, edx
jle 0x4884ab
mov ebp, dword [ecx + 8]
xor edx, edx
mov ebx, eax
mov dl, byte [esi + ebp]
shr ebx, 0x18
xor edx, ebx
shl eax, 8
mov edx, dword [edx*4 + 0x4a98f0]
xor eax, edx
inc esi
cmp esi, edi
jl 0x48848e
mov edx, dword [ecx]
pop edi
mov byte [edx + 0x16], al
mov esi, dword [ecx]
mov edx, eax
shr edx, 8
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov edx, eax
shr edx, 0x10
mov byte [esi + 0x18], dl
mov ecx, dword [ecx]
shr eax, 0x18
pop esi
pop ebp
mov byte [ecx + 0x19], al
pop ebx
ret
Function at 0x140012d0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x1c
xor eax, eax
push esi
mov dword [esp + 0xd], eax
push edi
mov edi, dword [esp + 0x28]
mov dword [esp + 0x15], eax
mov dword [esp + 0x19], eax
mov byte [esp + 8], 0
mov dword [esp + 0x1d], eax
mov dword [esp + 9], 0
mov word [esp + 0x21], ax
mov byte [esp + 0x10], 0
mov byte [esp + 0x23], al
lea eax, [edi - 1]
xor esi, esi
inc eax
push 0x5c
push eax
call fcn.14003350
add esp, 8
test eax, eax
je 0x1400131e
inc esi
jmp 0x1400130b
cmp esi, 1
jne 0x14001354
push 3
lea ecx, [esp + 0xc]
push edi
push ecx
call fcn.14003240
lea edx, [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push str.explorer__s
push eax
call fcn.140030e2
add esp, 0x18
lea ecx, [esp + 0x10]
push 5
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
add esp, 0x1c
ret

Function at 0x140014c0
Capabilities:
Create service
Modify service
Persist via windows service
Start service

Disassembly:
push ecx
push esi
push edi
call fcn.14001450
test eax, eax
jne 0x140015c8
push 0xf003f
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x140014fb
push eax
push 0x140080b4
push str.Couldnt_open_service_manager
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
xor eax, eax
pop esi
pop ecx
ret
push 0x140080b4
call fcn.14001290
push 0x140080c0
call fcn.14001290
mov eax, dword [esp + 0x18]
add esp, 8
push 0
push 0
push 0x14008d54
push 0
push 0
push eax
push 1
push 2
push 0x10
push 0xf01ff
push 0x140080c0
push 0x140080b4
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
push 0x140080b4
mov esi, eax
call fcn.14001250
push 0x140080c0
call fcn.14001250
add esp, 8
test esi, esi
jne 0x1400157c
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
push 0x140080b4
push str.Couldnt_create_service
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
xor eax, eax
pop esi
pop ecx
ret
push 0x140080d4
call fcn.14001290
add esp, 4
lea ecx, [esp + 8]
mov dword [esp + 8], 0x140080d4
push ecx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x140015bc
push eax
push eax
push str.count_start_service
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop edi
mov eax, 1
pop esi
pop ecx
ret
Function at 0x140015e0
Capabilities:
Delete service
Stop service

Disassembly:
sub esp, 0x1c
push esi
push edi
call fcn.14001450
test eax, eax
jne 0x140015f9
pop edi
mov eax, 1
pop esi
add esp, 0x1c
ret
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x14001628
push eax
push 0x140080b4
push str.Couldnt_open_service_manager
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
xor eax, eax
pop esi
add esp, 0x1c
ret
push 0x140080b4
call fcn.14001290
add esp, 4
push 0x10020
push 0x140080b4
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
push 0x140080b4
mov esi, eax
call fcn.14001250
add esp, 4
test esi, esi
jne 0x1400167a
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
push 0x140080b4
push str.Couldnt_open_service
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
xor eax, eax
pop esi
add esp, 0x1c
ret
lea eax, [esp + 8]
push ebx
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, eax
call esi
push edi
call esi
xor eax, eax
test ebx, ebx
pop ebx
pop edi
setne al
pop esi
add esp, 0x1c
ret

