joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438565
Capabilities:
Receive data
Receive data on socket

Disassembly:
push 0xc
mov eax, 0x5b465a
call fcn.00580e6b
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
push dword [ebp + 8]
call fcn.0040850b
mov dword [ebp - 4], edi
mov esi, 0x100000
push esi
mov dword [ebp - 0x10], 1
call fcn.00573e8f
pop ecx
push esi
mov ebx, eax
push edi
push ebx
call fcn.005783f0
add esp, 0xc
push 0
mov eax, esi
sub eax, edi
push eax
lea eax, [edi + ebx]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x4385c0
add edi, eax
jmp 0x4385a4
push ebx
lea eax, [ebp + 0xc]
push eax
mov byte [edi + ebx], 0
call fcn.00408420
mov dword [ebp - 4], 1
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0041bece
pop ecx
pop ecx
mov byte [ebp - 4], 2
mov edi, dword [ebp + 8]
call fcn.004085c5
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.004085a2
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.00408461
push ebx
call fcn.00573db2
pop ecx
mov eax, edi
call fcn.00580f43
ret 8

Function at 0x438619
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push 0x64
mov eax, 0x5ae09e
call fcn.00580e6b
mov edi, ecx
xor esi, esi
inc esi
mov dword [ebp - 4], esi
push edi
call fcn.0041d1c3
xor ebx, ebx
pop ecx
mov dword [ebp - 0x14], eax
cmp eax, ebx
jne 0x438640
mov dword [ebp - 0x14], edi
push 0x44
pop edi
push edi
lea eax, [ebp - 0x70]
push ebx
push eax
call fcn.005783f0
mov dword [ebp - 0x70], edi
xor eax, eax
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
mov word [ebp - 0x40], si
call fcn.0040850b
mov byte [ebp - 4], 2
push dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push dword [ebp + 8]
push str._s__s
call fcn.00417833
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea esi, [ebp - 0x10]
call fcn.004087dc
push eax
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x4386fa
cmp dword [0x6af38c], 3
jl 0x4386cd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateProcessAsUser____i
push str.RunProcessWaitR
push 3
call fcn.00532962
add esp, 0x10
xor esi, esi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.004085a2
mov byte [ebp - 4], bl
lea ecx, [ebp + 8]
call fcn.004085a2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.004085a2
mov eax, esi
call fcn.00580f43
ret
push dword [ebp - 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x20]
call esi
xor esi, esi
inc esi
jmp 0x4386cf
Function at 0x43bc7f
Capabilities:
Get session user name

