joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409ac0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x445050
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
mov eax, dword [0x453250]
push edi
mov dword [esp + 8], eax
mov dword [esp + 0x64], 0
mov dword [esp + 4], eax
mov ecx, dword [0x456abc]
mov eax, 1
xor edi, edi
mov byte [esp + 0x64], al
test ecx, ecx
mov dword [esp + 0xc], 0x960
mov dword [esp + 0x10], 0x961
mov dword [esp + 0x14], 0x962
mov dword [esp + 0x18], 0x963
mov dword [esp + 0x1c], 0x964
mov dword [esp + 0x20], 0x965
mov dword [esp + 0x24], 0x966
mov dword [esp + 0x28], 0x967
mov dword [esp + 0x2c], 0x968
mov dword [esp + 0x30], 0x969
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 2
mov dword [esp + 0x3c], 0xc
mov dword [esp + 0x40], 0x10
mov dword [esp + 0x44], pe_nt_image_headers32
mov dword [esp + 0x48], 0x200
mov dword [esp + 0x4c], 0x400
mov dword [esp + 0x50], 0x800
mov dword [esp + 0x54], 0x2000
mov dword [esp + 0x58], 0x4000
je 0x409baa
mov eax, dword [0x456ac0]
push eax
call fcn.0043c00f
push esi
push 0x3eb
lea ecx, [esp + 0x10]
call fcn.0043c49e
xor esi, esi
mov ecx, dword [esp + esi + 0x10]
push ecx
lea ecx, [esp + 0xc]
call fcn.0043c49e
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
push edx
push eax
call fcn.00404a80
add esp, 8
test eax, eax
je 0x409bea
cmp eax, 0x80000000
je 0x409bea
or edi, dword [esp + esi + 0x38]
add esi, 4
cmp esi, 0x28
jl 0x409bbb
test edi, 0x800
pop esi
je 0x409c01
or edi, 0x1000
lea ecx, [esp + 4]
mov byte [esp + 0x64], 0
call fcn.0043bf22
lea ecx, [esp + 8]
mov dword [esp + 0x64], 0xffffffff
call fcn.0043bf22
mov ecx, dword [esp + 0x5c]
mov eax, edi
pop edi
mov dword fs:[0], ecx
add esp, 0x64
ret

Function at 0x40a26b
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
test edi, edi
mov ebx, ecx
jne 0x40a265
pop edi
pop esi
xor eax, eax
pop ebx
ret 0xc
push 0
push 4
push 0
push 0
push 0x44976c
call fcn.0043ef8c
mov esi, eax
mov eax, dword [esp + 0x10]
test eax, eax
mov ecx, esi
push edi
je 0x40a28c
push eax
call fcn.0042aa70
jmp 0x40a291
call fcn.0042aa40
mov edi, eax
test edi, edi
je 0x40a2a1
push ebx
mov ecx, esi
call fcn.0042ab00
mov edi, eax
mov eax, dword [esp + 0x18]
push 0
push eax
mov ecx, esi
call fcn.0042aad0
test edi, edi
jne 0x40a2c9
mov edx, dword [esi]
mov ecx, esi
mov dword [esi + 0x24], 1
call dword [edx + 0x68]
pop edi
pop esi
xor eax, eax
pop ebx
ret 0xc
mov edi, dword [ebx + 0x124]
lea ecx, [ebx + 0x11c]
push esi
push edi
call fcn.0043b691
mov dword [ebx + 0x130], edi
mov eax, dword [esi + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
mov eax, 1
pop ebx
ret 0xc
Function at 0x40a300
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
test ebx, ebx
mov ebp, ecx
jne 0x40a315
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
push edi
push 0
push 4
push 0
push 0
push 0x44976c
mov edi, 1
call fcn.0043ef8c
mov esi, eax
push ebx
mov ecx, esi
call fcn.0042a9b0
test eax, eax
je 0x40a347
push ebp
mov ecx, esi
call fcn.0042ab00
test eax, eax
jne 0x40a349
xor edi, edi
mov eax, dword [esp + 0x18]
push 0
push eax
mov ecx, esi
call fcn.0042aad0
test edi, edi
pop edi
jne 0x40a372
mov edx, dword [esi]
mov ecx, esi
mov dword [esi + 0x24], 1
call dword [edx + 0x68]
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
mov eax, dword [ebp + 0x124]
lea ecx, [ebp + 0x11c]
push esi
push eax
call fcn.0043b691
mov ecx, dword [esi + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
pop ebp
mov eax, 1
pop ebx
ret 8

Function at 0x40a3a0
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
test ebx, ebx
mov ebp, ecx
jne 0x40a3b5
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x10
