joyce8/EMBER2024-capa huggingface dataset:
Function at 0x587fc5
Capabilities:
Move file

Disassembly:
push 0xac
mov eax, 0x61d66f
call fcn.005b2237
mov edi, dword [ebp + 8]
call fcn.00587a35
mov ebx, eax
lea eax, [ebp - 0xb8]
push ebx
push eax
call fcn.005882c2
mov esi, eax
and dword [ebp - 4], 0
lea eax, [ebp - 0xa0]
push 0x63db30
push edi
push eax
call fcn.004658e0
push esi
push eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
call fcn.00465c20
add esp, 0x20
xor esi, esi
lea ecx, [ebp - 0xa0]
push esi
push 1
call fcn.00434c40
push esi
push 1
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 4
call fcn.00434c40
lea eax, [ebp - 0x28]
push eax
call fcn.005909db
pop ecx
test al, al
je 0x588159
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.005d60dc
pop ecx
jmp 0x588159
lea eax, [ebp - 0x88]
push ebx
push eax
call fcn.0046c890
mov esi, eax
push 0x63db30
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 5
push edi
push eax
call fcn.004658e0
push esi
push eax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 6
push eax
call fcn.00465c20
add esp, 0x20
lea ecx, [ebp - 0x28]
push eax
call fcn.0041aab0
xor esi, esi
lea ecx, [ebp - 0x40]
push esi
push 1
call fcn.00434c40
push esi
push 1
lea ecx, [ebp - 0x70]
call fcn.00434c40
push esi
push 1
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 4
call fcn.00434c40
lea eax, [ebp - 0x28]
push eax
call fcn.005909db
pop ecx
test al, al
je 0x588159
lea eax, [ebx + 1]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.0046c890
mov esi, eax
push 0x63db30
lea eax, [ebp - 0x88]
mov byte [ebp - 4], 7
push edi
push eax
call fcn.004658e0
push esi
push eax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 8
push eax
call fcn.00465c20
add esp, 0x20
lea ecx, [ebp - 0x88]
xor esi, esi
push esi
push 1
call fcn.00434c40
push esi
push 1
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 4
call fcn.00434c40
cmp dword [ebp - 0x2c], 8
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x40]
cmp dword [ebp - 0x14], 8
push ecx
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.005dcfb3
pop ecx
pop ecx
push esi
push 1
lea ecx, [ebp - 0x40]
call fcn.00434c40
sub ebx, 1
jns 0x588060
push 0x6269d8
lea eax, [ebp - 0x58]
push edi
push eax
call fcn.004658e0
add esp, 0xc
lea eax, [ebp - 0x58]
cmp dword [ebp - 0x44], 8
cmovae eax, dword [ebp - 0x58]
cmp dword [edi + 0x14], 8
jb 0x588187
mov edi, dword [edi]
push eax
push edi
call fcn.005dcfb3
pop ecx
pop ecx
push esi
push 1
lea ecx, [ebp - 0x58]
call fcn.00434c40
push esi
push 1
lea ecx, [ebp - 0x28]
call fcn.00434c40
call fcn.005b21e1
ret
Function at 0x58ae3c
Capabilities:
Create process on windows

Disassembly:
push 0x88
mov eax, 0x61dd59
call fcn.005b2237
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x94]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x14]
push 0x44
push 0
push eax
call fcn.005ca820
push 0x10
lea eax, [ebp - 0x50]
mov dword [ebp - 0x94], 0x44
push 0
push eax
call fcn.005ca820
add esp, 0x18
lea ecx, [ebp - 0x28]
push esi
call fcn.00434e80
and dword [ebp - 4], 0
cmp dword [ebx + 0x10], 0
je 0x58aec5
push ebx
lea eax, [ebp - 0x40]
push 0x65056c
push eax
call fcn.004657d0
add esp, 0xc
push 0xffffffffffffffff
xor ebx, ebx
mov byte [ebp - 4], 1
push ebx
push eax
lea ecx, [ebp - 0x28]
call fcn.0041d9d0
push ebx
push 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], bl
call fcn.00434c40
jmp 0x58aec7
xor ebx, ebx
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 0x94]
push ecx
push ebx
push ebx
push 0x10
push ebx
push ebx
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x58af17
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test edi, edi
je 0x58aefe
call esi
mov dword [edi], eax
call esi
push eax
push str.Filed_to_Create_Process__d
push str.EFRUtils::CreateNewProcess
push 1
call fcn.00587c13
add esp, 0x10
jmp 0x58af48
cmp byte [ebp + 0x10], 0
je 0x58af36
push 0xffffffffffffffff
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test edi, edi
je 0x58af36
push edi
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x4c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x50]
call esi
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00434c40
mov al, bl
call fcn.005b21e1
ret