Disassembly:
push ebp
sub esp, 0xc8
lea ebp, [esp - 4]
mov eax, dword [0x6b06f8]
xor eax, ebp
mov dword [ebp + 0xc8], eax
push 0x10
mov eax, 0x5b1125
call fcn.00580e6b
xor esi, esi
mov dword [ebp - 4], esi
push str.SYSTEM
push edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], esi
call fcn.00408561
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], 1
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov dword [ebp - 0x10], esi
cmp eax, 0xffffffff
je 0x43bd44
lea ecx, [ebp - 0x10]
push ecx
push eax
call sub.WTSAPI32.dll_WTSQueryUserToken
test eax, eax
je 0x43bd44
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x43bd3b
xor eax, eax
push 0xc6
mov word [ebp], ax
lea eax, [ebp + 2]
push esi
push eax
call fcn.005783f0
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp]
push eax
mov dword [ebp - 0x14], 0x64
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x43bd35
mov eax, dword [ebp - 0x14]
cmp eax, esi
jbe 0x43bd35
xor ecx, ecx
mov word [ebp + eax*2], cx
lea eax, [ebp]
push eax
push edi
call fcn.00408606
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xc8]
xor ecx, ebp
call fcn.0057372c
add ebp, 0xcc
leave
ret
Function at 0x43d89d
Capabilities:
Create thread
Delete file
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5be71b
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x6b06f8]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov dword [esp + 0x14], ecx
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
cmp eax, ebx
jl 0x43da91
call fcn.0041d424
call fcn.0043d7c3
lea eax, [esp + 0x10]
push str._journal
push eax
mov esi, 0x6c8ef0
call fcn.004135f4
pop ecx
pop ecx
mov dword [esp + 0x48], ebx
push dword [eax]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
call edi
or dword [esp + 0x48], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.00408461
lea eax, [esp + 0x10]
push str._shm
push eax
call fcn.004135f4
pop ecx
pop ecx
mov dword [esp + 0x48], 1
push dword [eax]
call edi
or dword [esp + 0x48], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.00408461
lea eax, [esp + 0x10]
push str._wal
push eax
call fcn.004135f4
pop ecx
pop ecx
mov dword [esp + 0x48], 2
push dword [eax]
call edi
or dword [esp + 0x48], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.00408461
lea eax, [esp + 0x10]
push eax
call fcn.0042103d
pop ecx
push 3
pop esi
mov dword [esp + 0x48], esi
mov edi, 0x6c8ef8
call fcn.004085c5
or dword [esp + 0x48], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.004085a2
cmp dword [0x6af38c], 1
jl 0x43d9f5
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
push edi
push eax
call fcn.00408532
mov dword [esp + 0x4c], 4
lea eax, [esp + 0x14]
push eax
or dword [esp + 0x50], 0xffffffff
call fcn.004040c8
mov dword [esp + 0x50], 5
push dword [eax]
push str.HddId:__s
push str.AVSuiteService::Process
push 1
call fcn.00532962
add esp, 0x18
or dword [esp + 0x48], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.00408461
push ebx
push ebx
push ebx
push esi
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push ebx
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
lea eax, [esp + 0x24]
push eax
call fcn.0041ee6c
pop ecx
mov dword [esp + 0x48], 6
mov esi, eax
call fcn.0043daa4
or dword [esp + 0x48], 0xffffffff
lea eax, [esp + 0x24]
push eax
call fcn.0041f161
call fcn.0046c57c
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x28]
push ebx
push ebx
push eax
push 0x43d850
push ebx
push ebx
mov dword [esp + 0x34], ecx
call fcn.005755cb
add esp, 0x18
push 0xffffffffffffffff
mov dword [esp + 0x24], eax
push ebx
lea eax, [esp + 0x24]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
jne 0x43da91
call fcn.00456612
cmp dword [esp + 0x20], ebx
je 0x43da91
push ebx
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x43da91
push 1
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43e9d3
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
sub esp, 0x22c
lea ebp, [esp - 4]
mov eax, dword [0x6b06f8]
xor eax, ebp
mov dword [ebp + 0x22c], eax
push 8
mov eax, 0x5b106d
call fcn.00580e6b
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp + 0x238]
call fcn.004087b3
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x14], esi
cmp esi, 0xffffffff
je 0x43eab7
lea eax, [ebp]
push eax
push esi
mov dword [ebp], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x43ea3b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x43eab7
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp + 0x24]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00408561
mov byte [ebp - 4], 1
lea eax, [ebp - 0x10]
call fcn.004087b3
push dword [ebp + 0x238]
xor ecx, ecx
lea esi, [ebp - 0x10]
call fcn.00426385
cmp eax, 0xffffffff
je 0x43ea97
push dword [ebp + 8]
push ebx
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebx
je 0x43ea97
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call edi
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x10]
call fcn.004085a2
lea eax, [ebp]
push eax
push dword [ebp - 0x14]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x43ea41
push dword [ebp - 0x14]
call edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x238]
call fcn.004085a2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x22c]
xor ecx, ebp
call fcn.0057372c
add ebp, 0x230
leave
ret