push edi
push 0
push 4
push 0
push 0
push 0x44976c
mov edi, 1
call fcn.0043ef8c
mov esi, eax
mov eax, dword [esp + 0x14]
push ebx
push eax
mov ecx, esi
call fcn.0042a9e0
test eax, eax
je 0x40a3ec
push ebp
mov ecx, esi
call fcn.0042ab00
test eax, eax
jne 0x40a3ee
xor edi, edi
mov ecx, dword [esp + 0x1c]
push 0
push ecx
mov ecx, esi
call fcn.0042aad0
test edi, edi
pop edi
mov ecx, esi
jne 0x40a417
mov edx, dword [esi]
mov dword [esi + 0x24], 1
call dword [edx + 0x68]
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x10
mov eax, dword [esp + 0x1c]
push eax
call fcn.0042aab0
mov edx, dword [ebp + 0x124]
lea ecx, [ebp + 0x11c]
push esi
push edx
call fcn.0043b691
mov eax, dword [esi + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x10
Function at 0x40b0e0
Capabilities:
Create process on windows
Get comspec environment variable
Query environment variable
Resume thread
Self delete

Disassembly:
mov eax, 0x8158
call fcn.0042d040
push ebx
push ebp
push esi
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x20]
lea edx, [esp + 0x64]
rep stosd dword es:[edi], eax
mov ecx, dword [0x458b00]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
push ecx
mov dword [esp + 0x1c], eax
push edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 0x44
mov dword [esp + 0x54], 1
mov word [esp + 0x58], ax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x64]
push 0x104
lea ecx, [esp + 0x68]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea edx, [esp + 0x168]
push 0x7fff
push edx
push str._COMSPEC_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x168]
push str.__c_del
push eax
call esi
lea ecx, [esp + 0x64]
lea edx, [esp + 0x168]
push ecx
push edx
call esi
lea eax, [esp + 0x168]
push str.___nul
push eax
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push pe_nt_image_headers32
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push eax
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push 0xf
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push eax
call edi
lea ecx, [esp + 0x10]
lea edx, [esp + 0x20]
push ecx
push edx
push 0
push 0
push 0xc
push 0
push 0
lea eax, [esp + 0x184]
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40b237
mov ecx, dword [esp + 0x10]
push 0x40
push ecx
call esi
mov edx, dword [esp + 0x14]
push 0xfffffffffffffff1
push edx
call edi
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0x14]
push edx
call esi
lea eax, [esp + 0x64]
push 0
push eax
push 1
push 4
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x8158
ret
push 0x20
call ebx
push eax
call esi
push 0
call ebp
push eax
call edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x8158
ret
Function at 0x410630
Capabilities:
Check os version

Disassembly:
mov eax, dword [0x456b08]
sub esp, 0x9c
push ebx
push ebp
xor ebx, ebx
push esi
test eax, eax
push edi
jne 0x410852
mov ebp, dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, 0x27
lea edi, [esp + 0x10]
xor esi, esi
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x9c
push eax
call ebp
test eax, eax
je 0x4106aa
cmp byte [esp + 0xaa], 3
jne 0x41067e
mov ebx, 1
mov eax, dword [esp + 0x20]
sub eax, 0
je 0x410845
dec eax
je 0x4107c1
dec eax
je 0x4106d5
xor esi, esi
pop edi
mov dword [0x456b08], esi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x9c
ret
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0x94
push ecx
call ebp
test eax, eax
jne 0x41067e
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x9c
ret
mov eax, dword [esp + 0x14]
cmp eax, 6
jbe 0x4106f6
mov esi, 0x4000
pop edi
mov dword [0x456b08], esi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x9c
ret
jne 0x410710
mov esi, 0x4000
pop edi