Function at 0x14001810
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x14001882
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea ecx, [esp + 8]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [esp]
push 0
push 0
lea edx, [esp + 0xc]
push 0
push edx
push 0
push eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, dword [esp + 0x18]
push 0
or ecx, 4
push ecx
call dword [sym.imp.USER32.dll_ExitWindowsEx]
add esp, 0x14
ret
mov edx, dword [esp + 0x18]
push 0
or edx, 4
push edx
call dword [sym.imp.USER32.dll_ExitWindowsEx]
add esp, 0x14
ret
Function at 0x140018a0
Capabilities:
Copy file
Delete directory
Set file attributes
Write file on windows

Disassembly:
sub esp, 0x5f0
push ebx
push ebp
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x49]
mov byte [esp + 0x48], 0
rep stosd dword es:[edi], eax
mov ecx, dword [0x140082a0]
mov esi, 0x14008288
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [esp + 0x24], ecx
mov ecx, 5
lea edi, [esp + 0x30]
mov edx, dword [0x140082a4]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x14008278]
mov eax, dword [str.VXRND_]
mov dword [esp + 0x10], ecx
mov cx, word [0x14008284]
mov word [esp + 0x1c], cx
mov ecx, 0x23
mov esi, 0x140081e8
lea edi, [esp + 0x14c]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x28], edx
mov edx, dword [0x1400827c]
mov dword [esp + 0x20], eax
mov ax, word [0x140082a8]
mov dword [esp + 0x14], edx
mov word [esp + 0x2c], ax
mov eax, dword [0x14008280]
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x1c], eax
movsb byte es:[edi], byte [esi]
call fcn.14001290
lea eax, [esp + 0x34]
push eax
call fcn.14001290
mov edi, dword [esp + 0x60c]
lea ecx, [esp + 0x28]
push ecx
push edi
lea edx, [esp + 0x58]
push str._s_s
push edx
call fcn.140030e2
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
add esp, 0x18
lea eax, [esp + 0x48]
push 0x80
push eax
call esi
mov ebx, dword [esp + 0x608]
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
lea ecx, [esp + 0x48]
push 0
push ecx
push ebx
call ebp
lea edx, [esp + 0x48]
push 0x84
push edx
call esi
lea eax, [esp + 0x30]
lea ecx, [esp + 0x48]
push eax
push edi
push str._s_s
push ecx
call fcn.140030e2
add esp, 0x10
lea edx, [esp + 0x48]
push 0x80
push edx
call esi
push 0
lea eax, [esp + 0x4c]
push eax
push ebx
call ebp
lea ecx, [esp + 0x48]
push 6
push ecx
call esi
lea edx, [esp + 0x10]
push edx
call fcn.14001290
lea eax, [esp + 0x14]
push edi
lea ecx, [esp + 0x1e4]
push eax
push ecx
call fcn.140030e2
add esp, 0x10
lea edx, [esp + 0x1dc]
push 0x80
push edx
call esi
lea eax, [esp + 0x1dc]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0
push 7
push 2
push 0
push 2
lea ecx, [esp + 0x1f0]
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea edx, [esp + 0x14c]
mov esi, eax
push edx
call fcn.14001290
lea eax, [esp + 0x34]
lea ecx, [esp + 0x34]
push eax
lea edx, [esp + 0x38]
push ecx
lea eax, [esp + 0x158]
push edx
lea ecx, [esp + 0x2f0]
push eax
push ecx
call fcn.140030e2
lea edi, [esp + 0x2f8]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x18
repne scasb al, byte es:[edi]
not ecx
lea edx, [esp + 0x44]
push 0
dec ecx
push edx
lea eax, [esp + 0x2e8]
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5f0
ret
Function at 0x14001f00
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
mov ecx, dword [ebx + 8]
push edi
mov edi, dword [ebx + 4]
xor esi, esi
sub edi, ecx
test edi, edi
jle 0x14001f3a
mov ebp, dword [esp + 0x14]
mov edx, dword [ebx + 8]
mov eax, edi
mov ecx, esi
sub eax, esi
push 0
add ecx, edx
push eax
push ecx
push ebp
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x14001f3a
add esi, eax
cmp esi, edi
jl 0x14001f1a
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x14001f40
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x1c]
cmp edi, dword [esi + 0xc]
jg 0x14001f84
mov eax, dword [esi + 8]
test edi, edi
mov dword [esi], eax
mov dword [esi + 4], eax
jle 0x14001f84
mov ebx, dword [esp + 0x14]
mov ebp, dword [sym.imp.WS2_32.dll_recv]
mov eax, dword [esi + 4]
push 0
push edi
push eax
push ebx
call ebp
cmp eax, 0xffffffff
je 0x14001f84
mov edx, dword [esi + 4]
sub edi, eax
add edx, eax
test edi, edi
mov dword [esi + 4], edx
jg 0x14001f67
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x14001f90
Capabilities:
Get file size
Write file on windows

