joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cc553
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x5655bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp byte [esi + 0x18], bl
push edi
je 0x4cc5c4
cmp dword [esi + 0x10], ebx
je 0x4cc5c4
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, eax
inc edi
lea eax, [edi + edi]
call fcn.00475090
cmp esp, ebx
mov dword [ebp - 8], esp
je 0x4cc5c4
push edi
push dword [ebp - 8]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x10]
push dword [ebp - 8]
add ecx, 0x1b8
call fcn.004bc163
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
push ebx
push ebx
push ebx
push str.textchanged
push ecx
call dword [eax + 0x1c]
mov ecx, eax
call sym.7654Setup_Jihe.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___wchar_t_const___unsigned_int__long_int__bool_
xor eax, eax
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00463a1b
leave
ret 0x10

Function at 0x4d0b44
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x4d4], ebx
je 0x4d0bac
cmp dword [ebp + 8], 0x100
jne 0x4d0b9b
cmp word [ebp + 0xc], 0xd
jne 0x4d0b9b
cmp byte [esi + 0x4da], bl
je 0x4d0b82
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x4d0b9b
cmp byte [esi + 0x4db], bl
jne 0x4d0b9b
mov ecx, dword [esi + 0x40]
cmp ecx, ebx
je 0x4d0b97
push ebx
push ebx
push ebx
push str.return
push esi
call sym.7654Setup_Jihe.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___wchar_t_const___unsigned_int__long_int__bool_
xor eax, eax
jmp 0x4d0baf
mov eax, dword [esi + 0x4d4]
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop esi
pop ebx
pop ebp
jmp dword [eax + 0xc]
xor eax, eax
inc eax
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x4de88f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
test edx, edx
jne 0x4de89a
xor eax, eax
ret
mov eax, dword [esp + 0xc]
cmp eax, 8
push ebx
push esi
mov esi, dword [esp + 0xc]
not esi
mov ecx, 0xff
jb 0x4de955
push edi
mov edi, eax
shr edi, 3
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x52b9c8]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x52b9c8]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x52b9c8]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x52b9c8]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x52b9c8]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x52b9c8]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x52b9c8]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x52b9c8]
inc edx
sub eax, 8
dec edi
jne 0x4de8ba
pop edi
test eax, eax
je 0x4de96e
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x52b9c8]
inc edx
dec eax
jne 0x4de959
mov eax, esi
pop esi
not eax
pop ebx
ret

Function at 0x4dee07
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x10]
cmp byte [esi], 0
je 0x4dee3b
push 0
lea eax, [ebp + 0x10]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4dee36
mov byte [esi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x4dee63
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x14]
lea edx, [ecx + edi]
cmp edx, eax
jbe 0x4dee4c
sub eax, ecx
mov edi, eax
mov eax, dword [esi + 0x10]
push edi
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.00466540
add esp, 0xc
add dword [esi + 0x18], edi
mov eax, edi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop esi
pop ebp
ret

Function at 0x4dfbf9
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x5655bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x4dfca2
movzx ecx, word [esi]
test cx, cx
je 0x4dfca2
mov eax, esi
mov edx, esi
movzx ecx, cx
cmp cx, 0x2f
je 0x4dfc37
cmp cx, 0x5c
jne 0x4dfc39
mov eax, edx
inc edx
inc edx
movzx ecx, word [edx]
test cx, cx
jne 0x4dfc2b
cmp eax, esi
je 0x4dfc76
push edi
sub eax, esi
mov edi, eax
sar edi, 1
push edi
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.004f10d0
and word [ebp + edi*2 - 0x20c], 0
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.004dfbf9
add esp, 0x14
pop edi
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.0046588f
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.00465865
add esp, 0x10
push 0
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00463a1b
leave
ret