Function at 0x43eae9
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
push 0
push 4
or esi, 0xffffffff
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, esi
jne 0x43eb09
pop edi
mov eax, esi
pop esi
leave
ret
lea eax, [ebp - 0x1c]
push eax
push edi
mov dword [ebp - 0x1c], 0x1c
call sub.KERNEL32.dll_Thread32First
test eax, eax
jne 0x43eb27
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x43eb03
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 8]
je 0x43eb3b
lea eax, [ebp - 0x1c]
push eax
push edi
call sub.KERNEL32.dll_Thread32Next
jmp 0x43eb1a
mov esi, dword [ebp - 0x10]
jmp 0x43eb1e
Function at 0x43f946
Capabilities:
Shutdown system

Disassembly:
push 0x18
mov eax, 0x5a5c1b
call fcn.00580e9e
xor esi, esi
mov dword [ebp - 4], esi
lea eax, [ebp - 0x14]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x43f975
mov eax, 0x80004005
jmp 0x43f9c1
lea eax, [ebp - 0x20]
push eax
push str.SeShutdownPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x18], 2
push esi
push esi
push esi
lea eax, [ebp - 0x24]
push eax
push esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x43f9bf
push 0x80020013
push 5
call dword [sym.imp.USER32.dll_ExitWindowsEx]
or dword [ebp - 4], 0xffffffff
xor eax, eax
call fcn.00580f43
ret 4

Function at 0x44023e
Capabilities:
Get session user name

Disassembly:
push ebp
sub esp, 0xc8
lea ebp, [esp - 4]
mov eax, dword [0x6b06f8]
xor eax, ebp
mov dword [ebp + 0xc8], eax
push 0x14
mov eax, 0x5adea9
call fcn.00580e9e
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x11], bl
mov dword [ebp - 0x18], ebx
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ole32.dll_CoGetCallerTID]
cmp eax, ebx
jl 0x440345
cmp dword [ebp - 0x18], ebx
je 0x440345
push dword [ebp - 0x18]
call fcn.0043eae9
pop ecx
cmp eax, ebx
je 0x440345
push eax
push ebx
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ecx, [ebp - 0x1c]
push ecx
push 0xf
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x440345
mov byte [ebp - 0x11], 1
mov eax, dword [ebp - 0x1c]
mov dword [0x6c8c4c], eax
cmp dword [ebp + 0xe0], ebx
jne 0x4402e2
push eax
call fcn.0041d1c3
pop ecx
cmp eax, ebx
je 0x4402e2
mov dword [0x6c8c4c], eax
push dword [0x6c8c4c]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x440345
xor eax, eax
mov word [ebp], ax
push 0xc6
push ebx
lea eax, [ebp + 2]
push eax
call fcn.005783f0
add esp, 0xc
mov dword [ebp - 0x20], 0x64
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x44033f
mov eax, dword [ebp - 0x20]
cmp eax, ebx
jbe 0x44033f
xor ecx, ecx
mov word [ebp + eax*2], cx
lea eax, [ebp]
push eax
push 0x6c9450
call fcn.00408606
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
or dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xc8]
xor ecx, ebp
call fcn.0057372c
add ebp, 0xcc
leave
ret 0x14
Function at 0x4419d9
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push 0x18
mov eax, 0x5b9d63
call fcn.00580e9e
xor ebx, ebx
mov dword [ebp - 4], ebx
push dword [ebp + 0x14]
lea eax, [ebp - 0x18]
push eax
call fcn.00408561
mov byte [ebp - 4], 1
push 0x67a07c
xor ecx, ecx
lea esi, [ebp - 0x18]
call fcn.00426385
cmp eax, 0xffffffff
je 0x441a33
lea ecx, [ebp - 0x20]
push ecx
mov ecx, esi
push ecx
mov ecx, eax
call fcn.004265d2
mov byte [ebp - 4], 2
mov edi, esi
call fcn.004085c5
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.004085a2
push dword [ebp + 0x24]
lea eax, [ebp - 0x1c]
push eax
call fcn.00408561
mov byte [ebp - 4], 3
lea eax, [ebp - 0x1c]
call fcn.00426419
lea eax, [ebp - 0x1c]
push eax
lea esi, [ebp - 0x18]
call fcn.00424ad0
pop ecx
test al, al
jne 0x441b66
mov eax, esi
push eax
call fcn.00420a85
pop ecx
test al, al
je 0x441a7a
mov eax, esi
push eax
call fcn.00420af0
jmp 0x441b65
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x441aac
test al, 0x10
je 0x441aac
mov byte [ebp - 0x12], bl
lea eax, [ebp - 0x1c]
push eax
push 1
lea eax, [ebp - 0x12]
push eax
push 1
lea eax, [ebp - 0x18]
push eax
call fcn.00459e52
add esp, 0x14
jmp 0x441b66
push 1
lea esi, [ebp - 0x1c]
call fcn.004087dc
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x20], esp
push eax
call fcn.004081bb
mov byte [ebp - 4], 4
lea esi, [ebp - 0x18]
call fcn.004087dc
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x24], esp
push eax
call fcn.004081bb
mov byte [ebp - 4], 5
mov byte [ebp - 4], 3
call fcn.004537ea
add esp, 0x3c
mov byte [ebp - 0x11], bl
push 0x67a080
lea eax, [ebp - 0x20]
push eax
call fcn.00408561
mov byte [ebp - 4], 6
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x1c]
call fcn.00470bf0
mov byte [ebp - 0x12], al
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x20]
call fcn.004085a2
cmp byte [ebp - 0x12], bl
je 0x441b42
lea eax, [ebp - 0x11]
push eax
push 1
push ebx
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.0040fb52
lea ecx, [ebp - 0x20]
call fcn.00408461
cmp byte [ebp - 0x11], bl
jne 0x441b4b
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x67a088
lea eax, [ebp - 0x1c]
push eax
call fcn.00408642
test eax, eax
jne 0x441b66
push dword [ebp - 0x18]
call fcn.0041fba4
pop ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.004085a2
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x18]
call fcn.004085a2
or dword [ebp - 4], 0xffffffff
xor eax, eax
call fcn.00580f43
ret 0x24
Function at 0x442a9a
Capabilities:
Delete file

