joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8170e0
Capabilities:
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x8170e8
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x8172f5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.0040b8d8
xor edx, edx
push ebp
push 0x8172b0
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push 1
push 0
push 0
call sub.WTSAPI32.DLL_WTSEnumerateSessionsW
test eax, eax
jne 0x817136
call fcn.0043ab30
xor edx, edx
push ebp
push 0x81729f
push dword fs:[edx]
mov dword fs:[edx], esp
cmp dword [ebp - 0x18], 0
jbe 0x817286
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
dec eax
test eax, eax
jb 0x817286
inc eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax + 8], 0
jne 0x817279
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
push 5
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push eax
push 0
call sub.WTSAPI32.DLL_WTSQuerySessionInformationW
test eax, eax
je 0x817279
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x817279
cmp word [eax], 0
je 0x817279
lea edx, [ebp - 8]
mov eax, dword [ebp - 0x20]
call fcn.0040e678
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, 0
call fcn.0040c4b4
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x30], 0
je 0x8171d9
mov eax, dword [ebp - 0xc]
add eax, 0x30
mov edx, 0x817310
call fcn.0040c0e8
mov eax, dword [ebp - 0xc]
add eax, 0x30
mov edx, dword [ebp - 4]
call fcn.0040c0e8
xor eax, eax
push ebp
push 0x81726f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x38]
call fcn.0079ed24
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x38]
mov eax, dword [eax + 0x40]
xor edx, edx
call fcn.0078aa78
push eax
lea eax, [ebp - 0x34]
mov edx, dword [ebp - 0x14]
mov edx, dword [edx]
mov cl, 4
call fcn.004481bc
lea edx, [ebp - 0x34]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x118]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x38]
mov eax, dword [eax + 0x40]
mov edx, 1
call fcn.0078aa78
push eax
lea eax, [ebp - 0x44]
mov edx, dword [ebp - 4]
call fcn.00448460
lea edx, [ebp - 0x44]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x118]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x38]
mov edx, dword [eax]
call dword [edx + 0x324]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x817279
add dword [ebp - 0x14], 0xc
dec dword [ebp - 0x24]
jne 0x817164
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x8172a6
mov eax, dword [ebp - 0x10]
push eax
call sub.WTSAPI32.DLL_WTSFreeMemory
pop eax
jmp eax
Function at 0x818f28
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x818f87
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x818f75
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x208]
mov ecx, pe_nt_image_headers32
call fcn.0040c8d8
jmp 0x818f7d
mov eax, dword [ebp - 4]
call fcn.0040b8b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x818f99
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x8201f8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf4
mov ebx, edx
push esp
push 0
push 0
push eax
push 0
call sub.shell32.dll_SHGetFolderPathW
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.0040c8d8
add esp, 0x20c
pop ebx
ret

Function at 0x8221bc
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf4
mov ebx, edx
push esp
push 0
push 0
push eax
push 0
call sub.shell32.dll_SHGetFolderPathW
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.0040c8d8
add esp, 0x20c
pop ebx
ret
Function at 0x82c858
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x82c97b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x82c73c]
call fcn.0040999c
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
mov edx, dword [ebp - 0xc]
test edx, edx
je 0x82c892
sub edx, 0xfffffff8
call fcn.00410d98
mov eax, dword [ebp - 0xc]
mov esi, ebx
mov dword [eax + 0xc], esi
lea eax, [ebp - 4]
call fcn.0040b8b4
xor eax, eax
push ebp
push 0x82c8cd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [esi + 0x30]