Function at 0x4e11d3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x4e124e
cmp dword [esi + 4], 0xffffffff
jne 0x4e124e
push edi
lea edi, [esi + 0x138]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x53ae6c
push edi
call fcn.00465865
cmp dword [ebp + 0x10], 1
pop ecx
pop ecx
pop edi
jne 0x4e1220
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x4e1220
mov eax, 0x2000000
jmp 0x4e1253
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004dec1d
add esp, 0x10
test eax, eax
jne 0x4e123e
mov eax, dword [ebp + 0x10]
jmp 0x4e1253
push eax
call fcn.004e0dcf
mov dword [esi], eax
mov eax, dword [0x56c1e0]
pop ecx
jmp 0x4e1253
mov eax, 0x1000000
pop esi
pop ebp
ret 0xc
Function at 0x4e408d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
mov eax, dword [esi + 8]
push edi
mov edi, eax
and edi, 7
je 0x4e40b2
cmp eax, edi
jge 0x4e40aa
mov eax, esi
call fcn.004e3a81
mov ecx, edi
shr dword [esi + 0xc], cl
sub dword [esi + 8], edi
xor ecx, ecx
cmp dword [esi + 8], ecx
jle 0x4e40d4
mov al, byte [esi + 0xc]
shr dword [esi + 0xc], 8
add dword [esi + 8], 0xfffffff8
mov byte [ebp + ecx - 4], al
inc ecx
cmp dword [esi + 8], 0
jg 0x4e40b9
cmp ecx, 4
jge 0x4e40f3
mov edi, dword [esi + 4]
mov eax, dword [esi]
cmp eax, edi
jb 0x4e40e1
xor eax, eax
jmp 0x4e40e9
mov dl, byte [eax]
inc eax
mov dword [esi], eax
movzx eax, dl
mov byte [ebp + ecx - 4], al
inc ecx
cmp ecx, 4
jl 0x4e40d7
movzx edi, byte [ebp - 3]
movzx eax, byte [ebp - 4]
movzx ecx, byte [ebp - 2]
shl edi, 8
add edi, eax
movzx eax, byte [ebp - 1]
shl eax, 8
add eax, ecx
mov ecx, edi
xor ecx, 0xffff
cmp eax, ecx
je 0x4e4125
mov eax, str.zlib_corrupt
call fcn.004e16c0
jmp 0x4e4160
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x4e4135
mov eax, str.read_past_buffer
jmp 0x4e411e
mov eax, dword [esi + 0x10]
add eax, edi
cmp eax, dword [esi + 0x18]
jbe 0x4e414a
mov ecx, edi
call fcn.004e3aac
test eax, eax
je 0x4e4160
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.00466540
add dword [esi], edi
add dword [esi + 0x10], edi
xor eax, eax
add esp, 0xc
inc eax
pop edi
pop esi
leave
ret
Function at 0x4f01b6
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x4f01f3
cmp dword [ebp + 0x14], edi
je 0x4f01f3
cmp ecx, edi
jne 0x4f01fa
call fcn.0046bdf3
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.00463bfa
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x4f020e
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x4f022f
cmp ebx, 0xffffffff
je 0x4f021e
push ebx
push edi
push ecx
call fcn.00463a30
add esp, 0xc
cmp esi, edi
je 0x4f01db
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x4f01db
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x4f024b
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x4f0252
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x4f0343
test word [esi + 0xc], 0x10c
je 0x4f02a6
mov eax, dword [esi + 4]
test eax, eax
je 0x4f02a6
jl 0x4f03a4
cmp ebx, eax
mov edi, ebx
jb 0x4f0277
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x4f034b
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0046554b
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x4f033b
cmp ebx, dword [ebp - 0xc]
jb 0x4f0313
cmp dword [ebp - 0xc], 0
je 0x4f02d0
mov ecx, SysReAllocString
xor edx, edx
cmp ebx, ecx
jbe 0x4f02c5
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x4f02cc
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x4f02db
mov eax, SysReAllocString
cmp ebx, eax
ja 0x4f02db
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x4f0377
push eax
push dword [ebp - 8]
push esi
call fcn.0046f23d
pop ecx
push eax
call fcn.0047cedf
add esp, 0xc
test eax, eax
je 0x4f03b6
cmp eax, 0xffffffff
je 0x4f03a4
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x4f033b
push esi
call fcn.0046f6a3
cmp eax, 0xffffffff
pop ecx
je 0x4f03a8
cmp dword [ebp - 4], 0
je 0x4f0377
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x4f025a
mov eax, dword [ebp + 0x14]
jmp 0x4f01f5
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x4f0362
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.00463a30
add esp, 0xc
call fcn.0046bdf3
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x4f01eb
cmp dword [ebp + 0xc], 0xffffffff