Function at 0x58afb4
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
mov dword [ebp - 0xc], ebx
cmp dword [eax + 0x14], 8
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
jb 0x58afd1
mov eax, dword [eax]
push 0xf003f
push eax
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0xc]
call fcn.004b19b0
test eax, eax
jne 0x58b004
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x14], 8
jb 0x58aff3
mov eax, dword [eax]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
neg eax
sbb al, al
lea ebx, [eax + 1]
lea ecx, [ebp - 0xc]
call fcn.004b1a60
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x58c407
Capabilities:
Query environment variable

Disassembly:
push 0xc
mov eax, 0x61ea3a
call fcn.005b2203
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
push 0x209
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], ebx
call fcn.005962a2
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 0x18]
sub eax, edi
sar eax, 1
cmp dword [esi + 0x14], 8
jb 0x58c445
mov ecx, dword [esi]
jmp 0x58c447
mov ecx, esi
push eax
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x58c4c5
cmp eax, 0x208
jbe 0x58c4a5
inc eax
lea ecx, [ebp - 0x18]
push eax
call fcn.005962a2
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
sub eax, edi
sar eax, 1
cmp dword [esi + 0x14], 8
jb 0x58c479
mov ecx, dword [esi]
jmp 0x58c47b
mov ecx, esi
push eax
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x58c4a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Could_not_ExpandEnvironmentPath__error__u_
push str.EFRUtils::ExpandEnvironmentPath
push 1
call fcn.00587c13
add esp, 0x10
jmp 0x58c4c5
cmp dword [esi + 0x14], 8
jb 0x58c4ad
mov esi, dword [esi]
push esi
push edi
call fcn.005e4d3c
pop ecx
pop ecx
test eax, eax
je 0x58c4c5
mov ecx, dword [ebp + 0xc]
push edi
call fcn.00434220
mov bl, 1
lea ecx, [ebp - 0x18]
call fcn.0044b070
mov al, bl
call fcn.005b21cc
ret

Function at 0x58d42c
Capabilities:
Create directory

Disassembly:
push 0x38
mov eax, 0x61e045
call fcn.005b2237
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x44], ebx
cmp dword [0x6ba1a0], ebx
je 0x58d459
push 0x6ba190
mov ecx, edi
call fcn.00434e80
jmp 0x58d51b
push ebx
xor eax, eax
mov dword [ebp - 0x2c], 7
push 0x63f3e0
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], ebx
mov word [ebp - 0x40], ax
call fcn.004346a0
lea eax, [ebp - 0x40]
mov dword [ebp - 4], ebx
push eax
call fcn.0058d837
pop ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.00434e80
push ebx
push 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.00434c40
mov ebx, 0x63f3c0
push ebx
call fcn.005e4cfb
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x28]
call fcn.0041d8c0
mov ebx, str.AmsiScripts
mov esi, eax
push ebx
call fcn.005e4cfb
pop ecx
push eax
push ebx
mov ecx, esi
call fcn.0041d8c0
mov ebx, 0x63f3c0
mov esi, eax
push ebx
call fcn.005e4cfb
pop ecx
push eax
push ebx
mov ecx, esi
call fcn.0041d8c0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.005dcfe0
pop ecx
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x28]
mov ecx, 0x6ba190
push eax
call fcn.00434d60
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
call fcn.004344c0
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00434c40
mov eax, edi
call fcn.005b21e1
ret
Function at 0x58d523
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
push 0xc4
mov eax, 0x61e075
call fcn.005b2237
xor ebx, ebx
mov dword [ebp - 0xd0], ebx
mov dword [ebp - 0xcc], ebx
mov dword [ebp - 0xc8], ebx
mov edi, 0x100000
mov dword [ebp - 4], ebx
push edi
lea ecx, [ebp - 0xd0]
call fcn.004e5ac0
mov esi, dword [ebp - 0xd0]
push ebx
push edi
push esi
push 5
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
jns 0x58d5a2
xorps xmm0, xmm0
movlpd qword [ebp - 0xc4], xmm0
mov esi, dword [ebp - 0xc4]
mov edi, dword [ebp - 0xc0]
lea ecx, [ebp - 0xd0]
call fcn.004e59f0
mov eax, esi
mov edx, edi
call fcn.005b21e1
ret
cmp dword [esi + 0x44], 4
je 0x58d5a8
add esi, dword [esi]
cmp dword [esi], ebx
jne 0x58d59a
jmp 0x58d56e
mov edi, dword [esi + 0x20]
lea eax, [ebp - 0xbc]
mov esi, dword [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
sub edi, 0xd53e8000
push ebx
push 0x2710
sbb esi, 0x19db1de
push esi
push edi
call fcn.005b22e0
mov esi, eax
mov edi, edx
jmp 0x58d585

