joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d3ab4
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
mov ebx, eax
cmp byte [ebx + 0x68], 0
jne 0x4d3ae8
push 0x4001
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
push 0x4d3b7c
call sub.shell32.dll_SHGetFileInfo
mov esi, eax
jmp 0x4d3b07
push 0x4000
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
push 0x4d3b7c
call sub.shell32.dll_SHGetFileInfo
mov esi, eax
mov eax, ebx
call fcn.004d3b80
test al, al
je 0x4d3b1d
mov edx, esi
mov eax, ebx
call fcn.00481f54
jmp 0x4d3b74
mov ecx, ebx
mov dl, 1
mov eax, dword [0x47123c]
call fcn.00481bf8
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d3b6d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x42], 1
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.00481f54
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00482a4c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d3b74
mov eax, dword [ebp - 4]
call fcn.00403e94
ret
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4d4508
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
test dl, dl
je 0x4d4524
add esp, 0xfffffff0
call fcn.0040420c
mov byte [ebp - 1], dl
mov esi, eax
xor eax, eax
push ebp
push 0x4d466b
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, esi
call fcn.0046abd8
mov dword [esi + 0x2ac], 0xa
mov byte [esi + 0x2c0], 1
mov byte [esi + 0x2a0], 1
mov ecx, esi
mov dl, 1
mov eax, dword [0x4d1374]
call fcn.004d3a14
mov dword [esi + 0x298], eax
lea eax, [ebp - 8]
call fcn.00497f84
push 0x101
push 0x160
lea eax, [ebp - 0x168]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.004051e0
mov ebx, eax
push ebx
call sub.shell32.dll_SHGetFileInfo
mov eax, dword [ebp - 0x164]
mov dword [esi + 0x2a8], eax
push 0x103
push 0x160
lea eax, [ebp - 0x168]
push eax
push 0
push ebx
call sub.shell32.dll_SHGetFileInfo
mov eax, dword [ebp - 0x164]
mov dword [esi + 0x2a4], eax
mov dl, 4
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x118]
mov ecx, esi
mov dl, 1
mov eax, dword [0x462ec0]
call fcn.004688f0
mov ebx, eax
mov dword [esi + 0x29c], ebx
mov eax, ebx
mov edx, esi
mov ecx, dword [eax]
call dword [ecx + 0x68]
mov eax, dword [esi + 0x29c]
mov edx, 0x18
call fcn.0047439c
mov eax, dword [esi + 0x29c]
mov edx, 5
call fcn.004743c0
mov eax, esi
call fcn.004d4a40
mov eax, dword [esi + 0x29c]
mov dl, byte [0x4d4694]
call fcn.00473f80
mov eax, dword [esi + 0x29c]
xor edx, edx
call fcn.004689cc
mov eax, dword [esi + 0x29c]
mov dword [eax + 0x1e4], esi
mov dword [eax + 0x1e0], 0x4d4f70
mov byte [esi + 0x1f8], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d4672
lea eax, [ebp - 8]
call fcn.00404d04
ret
Function at 0x4d5508
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], ecx
call fcn.00404274
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d5610
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa8]
call fcn.0041dec0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa8]
call fcn.00403e94
mov eax, dword [ebp - 4]
cmp dword [eax + 0xbc], 0xffffffff
je 0x4d55e4
push 0x4d5634
call fcn.0040baa4
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x14]
mov eax, 0x4d5654
call fcn.0040c8c0
push dword [ebp - 0x14]
push 0x4d5678
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004050a0
xor eax, eax
push ebp
push 0x4d55cb
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404fe0
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xbc]
push eax
call sub.kernel32.dll_WriteFile
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d55d5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xbc]
push eax
call sub.kernel32.dll_CloseHandle_1
mov dl, byte [ebp - 5]
and dl, 0xfc
mov eax, dword [ebp - 4]
call fcn.00403e84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d5617
lea eax, [ebp - 0x14]
call fcn.00404d04
lea eax, [ebp - 0xc]
call fcn.00404d04
ret