je 0x4f038d
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.00463a30
add esp, 0xc
call fcn.0046bdf3
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x4f01eb
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x4f01f5
or dword [esi + 0xc], 0x10
jmp 0x4f03a8
Function at 0x4aa7f4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004aa730
test al, al
jne 0x4aa818
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4aa87e
xor eax, eax
push ebp
push 0x4aa86e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x1c]
push eax
mov eax, dword [ebp + 0x20]
push eax
mov eax, dword [ebp + 0x24]
push eax
push edi
push esi
call sub.kernel32.dll_CreateProcessW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aa875
lea eax, [ebp - 0xc]
call fcn.004aa76c
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20

Function at 0x4aa914
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004aa730
test al, al
jne 0x4aa935
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4aa981
xor eax, eax
push ebp
push 0x4aa971
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004064d4
push eax
call sub.kernel32.dll_DeleteFileW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aa978
lea eax, [ebp - 0xc]
call fcn.004aa76c
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4aaaec
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004aa730
test al, al
jne 0x4aab0f
mov dword [ebp - 4], 0xffffffff
jmp 0x4aab5b
xor eax, eax
push ebp
push 0x4aab4b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004064d4
push eax
call sub.kernel32.dll_GetFileAttributesW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aab52
lea eax, [ebp - 0xc]
call fcn.004aa76c
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4aac90
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004aa730
test al, al
jne 0x4aacb4
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4aad08
xor eax, eax
push ebp
push 0x4aacf8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.004064d4
push eax
mov eax, esi
call fcn.004064d4
push eax
call sub.kernel32.dll_MoveFileW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aacff
lea eax, [ebp - 0xc]
call fcn.004aa76c
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4aad14
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 8]
test edi, edi
jne 0x4aad37
test esi, 4
je 0x4aad37
xor edi, edi
jmp 0x4aad40
mov eax, edi
call fcn.004064d4
mov edi, eax
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004aa730
test al, al
jne 0x4aad55
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x4aada4
xor eax, eax
push ebp
push 0x4aad94
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
push edi
mov eax, dword [ebp - 4]
call fcn.004064d4
push eax
call sub.kernel32.dll_MoveFileExW
mov dword [ebp - 8], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x14], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aad9b
lea eax, [ebp - 0x10]
call fcn.004aa76c
ret
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4aae20
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004aa730
test al, al
jne 0x4aae41
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4aae8d
xor eax, eax
push ebp
push 0x4aae7d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004064d4
push eax
call sub.kernel32.dll_RemoveDirectoryW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aae84
lea eax, [ebp - 0xc]
call fcn.004aa76c
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4aae98
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004aa730
test al, al
jne 0x4aaebc
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4aaf09
xor eax, eax
push ebp
push 0x4aaef9
push dword fs:[eax]
mov dword fs:[eax], esp
push edi
mov eax, esi
call fcn.004064d4
push eax
call sub.kernel32.dll_SetFileAttributesW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aaf00
lea eax, [ebp - 0xc]
call fcn.004aa76c
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ad658
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffdc
mov ebx, eax
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x4ad686
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x10
call fcn.00406630
jmp 0x4ad68f
mov eax, ebx
xor edx, edx
call fcn.00406448