Function at 0x58da26
Capabilities:
Get hostname

Disassembly:
push 0x30
mov eax, 0x61e115
call fcn.005b2237
mov eax, dword fs:[0x2c]
xor ebx, ebx
mov ecx, dword [0x6c7adc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x3c], ebx
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x6c7150]
cmp eax, dword [ecx + 4]
jle 0x58da7d
mov edi, 0x6c7150
push edi
call fcn.005b1800
cmp dword [0x6c7150], 0xffffffff
pop ecx
jne 0x58da7d
push 0x6250c8
call fcn.005b1b57
push edi
call fcn.005b17c1
pop ecx
pop ecx
cmp byte [0x6c7154], bl
jne 0x58db02
mov edi, dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
lea eax, [ebp - 0x2c]
push eax
push ebx
push 2
mov dword [ebp - 0x2c], ebx
call edi
cmp dword [ebp - 0x2c], 1
jbe 0x58db02
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x38]
call fcn.00589d21
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], ebx
push eax
push dword [ebp - 0x38]
push 2
call edi
test eax, eax
je 0x58daf6
push dword [ebp - 0x38]
lea ecx, [ebp - 0x28]
call fcn.004347d0
mov edi, 0x6ba1d8
push eax
mov ecx, edi
call fcn.0041aab0
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.00434c40
push edi
mov ecx, esi
mov byte [0x6c7154], 1
call fcn.00434e80
lea ecx, [ebp - 0x38]
call fcn.0044b070
jmp 0x58db0e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.0044b070
push 0x6ba1d8
mov ecx, esi
call fcn.00434e80
mov eax, esi
call fcn.005b21e1
ret
Function at 0x58e20f
Capabilities:
Create directory

Disassembly:
push 0x34
mov eax, 0x61e29f
call fcn.005b2237
mov eax, dword fs:[0x2c]
mov ecx, dword [0x6c7adc]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x6c7168]
cmp eax, dword [ecx + 4]
jle 0x58e25e
mov esi, 0x6c7168
push esi
call fcn.005b1800
cmp dword [0x6c7168], 0xffffffff
pop ecx
jne 0x58e25e
push 0x6250b9
call fcn.005b1b57
push esi
call fcn.005b17c1
pop ecx
pop ecx
cmp dword [0x6ba264], 0
je 0x58e271
mov eax, 0x6ba254
jmp 0x58e2fe
xor edi, edi
mov dword [ebp - 0x2c], 7
push edi
xor eax, eax
mov dword [ebp - 0x30], edi
push 0x63f3e0
lea ecx, [ebp - 0x40]
mov word [ebp - 0x40], ax
call fcn.004346a0
lea eax, [ebp - 0x40]
mov dword [ebp - 4], edi
push eax
call fcn.0058d837
pop ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.00434e80
push edi
push 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.00434c40
mov esi, str.Events
push esi
call fcn.005e4cfb
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.0041d8c0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.005dcfe0
pop ecx
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x28]
mov esi, 0x6ba254
push eax
mov ecx, esi
call fcn.00434d60
push edi
push 1
lea ecx, [ebp - 0x28]
call fcn.00434c40
mov eax, esi
call fcn.005b21e1
ret
Function at 0x58e304
Capabilities:
Get file version info