Function at 0x4d9d90
Capabilities:
Hash data with md5

Disassembly:
push ebx
add esp, 0xffffffa8
mov ebx, eax
mov edx, esp
mov eax, ebx
mov ecx, 0x58
call fcn.00402d30
xor eax, eax
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], 0x67452301
mov dword [esp + 0xc], 0xefcdab89
mov dword [esp + 0x10], 0x98badcfe
mov dword [esp + 0x14], 0x10325476
mov edx, ebx
mov eax, esp
mov ecx, 0x58
call fcn.00402d30
add esp, 0x58
pop ebx
ret
Function at 0x4da050
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 8
add esp, 0xfffff004
push eax
dec eax
jne 0x4da059
mov eax, dword [ebp - 4]
add esp, 0xffffff90
push ebx
push esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004051d0
xor eax, eax
push ebp
push 0x4da16b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
xor ebx, ebx
mov byte [ebp - 0x19], 0
push 0
push 0x10000080
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 4]
call fcn.00405238
push eax
call sub.kernel32.dll_CreateFileA_1
mov esi, eax
cmp esi, 0xffffffff
je 0x4da155
lea eax, [ebp - 0x71]
xor ecx, ecx
mov edx, 0x58
call fcn.004035d4
lea eax, [ebp - 0x71]
call fcn.004d9d90
push 0
lea eax, [ebp - 0xc]
push eax
push 0x8000
lea eax, [ebp - 0x8071]
push eax
push esi
call sub.kernel32.dll_ReadFile_1
invalid
test eax, eax
jne 0x4da101
push esi
lea edx, [ebp - 0x8071]
lea eax, [ebp - 0x71]
mov ecx, dword [ebp - 0xc]
call fcn.004d9de4
mov eax, dword [ebp - 0xc]
xor edx, edx
add dword [ebp - 0x18], eax
adc dword [ebp - 0x14], edx
cmp word [ebp + 0xa], 0
je 0x4da133
push dword [ebp - 0x14]
push dword [ebp - 0x18]
lea edx, [ebp - 0x19]
mov eax, dword [ebp + 0xc]
call dword [ebp + 8]
cmp byte [ebp - 0x19], 0
jne 0x4da142
cmp dword [ebp - 0xc], 0x8000
je 0x4da0dd
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x71]
call fcn.004d9f1c
push esi
call sub.kernel32.dll_CloseHandle_1
mov bl, 1
Function at 0x4e30dc
Capabilities:
Initialize winsock library

Disassembly:
push ebx
push esi
test dl, dl
je 0x4e30ea
add esp, 0xfffffff0
call fcn.0040420c
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.00403e64
push esi
push 0x4e3248
mov eax, 0x4e31a0
call fcn.004cb5c4
mov dword [esi + 4], eax
lea eax, [esi + 0x40c]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov dl, 1
mov eax, dword [0x4dc498]
call fcn.00403e64
mov dword [esi + 0x59c], eax
xor eax, eax
mov dword [esi + 0x5a0], eax
xor eax, eax
mov dword [esi + 0x5a4], eax
xor eax, eax
mov dword [esi + 0x5b0], eax
xor eax, eax
mov dword [esi + 0x5b4], eax
xor eax, eax
mov dword [esi + 0x5bc], eax
xor eax, eax
mov dword [esi + 0x5c0], eax
mov dword [esi + 0x5a8], 0x2000
mov dword [esi + 0x5ac], 0x2000
lea eax, [esi + 0x5b8]
call fcn.00404d04
mov eax, esi
test bl, bl
je 0x4e3191
call fcn.00404264
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
ret

Function at 0x4e327c
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffc0
mov ebx, edx
mov eax, ebx
mov edx, 0x4e32bc
call fcn.00404d58
push 0x40
lea eax, [esp + 4]
push eax
call sub.wsock32.dll_gethostname
test eax, eax
jne 0x4e32ac
mov eax, ebx
mov edx, esp
mov ecx, 0x40
call fcn.00404f74
add esp, 0x40
pop ebx
ret