add esp, 0x24
pop ebx
ret

Function at 0x4ad6e0
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffec
mov eax, dword [0x4fef70]
cmp dword [eax], 2
jne 0x4ad748
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call fcn.00409388
test eax, eax
jne 0x4ad703
xor eax, eax
jmp 0x4ad757
lea eax, [esp + 8]
push eax
push 0x4ad75c
push 0
call fcn.00409380
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call fcn.004ad6d8
call sub.kernel32.dll_GetLastError
test eax, eax
je 0x4ad748
xor eax, eax
jmp 0x4ad757
push 0
push 2
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x14
ret

Function at 0x4ad784
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x4ad7de
inc esi
xor edi, edi
cmp edi, 1
jne 0x4ad7aa
mov eax, dword [ebp + 0xc]
push eax
call fcn.004136e8
jmp 0x4ad7b8
cmp edi, 1
jle 0x4ad7b8
mov eax, dword [ebp + 8]
push eax
call fcn.004136e8
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004aa914
test eax, eax
jne 0x4ad7de
call sub.kernel32.dll_GetLastError
cmp eax, 2
je 0x4ad7de
call sub.kernel32.dll_GetLastError
cmp eax, 3
je 0x4ad7de
inc edi
dec esi
jne 0x4ad79a
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
Function at 0x4b0f90
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
add esp, 0xfffffff4
mov ebx, edx
mov esi, eax
cmp byte [esi + 4], 0
je 0x4b106a
mov byte [esi + 5], 1
mov eax, dword [esi + 0x10]
mov dword [esp + 4], eax
mov byte [esp + 8], 0
lea edx, [esp + 4]
xor ecx, ecx
mov eax, 0x4b107c
call fcn.004b01a4
mov eax, dword [esi + 0xc]
push eax
call fcn.004093f0
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4b0fe8
mov eax, 0x4b10dc
call fcn.004aff20
push 1
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_TerminateProcess
push 0x2710
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x4b0fd3
push esp
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
je 0x4b103b
cmp dword [esp], 0
jne 0x4b101d
mov eax, 0x4b1134
call fcn.004aff20
jmp 0x4b1045
mov eax, dword [esp]
mov dword [esp + 4], eax
mov byte [esp + 8], 0
lea edx, [esp + 4]
xor ecx, ecx
mov eax, 0x4b1170
call fcn.004b01a4
jmp 0x4b1045
mov eax, 0x4b11d8
call fcn.004aff20
mov eax, dword [esi + 8]
push eax
call fcn.004093f0
xor eax, eax
mov dword [esi + 8], eax
xor eax, eax
mov dword [esi + 0x10], eax
mov byte [esi + 4], 0
test bl, bl
je 0x4b106a
push 0xfa
call fcn.004136e8
add esp, 0xc
pop esi
pop ebx
ret
Function at 0x4b1240
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b147e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
inc dword [eax + 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
mov ebx, dword [ebp - 4]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x24], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x28], ecx
xor eax, eax
lea ebx, [eax + 0xc]
add ebx, ecx
xor edx, edx
push ebp
push 0x4b1423
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
push 0xffffffffffffffff
push 0
call sub.kernel32.dll_CreateEventW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4b12b5
mov eax, 0x4b149c
call fcn.004ab40c
xor edx, edx
push ebp
push 0x4b13b8
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x14
call fcn.00403540
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 8]
push eax
push 0x14
mov eax, dword [ebp - 4]
add eax, 0x4034
push eax
push ebx
mov eax, dword [ebp - 4]
add eax, 0x20
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_TransactNamedPipe
test eax, eax
jne 0x4b13a1
call sub.kernel32.dll_GetLastError
cmp eax, 0x3e5
je 0x4b131d
mov eax, 0x4b14c0
call fcn.004ab40c
xor edx, edx
push ebp
push 0x4b138a
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [ebp + 8], 0
je 0x4b135d
mov eax, dword [ebp - 4]
cmp word [eax + 0x1a], 0
je 0x4b135d
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x1c]
call dword [ebx + 0x18]
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xc]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x4b133b
pop dword fs:[0]
add esp, 8
push 0x4b1391
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_GetOverlappedResult
mov ebx, eax
call sub.kernel32.dll_GetLastError
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b13bf
mov eax, dword [ebp - 0xc]
push eax
call fcn.004093f0
ret