mov dword [0x456b08], esi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x9c
ret
cmp eax, 5
jne 0x410783
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x410735
mov esi, 0x400
pop edi
mov dword [0x456b08], esi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x9c
ret
cmp eax, 2
jne 0x41075f
neg ebx
sbb ebx, ebx
pop edi
and ebx, 0x1000
add ebx, 0x1000
mov esi, ebx
mov dword [0x456b08], esi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x9c
ret
cmp eax, 1
pop edi
sbb esi, esi
and esi, 0xfffff800
add esi, 0x800
mov dword [0x456b08], esi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x9c
ret
jae 0x41084a
cmp eax, 4
jne 0x4107a6
mov esi, 0x200
pop edi
mov dword [0x456b08], esi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x9c
ret
sbb esi, esi
pop edi
and esi, 0x100
mov dword [0x456b08], esi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x9c
ret
cmp dword [esp + 0x14], 4
jne 0x410695
mov eax, dword [esp + 0x18]
test eax, eax
je 0x41082d
cmp eax, 0xa
je 0x4107fa
xor edx, edx
cmp eax, 0x5a
setne dl
dec edx
pop edi
and edx, 0x10
mov esi, edx
mov dword [0x456b08], esi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x9c
ret
lea eax, [esp + 0x24]
push 2
push eax
push 0x4528a8
call fcn.0042d931
mov esi, eax
add esp, 0xc
neg esi
sbb esi, esi
pop edi
and esi, 0xfffffffc
add esi, 8
mov dword [0x456b08], esi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x9c
ret
mov esi, 2
pop edi
mov dword [0x456b08], esi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x9c
ret
mov esi, 1
mov dword [0x456b08], esi
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x9c
ret
Function at 0x410af0
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
call edi
add eax, esi
push eax
push esi
call dword [sym.imp.USER32.dll_CharPrevA]
cmp byte [eax], 0x5c
je 0x410b39
push esi
call edi
mov ecx, dword [esp + 0x10]
dec ecx
cmp eax, ecx
jb 0x410b2a
push str._minst__ERROR:_Cannot_append_a_back_slash_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
xor eax, eax
pop esi
ret
push 0x45228c
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
pop edi
pop esi
ret
mov eax, esi
pop edi
pop esi
ret
Function at 0x410e80
Capabilities:
Copy file
Set file attributes

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x410ea3
mov ecx, dword [esp + 0x10]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
pop esi
ret

Function at 0x410eb0
Capabilities:
Delete directory
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x445720
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push ebp
push esi
lea ecx, [esp + 0x1c]
call fcn.0042ba73
mov ebp, dword [esp + 0x48]
lea ecx, [esp + 0xc]
push ebp
mov dword [esp + 0x44], 0
call fcn.0043bf90
lea eax, [esp + 0xc]
mov bl, 1
push eax
mov byte [esp + 0x44], bl
call fcn.00410ac0
add esp, 4
lea ecx, [esp + 0xc]
lea edx, [esp + 0x48]
push 0x452290
push ecx
push edx
call fcn.0043c16b
mov eax, dword [eax]
push 0
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x48], 2
call fcn.0042bb36
lea ecx, [esp + 0x48]
mov esi, eax
mov byte [esp + 0x40], bl
call fcn.0043bf22
test esi, esi
je 0x410ffd
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
lea ecx, [esp + 0x20]
call fcn.0042bd56
lea ecx, [esp + 0x20]
mov edi, eax
call fcn.0042bd1d
test eax, eax
jne 0x410ff4
mov eax, dword [esp + 0x20]
push 0x10
lea ecx, [esp + 0x24]
call dword [eax + 0x38]
test eax, eax
je 0x410fb6
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x24]
call fcn.0042bf4e
push eax
lea edx, [esp + 0x14]
lea eax, [esp + 0x50]
push edx
push eax
mov byte [esp + 0x50], 3
call fcn.0043c105
mov eax, dword [eax]
mov byte [esp + 0x44], 4
push eax
call fcn.00410eb0
add esp, 4
lea ecx, [esp + 0x4c]