Function at 0x4e32c8
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4e334a
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004e327c
mov eax, dword [ebp - 0xc]
call fcn.004051e0
push eax
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4e3328
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 8], eax
push dword [ebp - 8]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, esi
call fcn.00404efc
jmp 0x4e3334
mov eax, esi
mov edx, 0x4e3360
call fcn.00404d58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e3351
lea eax, [ebp - 0xc]
call fcn.00404d04
ret

Function at 0x4e3368
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebx
push esi
add esp, 0xffffffec
mov esi, ecx
mov ebx, edx
mov eax, esi
mov edx, 0x4e33c0
call fcn.00404d58
cmp dword [ebx + 0x34], 0xffffffff
je 0x4e33af
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
mov eax, dword [ebx + 0x34]
push eax
call sub.wsock32.dll_getsockname
test eax, eax
jne 0x4e33af
push dword [esp + 8]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, esi
call fcn.00404efc
add esp, 0x14
pop esi
pop ebx
ret

Function at 0x4e3634
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
sub dl, 1
jae 0x4e3645
push 0
push 1
push 2
call sub.wsock32.dll_socket
ret
push 0x11
push 2
push 2
call sub.wsock32.dll_socket
ret
Function at 0x4e3654
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebx
push esi
add esp, 0xffffffec
mov ebx, edx
or esi, 0xffffffff
cmp dword [ebx + 0x34], 0xffffffff
je 0x4e368c
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
mov eax, dword [ebx + 0x34]
push eax
call sub.wsock32.dll_getsockname
test eax, eax
jne 0x4e368c
mov ax, word [esp + 6]
push eax
call sub.wsock32.dll_htons
movzx esi, ax
mov eax, esi
add esp, 0x14
pop esi
pop ebx
ret

Function at 0x4e47dc
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004051d0
xor eax, eax
push ebp
push 0x4e4889
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, byte [ebx + 0x30]
mov eax, dword [ebx + 0x38]
call fcn.004e3634
mov dword [ebx + 0x34], eax
mov eax, ebx
call fcn.004e3bd4
test al, al
je 0x4e485e
mov edx, ebx
mov eax, dword [ebx + 0x38]
call fcn.004e3224
lea eax, [ebp - 0x14]
push eax
mov cl, 1
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.004e4798
push 0x10
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebx + 0x34]
push eax
call sub.wsock32.dll_connect
test eax, eax
je 0x4e4873
push 0x4e48a0
call sub.wsock32.dll_WSAGetLastError
mov edx, eax
mov cl, 1
mov eax, ebx
call fcn.004e3950
jmp 0x4e4873
push 0x4e48b4
call sub.wsock32.dll_WSAGetLastError
mov edx, eax
mov cl, 1
mov eax, ebx
call fcn.004e3950
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e4890
lea eax, [ebp - 4]
call fcn.00404d04
ret

Function at 0x4e561c
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.004051d0
xor eax, eax
push ebp
push 0x4e574f
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
mov dword [edi + 0xd8], 0
mov dword [edi + 0xdc], 0
mov byte [edi + 0x98], 1
cmp byte [edi + 0x31], 4
jne 0x4e5739
lea eax, [edi + 0xe0]
mov edx, 0x18
call fcn.0040817c
mov eax, dword [ebp + 0x10]
xor edx, edx
and eax, 0xffffffff
mov dword [ebp - 8], eax
push 0
or esi, 0x80
or esi, 0x10000000
or esi, 0
push esi
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 4]
call fcn.00405238
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [edi + 0xf0], eax
mov esi, dword [edi + 0xf0]
cmp esi, 0xffffffff
je 0x4e571c
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 0xc]
and eax, 0xffffffff
push eax
push esi
call sub.kernel32.dll_SetFilePointer_1
cmp eax, 0xffffffff
je 0x4e571c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [edi + 0xf0]
push eax
call sub.kernel32.dll_GetFileSize
xor edx, edx
mov dword [edi + 0xe0], eax
mov dword [edi + 0xe4], edx
mov al, byte [ebp + 8]
mov byte [edi + 0xb8], al
cmp byte [edi + 0x174], 0
je 0x4e5713
lea eax, [edi + 0x13c]
call fcn.004dc798
mov eax, edi
call fcn.004e5764
jmp 0x4e5739
mov eax, dword [edi + 0xf0]
cmp eax, 0xffffffff
je 0x4e572d
push eax
call sub.kernel32.dll_CloseHandle_1
mov dword [edi + 0xf0], 0xffffffff
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e5756
lea eax, [ebp - 4]
call fcn.00404d04
ret
Function at 0x4e5764
Capabilities:
Read file on windows