Disassembly:
push 0x48
mov eax, 0x5be194
call fcn.00580f0a
lea esi, [ebp + 0xc]
lea edi, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp + 0x1c]
lea edi, [ebp - 0x54]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor ebx, ebx
mov dword [ebp - 4], ebx
push dword [ebp - 0x1c]
lea eax, [ebp - 0x3c]
push eax
call fcn.00408561
mov byte [ebp - 4], 1
push dword [ebp - 0x4c]
lea eax, [ebp - 0x38]
push eax
call fcn.00408561
mov byte [ebp - 4], 2
cmp dword [ebp + 0x34], ebx
jne 0x442b40
push 1
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x40], esp
push dword [ebp - 0x3c]
call fcn.004081bb
mov byte [ebp - 4], 3
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x44], esp
push dword [ebp - 0x38]
call fcn.004081bb
mov byte [ebp - 4], 4
mov byte [ebp - 4], 2
call fcn.004537ea
add esp, 0x3c
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x67a088
lea eax, [ebp - 0x3c]
push eax
call fcn.00408642
test eax, eax
jne 0x442b64
push dword [ebp - 0x38]
call fcn.0041fba4
pop ecx
jmp 0x442b64
cmp dword [ebp + 0x34], 1
jne 0x442b4f
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x442b64
cmp dword [ebp + 0x34], 2
jne 0x442b64
call fcn.00456612
lea edx, [ebp - 0x38]
mov ecx, eax
call fcn.00462bc3
lea eax, [ebp - 0x34]
push eax
call fcn.0040f817
mov byte [ebp - 4], 5
push ebx
lea ecx, [ebp - 0x34]
call fcn.004100fc
test al, al
je 0x442b8b
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.00411d8b
mov byte [ebp - 4], 2
lea eax, [ebp - 0x34]
push eax
call fcn.0040f843
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x38]
call fcn.004085a2
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x3c]
call fcn.004085a2
or dword [ebp - 4], 0xffffffff
xor eax, eax
call fcn.00580f66
ret 0x34
Function at 0x442bc7
Capabilities:
Delete file