mov edx, dword [0x82c98c]
mov ecx, dword [eax]
call dword [ecx + 0x4c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x82c92b
mov eax, dword [0x8d1a20]
cmp byte [eax], 1
je 0x82c94e
mov edx, dword [ebp - 0xc]
test edx, edx
je 0x82c93f
sub edx, 0xfffffff0
xor eax, eax
call fcn.004c703c
lea eax, [ebp - 4]
call fcn.0040b8b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x82c982
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.0040b914
lea eax, [ebp - 8]
call fcn.00410d80
lea eax, [ebp - 4]
call fcn.0040b8b4
pop eax
jmp eax

Function at 0x83419c
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe2c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1d4], ecx
mov esi, edx
xor eax, eax
push ebp
push 0x834262
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1d0]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, esi
call fcn.0040b8b4
push 0x40
lea eax, [ebp - 0x40]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x40]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x834247
mov edi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x834226
push dword [esi]
mov eax, dword [edi + ebx*4]
mov eax, dword [eax]
call fcn.00639bc4
lea edx, [ebp - 0x1d4]
call fcn.00639fc0
push dword [ebp - 0x1d4]
push 0x83427c
mov eax, esi
mov edx, 3
call fcn.0040cb14
inc ebx
cmp dword [edi + ebx*4], 0
jne 0x8341f7
mov eax, dword [esi]
test eax, eax
je 0x834235
mov eax, dword [eax - 4]
mov edx, esi
mov ecx, 1
xchg edx, eax
call fcn.0040cca4
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x834269
lea eax, [ebp - 0x1d4]
call fcn.0040b8b4
pop eax
jmp eax

Function at 0x84244c
Capabilities:
Find taskbar

Disassembly:
push 0
push 0x842470
call sub.user32.dll_FindWindowW
test eax, eax
je 0x84246c
push 0
push 0x84248c
push 0
push eax
call sub.user32.dll_FindWindowExW
ret
xor eax, eax
ret
Function at 0x8443cc
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x84450a
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
call sub.user32.dll_IsIconic
test eax, eax
je 0x844400
cmp byte [0x196db29], 0
jne 0x844400
push 9
push ebx
call sub.user32.dll_ShowWindow
call sub.user32.dll_GetForegroundWindow
cmp ebx, eax
jne 0x844412
mov byte [ebp - 1], 1
jmp 0x844500
call fcn.00439660
cmp eax, 2
jne 0x844426
call fcn.00439674
cmp eax, 4
jg 0x844457
call fcn.00439660
dec eax
jne 0x8444e9
call fcn.00439674
cmp eax, 4
jg 0x844457
call fcn.00439674
cmp eax, 4
jne 0x8444e9
call fcn.0043967c
test eax, eax
jle 0x8444e9
mov byte [ebp - 1], 0
push 0
call sub.user32.dll_GetForegroundWindow
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov esi, eax
push 0
push ebx
call sub.user32.dll_GetWindowThreadProcessId
mov edi, eax
push 0xffffffffffffffff
push esi
push edi
call sub.user32.dll_AttachThreadInput
test eax, eax
je 0x8444a1
push ebx
call sub.user32.dll_BringWindowToTop
push ebx
call sub.user32.dll_SetForegroundWindow
push 0
push esi
push edi
call sub.user32.dll_AttachThreadInput
call sub.user32.dll_GetForegroundWindow
cmp ebx, eax
sete byte [ebp - 1]
cmp byte [ebp - 1], 0
jne 0x8444f5
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x2000
call sub.user32.dll_SystemParametersInfoW
push 2
push 0
push 0
push 0x2001
call sub.user32.dll_SystemParametersInfoW
push ebx
call sub.user32.dll_BringWindowToTop
push ebx
call sub.user32.dll_SetForegroundWindow
push 2
mov eax, dword [ebp - 8]
push eax
push 0
push 0x2001
call sub.user32.dll_SystemParametersInfoW
jmp 0x8444f5
push ebx
call sub.user32.dll_BringWindowToTop
push ebx
call sub.user32.dll_SetForegroundWindow
call sub.user32.dll_GetForegroundWindow
cmp ebx, eax
sete byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x844514
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x849fd0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040b9a8
mov eax, dword [ebp - 8]
call fcn.0040b9a8
xor eax, eax
push ebp
push 0x84a098
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x84a06f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x3c