Disassembly:
push esi
add esp, 0xfffffff4
mov esi, eax
mov eax, dword [esi + 0x38]
mov eax, dword [eax + 0x5a8]
call fcn.00402b10
mov dword [esi + 0xc4], eax
mov eax, dword [esi + 0x38]
mov eax, dword [eax + 0x5a8]
mov dword [esi + 0xbc], eax
push 0
lea eax, [esp + 4]
push eax
mov eax, dword [esi + 0x38]
mov eax, dword [eax + 0x5a8]
push eax
mov eax, dword [esi + 0xc4]
push eax
mov eax, dword [esi + 0xf0]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x4e5845
cmp dword [esp], 0
jbe 0x4e583c
lea eax, [esi + 0xc4]
mov edx, dword [esp]
call fcn.00402b60
cmp byte [esi + 0x174], 0
je 0x4e5816
lea eax, [esp + 8]
push eax
lea eax, [esp + 8]
push eax
mov ecx, dword [esp + 8]
mov edx, dword [esi + 0xc4]
lea eax, [esi + 0x13c]
call fcn.004dc7d4
mov eax, dword [esi + 0xc4]
call fcn.00402b40
mov eax, dword [esp + 8]
mov dword [esi + 0xc4], eax
mov eax, dword [esp + 4]
mov dword [esi + 0xbc], eax
jmp 0x4e581f
mov eax, dword [esp]
mov dword [esi + 0xbc], eax
xor eax, eax
mov dword [esi + 0xc0], eax
mov eax, dword [esi + 0xbc]
mov dword [esi + 0x118], eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
jmp 0x4e584c
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x4c]
jmp 0x4e584c
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x4c]
add esp, 0xc
pop esi
ret
Function at 0x4e5a4c
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, ecx
mov dword [esp], edx
mov ebx, eax
cmp byte [ebx + 0x174], 0
je 0x4e5a92
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
push 0
mov ecx, esi
mov edx, dword [esp + 0xc]
lea eax, [ebx + 0x13c]
call fcn.004dc880
mov eax, dword [esp]
call fcn.00402b40
mov eax, dword [esp + 0xc]
mov dword [esp], eax
mov esi, dword [esp + 8]
cmp dword [ebx + 0x108], 0xffffffff
je 0x4e5ba0
mov edi, esi
cmp dword [ebx + 0xfc], 0
jne 0x4e5ab5
cmp dword [ebx + 0xf8], 0
jbe 0x4e5ae8
jmp 0x4e5ab7
jle 0x4e5ae8
mov eax, edi
cdq
add eax, dword [ebx + 0x100]
adc edx, dword [ebx + 0x104]
cmp edx, dword [ebx + 0xfc]
jne 0x4e5ad8
cmp eax, dword [ebx + 0xf8]
jbe 0x4e5ae8
jmp 0x4e5ada
jle 0x4e5ae8
mov eax, dword [ebx + 0xf8]
sub eax, dword [ebx + 0x100]
sub edi, eax
push 0
lea eax, [esp + 8]
push eax
push edi
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [ebx + 0x108]
push eax
call sub.kernel32.dll_WriteFile
test eax, eax
je 0x4e5b47
mov eax, dword [esp + 4]
xor edx, edx
add dword [ebx + 0x100], eax
adc dword [ebx + 0x104], edx
mov eax, dword [esp + 4]
xor edx, edx
add dword [ebx + 0xd8], eax
adc dword [ebx + 0xdc], edx
cmp word [ebx + 0x112], 0
je 0x4e5b61
mov ecx, dword [esp + 4]
mov edx, ebx
mov eax, dword [ebx + 0x114]
call dword [ebx + 0x110]
jmp 0x4e5b61
mov eax, ebx
call fcn.004e5c20
push 0x4e5c0c
mov cl, 1
mov edx, 1
mov eax, ebx
call fcn.004e3950
cmp dword [ebx + 0xfc], 0
jne 0x4e5b75
cmp dword [ebx + 0xf8], 0
jbe 0x4e5bce
jmp 0x4e5b77
jle 0x4e5bce
mov eax, dword [ebx + 0x100]
mov edx, dword [ebx + 0x104]
cmp edx, dword [ebx + 0xfc]
jne 0x4e5b95
cmp eax, dword [ebx + 0xf8]
jb 0x4e5bce
jmp 0x4e5b97
jl 0x4e5bce
mov eax, ebx
call fcn.004e5c20
jmp 0x4e5bce
mov eax, dword [ebx + 0x138]
test eax, eax
je 0x4e5bce
mov edx, dword [esp]
mov ecx, esi
call fcn.0041d940
cmp word [ebx + 0x112], 0
je 0x4e5bce
mov ecx, esi
mov edx, ebx
mov eax, dword [ebx + 0x114]
call dword [ebx + 0x110]
cmp word [ebx + 0x12a], 0
je 0x4e5beb
push esi
mov ecx, dword [esp + 4]
mov edx, ebx
mov eax, dword [ebx + 0x12c]
call dword [ebx + 0x128]
cmp byte [ebx + 0x174], 0
je 0x4e5bfc
mov eax, dword [esp]
call fcn.00402b40
add esp, 0x10
pop edi
pop esi
pop ebx
ret