Disassembly:
mov eax, 0x19084
call fcn.14003410
push ebx
push ebp
push esi
push edi
mov ecx, 0x6418
xor eax, eax
lea edi, [esp + 0x31]
mov byte [esp + 0x30], 0
rep stosd dword es:[edi], eax
mov ebx, dword [esp + 0x19098]
lea ecx, [esp + 0x14]
stosw word es:[edi], ax
stosb byte es:[edi], al
push 4
lea eax, [esp + 0x34]
push ecx
push ebx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x2c], 0x19064
mov dword [esp + 0x28], eax
call fcn.14001f40
mov edx, dword [esp + 0x28]
mov ecx, 0x7d000
mov eax, dword [edx]
mov edx, dword [esp + 0x190a8]
cmp ecx, eax
mov dword [esp + 0x30], eax
sbb eax, eax
push edx
and eax, 0x16800
add eax, 0x2800
mov dword [esp + 0x38], eax
call fcn.14006e60
add esp, 0x10
mov eax, dword [esp + 0x1909c]
push 0
push 0x80
push 4
push 0
push 2
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea ecx, [esp + 0x14]
push 4
push ecx
push ebx
mov edi, eax
call fcn.14001f40
mov edx, dword [esp + 0x28]
add esp, 0xc
mov esi, dword [edx]
cmp esi, 0xffffffff
je 0x140020a3
lea eax, [esp + 0x14]
push 4
push eax
push ebx
call fcn.14001f40
imul esi, dword [esp + 0x34]
mov ecx, dword [esp + 0x28]
add esp, 0xc
mov ebp, dword [ecx]
push 0
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea edx, [esp + 0x14]
push ebp
push edx
push ebx
call fcn.14001f40
mov ecx, dword [esp + 0x28]
add esp, 0xc
lea eax, [esp + 0x2c]
push 0
push eax
push ebp
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14002010
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [esp + 0x24], eax
jne 0x140020ba
mov dword [esp + 0x10], 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x19084
ret
Function at 0x140020d0
Capabilities:
Get file size

Disassembly:
mov eax, 0x19074
call fcn.14003410
mov ecx, dword [esp + 0x1907c]
push esi
push 0
push 0x80
push 3
push 0
push 1
lea eax, [esp + 0x28]
push bind
push ecx
mov dword [esp + 0x2c], 0x19064
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
jne 0x1400211d
xor eax, eax
mov ecx, dword [esp + 0xc]
lea edx, [esp + 4]
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov dword [ecx], eax
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0x1907c]
add ecx, 4
push edx
push eax
mov dword [esp + 0x10], ecx
call fcn.14001f00
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
add esp, 0x19074
ret