call fcn.00408280
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x40], 0x500
mov eax, 0x84a0a8
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 4]
call fcn.0040c824
mov dword [ebp - 0x34], eax
cmp dword [ebp - 8], 0
je 0x84a051
mov eax, dword [ebp - 8]
call fcn.0040c824
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x44]
push eax
call sub.shell32.dll_ShellExecuteExW
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x84a07b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x84a09f
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040b914
pop eax
jmp eax
Function at 0x84b944
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x84b94c
xor eax, eax
push ebp
push 0x84bbb9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.0070fb40
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0
call fcn.0040c4b4
lea eax, [ebp - 8]
push eax
mov ecx, 0x6e
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.0040c31c
lea eax, [ebp - 0xc]
mov edx, dword [0x96d96c]
mov edx, dword [edx + 0x488]
call fcn.0040bcec
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 0xc]
call fcn.0084a504
lea eax, [ebp - 4]
mov edx, 0x84bbd0
call fcn.0040bd94
push dword [ebp - 4]
push 0x84bc24
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0xc]
mov ecx, 0
call fcn.0040c4b4
push dword [ebp - 0x14]
push 0x84bc3c
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0xc]
mov ecx, 0
call fcn.0040c4b4
push dword [ebp - 0x18]
push 0x84bc4c
lea eax, [ebp - 4]
mov edx, 6
call fcn.0040c1c4
lea eax, [ebp - 4]
mov edx, 0x84bc5c
call fcn.0040c0e8
push dword [ebp - 4]
lea eax, [ebp - 0x24]
mov edx, dword [ebp - 8]
call fcn.0040c8f4
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.0042f458
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov ecx, 0
call fcn.0040c4b4
push dword [ebp - 0x1c]
push 0x84bc3c
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040c1c4
push dword [ebp - 4]
lea edx, [ebp - 0x2c]
mov eax, 0x84bc70
call fcn.0042f458
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
mov ecx, 0
call fcn.0040c4b4
push dword [ebp - 0x28]
push 0x84bc3c
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040c1c4
push dword [ebp - 4]
lea edx, [ebp - 0x34]
mov eax, 0x84bc8c
call fcn.0042f458
mov edx, dword [ebp - 0x34]
lea eax, [ebp - 0x30]
mov ecx, 0
call fcn.0040c4b4
push dword [ebp - 0x30]
push 0x84bcc4
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040c1c4
lea eax, [ebp - 4]
mov edx, 0x84bcd4
call fcn.0040c0e8
push dword [ebp - 4]
push 0x84bcf4
lea eax, [ebp - 0x38]
mov edx, dword [ebp - 0xc]
mov ecx, 0
call fcn.0040c4b4
push dword [ebp - 0x38]
push 0x84bd34
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040c1c4
lea edx, [ebp - 4]
mov eax, dword [ebp - 4]
call fcn.0084a870
push 0x84bd60
push dword [ebp - 4]
push 0x84bd74
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040c1c4
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.0084d184
push 1
call sub.kernel32.dll_Sleep
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.0084d184
push 1
call sub.kernel32.dll_Sleep
lea eax, [ebp - 4]
mov edx, 0x84bd88
call fcn.0040bd94
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.0084d184
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x84bbc0
lea eax, [ebp - 0x38]
call fcn.0040b8d8
lea eax, [ebp - 0x34]
call fcn.0040b8b4
lea eax, [ebp - 0x30]
call fcn.0040b8d8
lea eax, [ebp - 0x2c]
call fcn.0040b8b4
lea eax, [ebp - 0x28]
call fcn.0040b8d8
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.0040b914
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.0040b94c
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0040b914
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040b94c
pop eax
jmp eax
Function at 0x84dad0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x84dafd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, dword [ebp - 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x84db0c