Function at 0x4e6354
Capabilities:
Shutdown system

Disassembly:
push ebx
add esp, 0xffffffd8
mov ebx, eax
mov eax, dword [0x592834]
cmp dword [eax], 2
jne 0x4e63ce
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x4e63ce
lea eax, [esp + 0xc]
push eax
push 0x4e63e4
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
cmp eax, 1
sbb eax, eax
inc eax
mov dword [esp + 8], 1
mov dword [esp + 0x14], 2
mov edx, 0x10
xor ecx, ecx
mov dword [esp + 4], ecx
test al, al
je 0x4e63ce
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x1c]
push eax
push edx
lea eax, [esp + 0x14]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
push 0
push ebx
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x28
pop ebx
ret
Function at 0x4e65bf
Capabilities:
Compare security identifiers

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov byte [esp], 0
lea eax, [esp + 4]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
mov ebx, eax
test ebx, ebx
jne 0x4e656c
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x3f0
jne 0x4e656c
lea eax, [esp + 4]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov ebx, eax
test ebx, ebx
je 0x4e6603
mov eax, 0x400
call fcn.00402b10
mov esi, eax
lea eax, [esp + 8]
push eax
push 0x400
push esi
push 2
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_GetTokenInformation
mov ebx, eax
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_CloseHandle_1
test ebx, ebx
je 0x4e65fc
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
push 0x58da74
call sub.advapi32.dll_AllocateAndInitializeSid
mov ebx, dword [esi]
dec ebx
test ebx, ebx
jl 0x4e65f2
inc ebx
xor edi, edi
mov eax, dword [esi + edi*8 + 4]
push eax
mov eax, dword [esp + 0x10]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x4e65ee
mov byte [esp], 1
jmp 0x4e65f2
inc edi
dec ebx
jne 0x4e65d5
mov eax, dword [esp + 0xc]
push eax
call sub.advapi32.dll_FreeSid
mov eax, esi
call fcn.00402b40
mov al, byte [esp]
add esp, 0x10
pop edi
pop esi
pop ebx
ret