Disassembly:
push 0x80
mov eax, 0x5be142
call fcn.00580f0a
xor edi, edi
mov dword [ebp - 4], edi
lea eax, [ebp - 0x54]
push eax
call fcn.004137bf
mov byte [ebp - 4], 1
lea eax, [ebp - 0x6c]
push eax
call fcn.004137bf
mov byte [ebp - 4], 2
lea eax, [ebp - 0x88]
push eax
call fcn.004137bf
mov byte [ebp - 4], 3
lea eax, [ebp - 0x6c]
push eax
lea esi, [ebp + 0xc]
call fcn.00420603
lea eax, [ebp - 0x54]
push eax
lea esi, [ebp + 0x1c]
call fcn.00420603
lea eax, [ebp - 0x88]
push eax
lea esi, [ebp + 0x2c]
call fcn.0042081e
add esp, 0xc
mov dword [ebp - 0x38], edi
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x48]
sar eax, 2
cmp edi, eax
jae 0x442d21
lea esi, [ebp - 0x88]
call fcn.00413946
cmp dword [eax], 0
jne 0x442cd9
push 1
lea esi, [ebp - 0x6c]
call fcn.00413946
mov eax, dword [eax]
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x8c], esp
push eax
call fcn.004081bb
mov byte [ebp - 4], 4
lea esi, [ebp - 0x54]
call fcn.00413946
mov eax, dword [eax]
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x70], esp
push eax
call fcn.004081bb
mov byte [ebp - 4], 5
mov byte [ebp - 4], 3
call fcn.004537ea
add esp, 0x3c
lea esi, [ebp - 0x54]
call fcn.00413946
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x67a088
lea esi, [ebp - 0x6c]
call fcn.00413946
push eax
call fcn.00408642
test eax, eax
jne 0x442d1b
lea esi, [ebp - 0x54]
call fcn.00413946
push dword [eax]
call fcn.0041fba4
pop ecx
jmp 0x442d1b
lea esi, [ebp - 0x88]
call fcn.00413946
cmp dword [eax], 1
jne 0x442cf3
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x442d1b
lea esi, [ebp - 0x88]
call fcn.00413946
cmp dword [eax], 2
jne 0x442d1b
call fcn.00456612
mov ebx, eax
lea esi, [ebp - 0x54]
call fcn.00413946
mov edx, eax
mov ecx, ebx
call fcn.00462bc3
inc edi
jmp 0x442c2f
lea eax, [ebp - 0x34]
push eax
call fcn.0040f817
mov byte [ebp - 4], 6
xor edi, edi
push edi
lea ecx, [ebp - 0x34]
call fcn.004100fc
test al, al
je 0x442d62
mov dword [ebp - 0x3c], edi
mov eax, dword [ebp - 0x5c]
sub eax, dword [ebp - 0x60]
sar eax, 2
cmp edi, eax
jae 0x442d62
lea esi, [ebp - 0x6c]
call fcn.00413946
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.00411d8b
inc edi
jmp 0x442d3d
mov byte [ebp - 4], 3
lea eax, [ebp - 0x34]
push eax
call fcn.0040f843
mov byte [ebp - 4], 2
lea eax, [ebp - 0x88]
push eax
call fcn.00448a80
mov byte [ebp - 4], 1
lea eax, [ebp - 0x6c]
push eax
call fcn.0041391c
mov byte [ebp - 4], 0
lea eax, [ebp - 0x54]
push eax
call fcn.0041391c
or dword [ebp - 4], 0xffffffff
xor eax, eax
call fcn.00580f66
ret 0x34
Function at 0x442db1
Capabilities:
Delete registry key