mov byte [esp + 0x44], 3
call fcn.0043bf22
lea ecx, [esp + 0x14]
jmp 0x410feb
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x24]
call fcn.0042bf4e
push eax
lea edx, [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push eax
mov byte [esp + 0x50], 5
call fcn.0043c105
mov eax, dword [eax]
push eax
call esi
lea ecx, [esp + 0x18]
call fcn.0043bf22
lea ecx, [esp + 0x1c]
mov byte [esp + 0x44], bl
call fcn.0043bf22
test edi, edi
jne 0x410f42
pop edi
lea ecx, [esp + 0x1c]
call fcn.0042baec
push ebp
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea ecx, [esp + 0xc]
mov esi, eax
mov byte [esp + 0x40], 0
call fcn.0043bf22
lea ecx, [esp + 0x1c]
mov dword [esp + 0x40], 0xffffffff
call fcn.0042bab0
mov ecx, dword [esp + 0x38]
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret
Function at 0x411800
Capabilities:
Get common file path
Get disk size

Disassembly:
sub esp, 0x130
lea eax, [esp + 0x28]
push ebp
push edi
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x30]
push 0x5c
push ecx
call fcn.0042da54
add esp, 8
mov byte [eax + 1], 0
push str.GetDiskFreeSpaceExA
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41186e
lea edx, [esp + 0x18]
lea ecx, [esp + 0x20]
push edx
push ecx
lea edx, [esp + 0x30]
lea ecx, [esp + 0x38]
push edx
push ecx
call eax
mov edi, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
jmp 0x4118a6
lea edx, [esp + 8]
lea eax, [esp + 0xc]
push edx
lea ecx, [esp + 0x14]
push eax
lea edx, [esp + 0x1c]
push ecx
lea eax, [esp + 0x3c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
mov ecx, dword [esp + 0x14]
xor edi, edi
imul ecx, dword [esp + 0x10]
mov edx, ecx
imul ecx, dword [esp + 8]
imul edx, dword [esp + 0xc]
xor ebp, ebp
test eax, eax
je 0x4118cd
push esi
mov esi, dword [esp + 0x140]
mov dword [esi], edx
mov edx, dword [esp + 0x144]
mov dword [esi + 4], edi
pop esi
mov dword [edx + 4], ebp
pop edi
mov dword [edx], ecx
pop ebp
add esp, 0x130
ret
mov ecx, dword [esp + 0x13c]
pop edi
pop ebp
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov ecx, dword [esp + 0x138]
mov dword [ecx], 0
mov dword [ecx + 4], 0
add esp, 0x130
ret

Function at 0x411900
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x18
push esi
push edi
mov edi, dword [esp + 0x24]
mov dword [esp + 8], 0
test edi, edi
je 0x411982
mov esi, dword [esp + 0x28]
test esi, esi
je 0x411982
lea eax, [esp + 8]
mov dword [esi], 0
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x41194e
push str._minst__FAILED_to_check_privileges._OpenProcessToken___n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
xor eax, eax
pop esi
add esp, 0x18
ret
lea ecx, [esp + 0x14]
push ecx
push edi
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x41198a
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str._minst__FAILED_to_check_privileges._LookupPrivilegeValue___n
call esi
push edi
call esi
push 0x45210c
call esi
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
add esp, 0x18
ret
mov ecx, dword [esp + 8]
lea eax, [esp + 0xc]
push esi
push eax
push ecx
mov dword [esp + 0x18], 1
call dword [sym.imp.ADVAPI32.dll_PrivilegeCheck]
test eax, eax
jne 0x4119c5
push str._minst__FAILED_to_check_privileges._PrivilegeCheck___n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
add esp, 0x18
ret
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
add esp, 0x18
ret
Function at 0x4119e0
Capabilities:
Print debug messages

Disassembly:
push ecx
mov eax, dword [0x456b0c]
test eax, eax
je 0x4119f5
xor ecx, ecx
test eax, eax
setg cl
mov eax, ecx
pop ecx
ret
call fcn.00410630
test al, 0xfe
je 0x411a0c
mov dword [0x456b0c], 0xffffffff
xor eax, eax
pop ecx
ret
call fcn.00410630
test ah, 0x20
jne 0x411ab7