Function at 0x4fafd4
Capabilities:
Initialize winsock library

Disassembly:
push ebx
push esi
test dl, dl
je 0x4fafe2
add esp, 0xfffffff0
call fcn.0040420c
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.00403e64
push esi
push 0x4fb050
mov eax, 0x4fb040
call fcn.004cb5c4
mov dword [esi + 4], eax
lea eax, [esi + 0x40c]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor eax, eax
mov dword [esi + 0x59c], eax
mov eax, esi
test bl, bl
je 0x4fb030
call fcn.00404264
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
ret
Function at 0x5025d8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x164], edx
mov dword [ebp - 0x160], edx
mov dword [ebp - 4], edx
mov ebx, eax
lea eax, [ebp - 0x15c]
mov edx, dword [0x4087b8]
call fcn.00405728
xor eax, eax
push ebp
push 0x502784
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x434]
mov eax, dword [eax + 0x26c]
call fcn.00451a7c
mov eax, dword [ebx + 0x434]
mov eax, dword [eax + 0x26c]
mov ecx, 0x50279c
xor edx, edx
call fcn.00451b20
mov esi, eax
mov edx, dword [0x592858]
mov edx, dword [edx]
mov eax, esi
call fcn.004509e0
mov edx, dword [0x592398]
mov edx, dword [edx]
mov eax, esi
call fcn.00450a38
lea eax, [ebp - 0x160]
mov ecx, 0x5027ac
mov edx, dword [ebx + 0x438]
call fcn.0040502c
mov eax, dword [ebp - 0x160]
lea ecx, [ebp - 0x15c]
mov edx, 0x3f
call fcn.0040a160
mov esi, eax
test esi, esi
jne 0x5026f0
lea ecx, [ebp - 4]
mov dl, 0x5f
mov eax, dword [ebp - 0x150]
call fcn.00499344
cmp dword [ebp - 0x158], 0
jle 0x5026b7
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00502554
jmp 0x5026df
lea eax, [ebp - 0x164]
mov ecx, dword [ebp - 0x150]
mov edx, dword [ebx + 0x438]
call fcn.0040502c
mov eax, dword [ebp - 0x164]
call fcn.004051e0
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x15c]
call fcn.0040a1b0
mov esi, eax
test esi, esi
je 0x502690
lea eax, [ebp - 0x15c]
call fcn.0040a1d4
push 1
mov edx, 0x502530
xor ecx, ecx
mov eax, dword [ebx + 0x434]
call fcn.00452c60
mov eax, dword [ebx + 0x434]
call fcn.00452fd0
mov eax, dword [ebx + 0x434]
mov eax, dword [eax + 0x26c]
call fcn.00451a44
dec eax
jle 0x50274d
mov esi, dword [ebx + 0x434]
mov eax, dword [esi + 0x26c]
mov edx, 1
call fcn.00451e2c
mov edx, eax
mov eax, esi
call fcn.004530e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50278b
lea eax, [ebp - 0x164]
mov edx, 2
call fcn.00404d28
lea eax, [ebp - 0x15c]
mov edx, dword [0x4087b8]
call fcn.004057f8
lea eax, [ebp - 4]
call fcn.00404d04
ret

Function at 0x5095bc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x50963b
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 4]
mov edx, esi
mov eax, dword [ebx + 0x30]
mov edi, dword [eax]
call dword [edi + 0xc]
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
call fcn.00404fe0
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00405240
push ebx
push 0x508eec
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x508120]
call fcn.005096bc
mov dword [eax + 0x40], 0xffffffff
mov edx, esi
mov eax, dword [ebx + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x48]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x509642
lea eax, [ebp - 4]
call fcn.00404d04
ret