Disassembly:
push 0x98
mov eax, 0x61e2cf
call fcn.005b2237
mov esi, dword [ebp + 8]
xor ebx, ebx
mov edi, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0x78], 7
mov dword [ebp - 0x7c], ebx
mov word [ebp - 0x8c], ax
cmp dword [edi + 0x14], 8
mov dword [ebp - 4], ebx
jb 0x58e341
mov eax, dword [edi]
jmp 0x58e343
mov eax, edi
push ebx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x98], eax
test eax, eax
jne 0x58e368
lea eax, [ebp - 0x8c]
mov ecx, esi
push eax
call fcn.004344c0
push ebx
jmp 0x58e471
push eax
call fcn.005b1ceb
cmp dword [edi + 0x14], 8
mov ebx, eax
pop ecx
jb 0x58e379
mov edi, dword [edi]
push ebx
push dword [ebp - 0x98]
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x58e3a8
push ebx
call fcn.005b1ce6
pop ecx
lea eax, [ebp - 0x8c]
mov ecx, esi
push eax
call fcn.004344c0
push 0
jmp 0x58e471
lea eax, [ebp - 0x90]
xor edi, edi
push eax
lea eax, [ebp - 0x9c]
mov dword [ebp - 0x90], edi
push eax
push str.VarFileInfoTranslation
push ebx
call sub.VERSION.dll_VerQueryValueW
cmp dword [ebp - 0x90], edi
jne 0x58e3ec
push ebx
call fcn.005b1ce6
pop ecx
lea eax, [ebp - 0x8c]
mov ecx, esi
push eax
call fcn.004344c0
push edi
jmp 0x58e471
mov ecx, dword [ebp - 0x9c]
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
push str.StringFileInfo_04x_04xFileDescription
lea eax, [ebp - 0x74]
push 0x32
push eax
call fcn.00544920
add esp, 0x14
test eax, eax
js 0x58e3d1
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], edi
push eax
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x74]
push eax
push ebx
call sub.VERSION.dll_VerQueryValueW
cmp dword [ebp - 0x94], edi
je 0x58e3d1
mov edi, dword [ebp - 0xa0]
xor eax, eax
cmp word [edi], ax
je 0x58e44c
push edi
call fcn.005e4cfb
pop ecx
push eax
push edi
lea ecx, [ebp - 0x8c]
call fcn.004346a0
push ebx
call fcn.005b1ce6
pop ecx
lea eax, [ebp - 0x8c]
mov ecx, esi
push eax
call fcn.004344c0
xor eax, eax
push eax
push 1
lea ecx, [ebp - 0x8c]
call fcn.00434c40
mov eax, esi
call fcn.005b21e1
ret
Function at 0x58e531
Capabilities:
Enumerate files on windows