call fcn.00410630
test ah, 0x10
jne 0x411ab7
lea edx, [esp]
mov dword [esp], 0
push edx
push str.SeLoadDriverPrivilege
call fcn.00411900
add esp, 8
test eax, eax
jne 0x411a52
mov dword [0x456b0c], 0xffffffff
pop ecx
ret
mov eax, dword [esp]
test eax, eax
jne 0x411a84
lea eax, [esp]
push eax
push str.SeUndockPrivilege
call fcn.00411900
add esp, 8
test eax, eax
jne 0x411a7c
mov dword [0x456b0c], 0xffffffff
pop ecx
ret
mov eax, dword [esp]
test eax, eax
je 0x411a97
or eax, 0xffffffff
xor ecx, ecx
test eax, eax
setg cl
mov dword [0x456b0c], eax
mov eax, ecx
pop ecx
ret
push str._minst__This_process_may_be_launched_via_the_seclogon_service._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 1
xor ecx, ecx
test eax, eax
setg cl
mov dword [0x456b0c], eax
mov eax, ecx
pop ecx
ret
call fcn.00411b00
test eax, eax
je 0x411ae4
push str._minst___Is2003IsXP64__This_process_may_be_launched_via_the_seclogon_service._n
mov dword [0x456b0c], 1
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [0x456b0c]
xor eax, eax
test ecx, ecx
setg al
pop ecx
ret
mov dword [0x456b0c], 0xffffffff
mov ecx, dword [0x456b0c]
xor eax, eax
test ecx, ecx
setg al
pop ecx
ret
Function at 0x411ba0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x234
mov al, byte [0x456af4]
push ebx
push ebp
push esi
push edi
mov byte [esp + 0x140], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x141]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.CreateToolhelp32Snapshot
push str.kernel32.dll
mov dword [esp + 0x1c], 0
stosb byte es:[edi], al
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.Process32First
push str.kernel32.dll
mov ebx, eax
call esi
push eax
call edi
push str.Process32Next
push str.kernel32.dll
mov dword [esp + 0x18], eax
call esi
push eax
call edi
mov edx, dword [esp + 0x10]
mov ebp, eax
mov ecx, ebp
and ecx, edx
test ebx, ecx
jne 0x411c36
push str._minst__FAILED_to_get_the_process_functions._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x234
ret
mov ecx, dword [esp + 0x248]
test ecx, ecx
je 0x411d8e
mov eax, dword [esp + 0x24c]
test eax, eax
jbe 0x411d8e
mov eax, dword [esp + 0x250]
test eax, eax
je 0x411d8e
push 0
mov byte [ecx], 0
push 2
mov dword [eax], 0
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x411c91
push str._minst__FAILED_to_CreateToolhelp32Snapshot_PROCESS__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x234
ret
mov ebx, dword [esp + 0x10]
lea edx, [esp + 0x18]
mov ecx, 0x4a
xor eax, eax
lea edi, [esp + 0x18]
push edx
rep stosd dword es:[edi], eax
push esi
mov dword [esp + 0x20], 0x128
call ebx
test eax, eax
je 0x411cd0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
cmp edi, dword [esp + 0x20]
je 0x411cda
lea eax, [esp + 0x18]
push eax
push esi
call ebp
test eax, eax
jne 0x411cbe
push str._minst__Not_found_this_process._n
jmp 0x411d81
mov edi, dword [esp + 0x30]
lea ecx, [esp + 0x18]
push ecx
push esi
call ebx
test eax, eax
je 0x411cfc
cmp edi, dword [esp + 0x20]
je 0x411d03
lea edx, [esp + 0x18]
push edx
push esi
call ebp
test eax, eax
jne 0x411cea
push str._minst__Not_found_the_parent_process._n
jmp 0x411d81
lea eax, [esp + 0x3c]
lea ecx, [esp + 0x140]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x140]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x411d72
mov eax, dword [esp + 0x24c]
cmp eax, 0x104
jb 0x411d42
mov eax, 0x104
mov ecx, dword [esp + 0x248]
push eax
lea eax, [esp + 0x144]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov edx, dword [esp + 0x250]
mov eax, 1
mov dword [edx], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x234
ret
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x234
ret
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x234