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x84f524
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x84f694
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, ebx
call fcn.0042efe0
mov eax, dword [ebp - 8]
test eax, eax
je 0x84f563
mov eax, dword [eax - 4]
mov edx, eax
sar edx, 1
jns 0x84f56c
adc edx, 0
lea eax, [ebp - 4]
xor ecx, ecx
call fcn.0040c438
mov ebx, 1
xor eax, eax
push ebp
push 0x84f5f4
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x84f5dc
push 0x84f6b0
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 8]
movzx edx, word [edx + ebx*2 - 2]
call fcn.0040c844
push dword [ebp - 0x18]
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 8]
movzx edx, word [edx + ebx*2]
call fcn.0040c844
push dword [ebp - 0x1c]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.0040cb14
mov eax, dword [ebp - 0x14]
call fcn.0042ffb4
mov edx, ebx
sar edx, 1
jns 0x84f5d3
adc edx, 0
mov ecx, dword [ebp - 4]
mov byte [ecx + edx], al
add ebx, 2
mov esi, dword [ebp - 8]
test esi, esi
je 0x84f5e6
mov esi, dword [esi - 4]
cmp esi, ebx
jg 0x84f58b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x84f60d
mov eax, dword [ebp - 4]
test eax, eax
je 0x84f617
mov eax, dword [eax - 4]
dec eax
test eax, eax
jl 0x84f649
inc eax
xor ebx, ebx
mov edx, dword [ebp - 4]
movzx edx, byte [edx + ebx]
mov dword [ebp - 0x10], edx
mov edx, dword [ebp - 4]
movzx ecx, di
shr ecx, 8
xor byte [edx + ebx], cl
add di, word [ebp - 0x10]
imul dx, di, 0xc8f4
add dx, 0x7c21
mov edi, edx
inc ebx
dec eax
jne 0x84f61f
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.00412244
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc]
call fcn.0040c914
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x84f69b
lea eax, [ebp - 0x20]
call fcn.0040b8fc
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.0040b914
lea eax, [ebp - 8]
call fcn.0040b8b4
lea eax, [ebp - 4]
call fcn.0040b8d8
pop eax
jmp eax
Function at 0x84f9a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040b9a8
mov eax, dword [ebp - 8]
call fcn.0040b9a8
xor eax, eax
push ebp
push 0x84fa68
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x84fa3f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x3c
call fcn.00408280
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x40], 0x500
mov eax, 0x84fa78
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 4]
call fcn.0040c824
mov dword [ebp - 0x34], eax
cmp dword [ebp - 8], 0
je 0x84fa21
mov eax, dword [ebp - 8]
call fcn.0040c824
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x44]
push eax
call sub.shell32.dll_ShellExecuteExW
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x84fa4b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x84fa6f
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040b914
pop eax
jmp eax

Function at 0x8540ac
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
mov esi, edx
mov ebx, eax
test esi, esi
je 0x8540be
test edi, edi
jne 0x8540d2
mov ecx, 0x3e3
mov edx, 0x854130
mov eax, 0x8541ac
call fcn.0040b700
push 0x40
push 0x1000
push 0x20
push 0
call sub.kernel32.dll_VirtualAlloc
mov ebp, eax
mov eax, dword [ebx]
xor ecx, ecx
mov edx, esi
call fcn.008541d0
mov esi, eax
mov eax, dword [ebx]
xor ecx, ecx
mov edx, edi
call fcn.008541d0
mov edi, eax
push edi
mov ecx, ebp
mov edx, esi
mov eax, ebx
call fcn.008542c8
test al, al
jne 0x85411d
push 0x8000
push 0x20
push ebp
call sub.kernel32.dll_VirtualFree
xor ebp, ebp
mov eax, ebp
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x88bb78
Capabilities:
Shutdown system

Disassembly:
push ebx
add esp, 0xffffffe8
mov ebx, eax
call fcn.00439660
cmp eax, 2
jne 0x88bbe0
lea eax, [esp + 4]
push eax
push 0x20
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
lea eax, [esp + 0xc]
push eax
push 0x88bbf0
push 0
call sub.advapi32.dll_LookupPrivilegeValueW
mov dword [esp + 8], 1
mov dword [esp + 0x14], 2
xor eax, eax
mov dword [esp], eax
push esp
push 0
push 0
lea eax, [esp + 0x14]