Disassembly:
push 0x2ac
mov eax, 0x61e360
call fcn.005b2237
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x28]
mov esi, dword [ebp + 8]
xor ebx, ebx
mov edi, dword [ebp + 0x10]
push eax
mov dword [ebp - 0x2b8], ebx
call fcn.00434e80
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
jne 0x58e580
lea eax, [ebp - 0x40]
push eax
call fcn.0058d6c1
pop ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.0041aab0
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.00434c40
lea eax, [ebp - 0x28]
push eax
call fcn.0058a680
push edi
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00423fa0
add esp, 0x10
cmp dword [eax + 0x14], 8
jb 0x58e5a2
mov eax, dword [eax]
lea ecx, [ebp - 0x2a8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push ebx
push 1
lea ecx, [ebp - 0x58]
mov edi, eax
call fcn.00434c40
mov dword [ebp - 0x2b4], ebx
mov dword [ebp - 0x2b0], ebx
mov dword [ebp - 0x2ac], ebx
mov byte [ebp - 4], 1
cmp edi, 0xffffffff
jne 0x58e5f7
lea eax, [ebp - 0x2b4]
mov ecx, esi
push eax
call fcn.00589cf1
lea ecx, [ebp - 0x2b4]
call fcn.004ddb40
push ebx
jmp 0x58e6a3
mov bl, byte [ebp + 0x14]
mov eax, dword [ebp - 0x2a8]
and eax, 0x10
je 0x58e609
test bl, bl
je 0x58e66b
test eax, eax
jne 0x58e611
test bl, bl
jne 0x58e66b
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.004658e0
add esp, 0xc
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 2
cmovae eax, dword [ebp - 0x40]
push eax
push 0x104
lea eax, [ebp - 0x27c]
push eax
call fcn.00592e10
lea eax, [ebp - 0x2a8]
push eax
lea ecx, [ebp - 0x2b4]
call fcn.00596000
push 0
push 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.00434c40
lea eax, [ebp - 0x2a8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x58e5fa
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x2b4]
mov ecx, esi
push eax
call fcn.00589cf1
lea ecx, [ebp - 0x2b4]
call fcn.004ddb40
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00434c40
mov eax, esi
call fcn.005b21e1
ret
Function at 0x58ea3d
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push 0xab8
mov eax, 0x61e430
call fcn.005b2237
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x63f3e0
mov ecx, edi
mov dword [ebp - 4], ebx
mov dword [ebp - 0xac4], edi
mov dword [ebp - 0xac0], ebx
call fcn.004347d0
lea eax, [ebp - 0xab8]
mov dword [ebp - 4], ebx
push eax
push 0x202
mov dword [ebp - 0xac0], 1
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x58eb40
push 0x100
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x58eb3a
lea eax, [ebp - 0xabc]
push eax
push ebx
push ebx
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x58eb3a
mov esi, dword [ebp - 0xabc]
test esi, esi
je 0x58eb33
mov eax, dword [esi + 4]
dec eax
sub eax, 1
jne 0x58eb16
mov eax, dword [esi + 0x18]
lea ecx, [ebp - 0x910]
push 0x400
push ecx
add eax, 4
push eax
push 2
call sub.WS2_32.dll_InetNtopW
push eax
lea ecx, [ebp - 0x928]
call fcn.004347d0
push eax
mov ecx, edi
call fcn.0041aab0
push ebx
push 1
lea ecx, [ebp - 0x928]
call fcn.00434c40
push 0x63f3e0
mov ecx, edi
call fcn.0041a910
test eax, eax
jne 0x58eb2d
mov esi, dword [esi + 0x1c]
test esi, esi
jne 0x58ead1
mov esi, dword [ebp - 0xabc]
push esi
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, edi
call fcn.005b21e1
ret
Function at 0x58f2e9
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6ba394]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x6c7adc]
push esi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x6c7130]
cmp eax, dword [ecx + 4]
jg 0x58f381
cmp dword [0x6ba1b8], 0
mov esi, 0x6ba1a8
jne 0x58f370
push edi
xor eax, eax
mov dword [ebp - 0x28], 0x10
push 7
mov word [ebp - 0x24], ax
lea edi, [ebp - 0x22]
pop ecx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
pop edi
test eax, eax
je 0x58f370
cmp word [ebp - 0x24], 0
jne 0x58f35a
xor eax, eax
jmp 0x58f364
lea eax, [ebp - 0x24]
push eax
call fcn.005e4cfb
pop ecx
push eax
lea ecx, [ebp - 0x24]
push ecx
mov ecx, esi
call fcn.004346a0
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.005b168a
mov esp, ebp
pop ebp
ret
mov esi, 0x6c7130
push esi
call fcn.005b1800
cmp dword [0x6c7130], 0xffffffff
pop ecx
jne 0x58f316
push 0x62512c
call fcn.005b1b57
push esi
call fcn.005b17c1
pop ecx
pop ecx
jmp 0x58f316
Function at 0x58fc28
Capabilities:
Enumerate processes