ret
Function at 0x411da0
Capabilities:
Print debug messages
Shutdown system

Disassembly:
sub esp, 0x14
call fcn.00410630
test ah, 0xff
je 0x411e45
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x411dda
push str._minst__FAILED_to_reboot:_OpenProcessToken___n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
add esp, 0x14
ret
lea ecx, [esp + 8]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [esp]
push 0
push 0
lea edx, [esp + 0xc]
push 0
push edx
push 0
push eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x411e3a
push str._minst__FAILED_to_reboot:_AdjustTokenPrivileges___n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add esp, 0x14
ret
mov edx, dword [esp]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x411e5c
mov eax, 1
add esp, 0x14
ret
push str._minst__FAILED_to_reboot:_ExitWindowsEx___n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
add esp, 0x14
ret
Function at 0x4245d0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4469f6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1f0
mov eax, dword [esp + 0x200]
push ebp
push edi
mov ebp, ecx
push eax
lea ecx, [esp + 0xc]
call fcn.0043bf90
mov ecx, dword [esp + 8]
xor edi, edi
mov dword [esp + 0x200], edi
cmp dword [ecx - 8], edi
jle 0x4247d4
lea edx, [esp + 8]
mov ecx, ebp
push edx
call fcn.00424300
test eax, eax
je 0x4247d4
push ebx
push esi
lea eax, [esp + 0xf8]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x30]
lea edx, [esp + 0x20]
push ecx
push edx
call fcn.00411800
mov ebx, dword [esp + 0x21c]
add esp, 8
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov edi, dword [ebp + 0xa4]
lea eax, [esp + 0x18]
lea esi, [ebx + ebx*4]
push eax
mov ecx, edi
add esi, esi
call fcn.00420170
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x2c], edx
cmp ecx, eax
ja 0x4246a0
jb 0x424699
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
cmp edx, eax
ja 0x4246a0
mov eax, 1
jmp 0x4246a2
xor eax, eax
mov dword [edi + 0x100], eax
mov eax, 1
xor edx, edx
mov ecx, esi
call fcn.0042dd00
mov ecx, dword [esp + 0x20]
mov edi, edx
mov esi, eax
mov eax, dword [esp + 0x24]
push edi
push esi
push eax
push ecx
call fcn.0042dc90
push edx
push eax
lea edx, [esp + 0x80]
push str._I64u
push edx
call fcn.0042d7d0
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
add esp, 0x10
push edi
push esi
push eax
push ecx
call fcn.0042dc90
push edx
push eax
lea edx, [esp + 0x40]
push str._I64u
push edx
call fcn.0042d7d0
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
add esp, 0x10
push edi
push esi
push eax
push ecx
call fcn.0042dc90
push edx
push eax
lea edx, [esp + 0xc0]
push str._I64u
push edx
call fcn.0042d7d0
mov eax, dword [0x453250]
add esp, 0x10
mov dword [esp + 0x14], eax
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ebx
push ecx
mov ecx, dword [ebp + 0xa4]
mov byte [esp + 0x210], 1
call fcn.004204b0
mov eax, dword [eax]
lea edx, [esp + 0xb8]
lea ecx, [esp + 0x38]
push edx
push ecx
lea edx, [esp + 0x80]
movsx ecx, byte [esp + 0x100]
push edx
push eax
push ecx
lea edx, [esp + 0x28]
push esi
push edx
call fcn.0043aed2
add esp, 0x1c
lea eax, [esp + 0x14]
lea ecx, [ebp + 0x90]
push eax
call fcn.0043c00f
lea ecx, [esp + 0x14]
mov byte [esp + 0x208], 0
call fcn.0043bf22
mov ebp, dword [ebp + 0x1c]
pop esi
test ebp, ebp
pop ebx
je 0x4247b9
push 0
push 0
push ebp
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [esp + 8]
mov dword [esp + 0x200], 0xffffffff
call fcn.0043bf22
mov eax, 1
jmp 0x4247ea
lea ecx, [esp + 8]
mov dword [esp + 0x200], 0xffffffff
call fcn.0043bf22
xor eax, eax
mov ecx, dword [esp + 0x1f8]
pop edi
pop ebp
mov dword fs:[0], ecx
add esp, 0x1fc
ret 8