push eax
push 0
mov eax, dword [esp + 0x18]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_CloseHandle
push 0
push ebx
call sub.user32.dll_ExitWindowsEx
add esp, 0x18
pop ebx
ret
Function at 0x88e6bc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x88e892
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov edx, 0x88e8ac
call fcn.0040cc24
jne 0x88e729
cmp dword [ebp - 0x10], 0x20
jae 0x88e729
xor eax, eax
push ebp
push 0x88e71f
push dword fs:[eax]
mov dword fs:[eax], esp
push 5
push 0x88e8c0
call sub.kernel32.dll_WinExec
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x88e729
cmp dword [ebp - 0x10], 0x20
jae 0x88e79c
lea eax, [ebp - 8]
mov edx, 0x88e8f4
call fcn.0040bd94
mov eax, dword [ebp - 0xc]
mov edx, 0x88e8ac
call fcn.0040cc24
jne 0x88e75a
lea eax, [ebp - 8]
mov edx, 0x88e914
call fcn.0040c0e8
jmp 0x88e767
lea eax, [ebp - 8]
mov edx, 0x88e934
call fcn.0040c0e8
xor eax, eax
push ebp
push 0x88e792
push dword fs:[eax]
mov dword fs:[eax], esp
push 5
mov eax, dword [ebp - 8]
call fcn.0040c30c
push eax
call sub.kernel32.dll_WinExec
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x88e79c
cmp dword [ebp - 0x10], 0x20
jae 0x88e80a
lea eax, [ebp - 4]
mov edx, 0x88e954
call fcn.0040bcec
mov eax, dword [ebp - 0xc]
mov edx, 0x88e8ac
call fcn.0040cc24
jne 0x88e7cd
lea eax, [ebp - 4]
mov edx, 0x88e984
call fcn.0040ca34
jmp 0x88e7da
lea eax, [ebp - 4]
mov edx, 0x88e9b8
call fcn.0040ca34
xor eax, eax
push ebp
push 0x88e800
push dword fs:[eax]
mov dword fs:[eax], esp
push 5
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_WinExec
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x88e80a
cmp dword [ebp - 0x10], 0x20
jae 0x88e872
mov dword [ebp - 0x4c], 0x3c
xor eax, eax
mov dword [ebp - 0x48], eax
call sub.user32.dll_GetForegroundWindow
mov dword [ebp - 0x44], eax
mov eax, 0x88e9dc
mov dword [ebp - 0x40], eax
mov eax, 0x88e9e8
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0xc]
mov edx, 0x88e8ac
call fcn.0040cc24
jne 0x88e84d
mov eax, 0x88ea0c
mov dword [ebp - 0x38], eax
jmp 0x88e855
mov eax, 0x88ea34
mov dword [ebp - 0x38], eax
mov eax, 0x88ea58
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 1
xor eax, eax
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x4c]
push eax
call sub.shell32.dll_ShellExecuteExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x88e899
lea eax, [ebp - 8]
call fcn.0040b8d8
lea eax, [ebp - 4]
call fcn.0040b8b4
pop eax
jmp eax
Function at 0x88ef9c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x88f0ac
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
test eax, eax
je 0x88efc6
mov eax, dword [eax - 4]
inc eax
call fcn.0043122c
mov ebx, eax
mov edx, esi
mov eax, ebx
call fcn.00430f6c
lea eax, [ebp - 8]
push eax
push ebx
call sub.version.dll_GetFileVersionInfoSizeW
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.0040b8b4
test esi, esi
jle 0x88f08d
lea eax, [esi + 1]
call fcn.0043122c
mov edi, eax
push edi
push esi
mov eax, dword [ebp - 8]
push eax
push ebx
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x88f086
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x88f0bc
push edi
call sub.version.dll_VerQueryValueW
mov esi, dword [ebp - 0xc]
mov eax, dword [esi + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
shr eax, 0x10
movzx eax, ax
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0
movzx eax, word [esi + 8]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0
mov eax, dword [ebp - 0x18]
shr eax, 0x10
movzx eax, ax
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0
movzx eax, word [esi + 0xc]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
lea edx, [ebp - 0x3c]
mov ecx, 3
mov eax, 0x88f0cc
call fcn.004313e8
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.0040bca4
mov eax, edi
call fcn.0043126c
mov eax, ebx
call fcn.0043126c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x88f0b3
lea eax, [ebp - 0x1c]
call fcn.0040b8b4
pop eax
jmp eax