Disassembly:
push 0x284
mov eax, 0x61e653
call fcn.005b2237
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [ebp + 8]
push ebx
push 2
mov dword [ebp - 0x284], esi
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x288], ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x58fc81
push str.CreateToolhelp32Snapshot__of_processes_
push str.EFRUtils::GetSnapshotProcChildList
push 1
call fcn.00587c13
add esp, 0xc
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
jmp 0x58fe15
lea eax, [ebp - 0x26c]
mov dword [ebp - 0x26c], 0x22c
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x58fcb9
push str.Process32First_failed
push str.EFRUtils::GetSnapshotProcChildList
push 1
call fcn.00587c13
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x58fc74
xor eax, eax
mov dword [ebp - 0x280], eax
mov dword [ebp - 0x27c], eax
mov dword [ebp - 0x278], eax
mov esi, dword [ebp - 0x270]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x264]
cmp dword [esi], ecx
jne 0x58fd00
lea eax, [ebp - 0x248]
push eax
lea ecx, [esi + 0x18]
call fcn.0041a910
mov ecx, dword [ebp - 0x264]
test eax, eax
push 1
movzx ebx, bl
pop eax
cmove ebx, eax
mov eax, dword [esi]
cmp eax, dword [ebp - 0x254]
jne 0x58fdca
lea eax, [ebp - 0x290]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0x274]
movlpd qword [ebp - 0x274], xmm0
push eax
push ecx
call fcn.0058f707
add esp, 0xc
test al, al
je 0x58fdca
and dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
inc eax
xorps xmm0, xmm0
cmp word [ebp - 0x248], 0
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x264]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x274]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x270]
mov dword [ebp - 0x34], eax
movlpd qword [ebp - 0x30], xmm0
jne 0x58fd7e
xor eax, eax
jmp 0x58fd8b
lea eax, [ebp - 0x248]
push eax
call fcn.005e4cfb
pop ecx
push eax
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x28]
call fcn.004346a0
cmp dword [ebp - 0x40], 0
je 0x58fdb8
mov eax, dword [ebp - 0x38]
or eax, dword [ebp - 0x34]
je 0x58fdb8
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x280]
call fcn.00595f22
xor eax, eax
mov byte [ebp - 4], 0
push 0
inc eax
lea ecx, [ebp - 0x28]
push eax
call fcn.00434c40
lea eax, [ebp - 0x26c]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x58fcd6
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x284]
test bl, bl
jne 0x58fdfc
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
jmp 0x58fe0a
lea eax, [ebp - 0x280]
mov ecx, esi
push eax
call fcn.00589cf1
lea ecx, [ebp - 0x280]
call fcn.0041a880
mov eax, esi
call fcn.005b21e1
ret

Function at 0x5909a7
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x5909b5
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x5909c5
xor al, al
pop ebp
ret
shr eax, 4
and eax, 1
pop ebp
ret
Function at 0x590d4b
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x6ba394]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push ebx
push 2
mov dword [ebp - 0x230], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
cmp eax, 1
jne 0x590db6
jmp 0x590da0
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.0041a910
test eax, eax
je 0x590db4
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
je 0x590d8e
jmp 0x590db6
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005b168a
mov esp, ebp
pop ebp
ret

Function at 0x591101
Capabilities:
Get user security identifier

Disassembly:
push 0xd8
mov eax, 0x61e846
call fcn.005b2237
mov esi, ecx
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0xe4], eax
call fcn.0058a711
test edi, edi
je 0x59126e
and dword [ebp - 0xd8], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0xd8]
push 0x80
call fcn.0058a4cb
mov ebx, dword [ebp - 0xd8]
lea eax, [esi + 0x4c]
push eax
lea eax, [ebp - 0xdc]
mov dword [ebp - 0xe0], 0x44
push eax
push ebx
lea eax, [ebp - 0xe0]
mov dword [ebp - 0xdc], 0x80
push eax
lea eax, [ebp - 0x54]
push eax
push edi
push dword [ebp - 0xe4]
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x5911f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x59124e
cmp dword [ebp - 0xe0], 0x44
jbe 0x5911aa
push 0x80004005
call fcn.0046c2f0
cmp dword [ebp - 0xdc], 0x80
jbe 0x5911cd
push dword [ebp - 0xdc]
lea ecx, [ebp - 0xd8]
call fcn.00591b8c
mov ebx, dword [ebp - 0xd8]
lea eax, [esi + 0x4c]
push eax
lea eax, [ebp - 0xdc]
push eax
push ebx
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebp - 0x54]
push eax
push edi
push dword [ebp - 0xe4]
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x59124e
lea eax, [ebp - 0x54]
mov byte [esi + 0x48], 1
push eax
lea eax, [esi + 4]
push eax
push dword [ebp - 0xe0]
call dword [sym.imp.ADVAPI32.dll_CopySid]
test eax, eax
je 0x59124e
push ebx
lea ecx, [esi + 0x54]
call fcn.0059252a
push edi
lea ecx, [esi + 0x50]
call fcn.0059252a
push dword [ebp - 0xe4]
lea ecx, [esi + 0x5c]
call fcn.0059252a
lea ecx, [ebp - 0xd4]
cmp dword [ebp - 0xd8], ecx
je 0x59124a
lea ecx, [ebp - 0xd8]
call fcn.0058c61e
mov al, 1
jmp 0x591270
mov ecx, esi
call fcn.0058a711
lea eax, [ebp - 0xd4]
cmp dword [ebp - 0xd8], eax
je 0x59126e
lea ecx, [ebp - 0xd8]
call fcn.0058c61e
xor al, al
call fcn.005b21e1
ret 8