Disassembly:
push 8
mov eax, 0x5a816e
call fcn.00580e9e
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0x14], 1
jne 0x442e06
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], 1
push ebx
lea esi, [ebp - 0x14]
call fcn.00409535
push eax
push ebx
push 0x20006
push 1
push ebx
push ebx
push str.SOFTWAREClasses_avhnoralert
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov byte [ebp - 4], bl
cmp dword [ebp - 0x14], ebx
je 0x442e16
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x442e16
push str.SOFTWAREClasses_avhnoralert
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
or dword [ebp - 4], 0xffffffff
xor eax, eax
call fcn.00580f43
ret 0x14
Function at 0x444a9b
Capabilities:
Delete file
Set file attributes

Disassembly:
push 8
mov eax, 0x5b0d80
call fcn.00580e9e
xor ebx, ebx
mov dword [ebp - 4], ebx
push dword [ebp + 0x14]
lea eax, [ebp - 0x14]
push eax
call fcn.00408561
mov byte [ebp - 4], 1
lea eax, [ebp - 0x14]
call fcn.004087b3
mov esi, dword [ebp - 0x14]
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x444aed
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x14]
call fcn.004085a2
xor eax, eax
jmp 0x444b01
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x14]
call fcn.004085a2
or dword [ebp - 4], 0xffffffff
mov eax, 0x80004005
call fcn.00580f43
ret 0x14
Function at 0x445f5b
Capabilities:
Terminate process

Disassembly:
push 4
mov eax, 0x5a5af2
call fcn.00580e9e
xor edi, edi
mov dword [ebp - 4], edi
push dword [ebp + 0x14]
push edi
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, edi
je 0x445f8d
push edi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
xor eax, eax
call fcn.00580f43
ret 0x14

Function at 0x445fea
Capabilities:
Copy file

Disassembly:
push 0xc
mov eax, 0x5b0d3a
call fcn.00580e9e
xor ebx, ebx
mov dword [ebp - 4], ebx
push dword [ebp + 0x24]
lea eax, [ebp - 0x18]
push eax
call fcn.00408561
mov esi, eax
mov byte [ebp - 4], 1
push dword [ebp + 0x14]
lea eax, [ebp - 0x14]
push eax
call fcn.00408561
mov byte [ebp - 4], 2
mov esi, dword [esi]
mov eax, dword [eax]
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.004085a2
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x18]
call fcn.004085a2
or dword [ebp - 4], 0xffffffff
xor eax, eax
call fcn.00580f43
ret 0x24

Function at 0x4465da
Capabilities:
Check if file exists
Create directory

Disassembly:
push 0xc
mov eax, 0x5add42
call fcn.00580e9e
xor ebx, ebx
mov dword [ebp - 4], ebx
push 0x5c
mov esi, dword [ebp + 8]
call fcn.004263d2
mov esi, eax
lea eax, [ebp - 0x14]
push eax
call fcn.0040850b
mov byte [ebp - 4], 1
cmp esi, 0xffffffff
je 0x446659
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
mov ecx, esi
call fcn.004265d2
mov byte [ebp - 4], 2
lea edi, [ebp - 0x14]
call fcn.004085c5
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.004085a2
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], ebx
je 0x446659
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x446659
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x5c
mov esi, edi
call fcn.004263d2
mov esi, eax
jmp 0x446604
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x14]
call fcn.004085a2
or dword [ebp - 4], 0xffffffff
call fcn.00580f43
ret
Function at 0x44792c
Capabilities:
Shutdown system

Disassembly:
push 0x18
mov eax, 0x5a5abc
call fcn.00580e9e
xor esi, esi
mov dword [ebp - 4], esi
lea eax, [ebp - 0x14]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x44795b
mov eax, 0x80004005
jmp 0x4479a7
lea eax, [ebp - 0x20]
push eax
push str.SeShutdownPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x18], 2
push esi
push esi
push esi
lea eax, [ebp - 0x24]
push eax
push esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4479a5
push 0x80020013
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
or dword [ebp - 4], 0xffffffff
xor eax, eax
call fcn.00580f43
ret 4