joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b03f4
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4b03fd
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004050c0
mov eax, dword [ebp - 8]
call fcn.004050c0
xor eax, eax
push ebp
push 0x4b05b5
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 1
mov eax, dword [ebp - 4]
call fcn.00409df8
test al, al
jne 0x4b0471
mov eax, dword [ebp - 8]
call fcn.00409df8
test al, al
je 0x4b0468
push 0
mov eax, dword [ebp - 4]
call fcn.004050d0
push eax
mov eax, dword [ebp - 8]
call fcn.004050d0
push eax
call sub.kernel32.dll_CopyFileA
jmp 0x4b0471
mov byte [ebp - 0xd], 0
jmp 0x4b058d
mov dl, 1
mov eax, dword [0x41aff4]
call fcn.00403d10
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4b0586
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x68]
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x4b04d4
inc esi
xor ebx, ebx
lea ecx, [ebp - 0x1c]
mov edx, ebx
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.004aec1c
mov ecx, dword [ebp - 0x18]
mov edx, ebx
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0x20]
inc ebx
dec esi
jne 0x4b04ab
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edx, dword [ebp - 0x20]
mov eax, 0x4b05d0
call fcn.0040521c
dec eax
je 0x4b055a
mov eax, dword [ebp - 8]
call fcn.00409df8
test al, al
je 0x4b055a
push 0
mov eax, dword [ebp - 4]
call fcn.004050d0
push eax
mov eax, dword [ebp - 8]
call fcn.004050d0
push eax
call sub.kernel32.dll_CopyFileA
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x68]
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x4b055a
inc esi
xor ebx, ebx
lea ecx, [ebp - 0x28]
mov edx, ebx
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.004aec1c
mov ecx, dword [ebp - 0x24]
mov edx, ebx
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0x20]
inc ebx
dec esi
jne 0x4b0531
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0xc]
call fcn.00404c94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b058d
mov eax, dword [ebp - 0x14]
call fcn.00403d40
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b05bc
lea eax, [ebp - 0x2c]
mov edx, 6
call fcn.00404c64
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404c64
ret
Function at 0x4b077c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef4
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.00404eb0
mov eax, dword [ebx]
mov dword [esp + 0x108], eax
mov eax, dword [esp + 0x108]
test eax, eax
je 0x4b07bb
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
je 0x4b07d0
mov eax, ebx
mov edx, 0x4b07e0
call fcn.00404f0c
add esp, 0x10c
pop ebx
ret

Function at 0x4b366c
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4b369a
mov eax, ebx
call fcn.004b4120
cmp dword [ebx + 0x40], 0
je 0x4b3693
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4b370b
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4b36fd
cmp dword [ebx + 8], 0
je 0x4b36bc
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4b36ce
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4b36fd
cmp dword [ebx + 8], 0
je 0x4b36af
cmp eax, 3
je 0x4b36e1
dec eax
jne 0x4b36af
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4b36af
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4b36af
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4b3729
cmp dword [ebx + 0x14], 0xcc
je 0x4b3729
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004b3734
pop ebx
ret

Function at 0x4c49d4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004050c0
xor eax, eax
push ebp
push 0x4c4aab
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x209]
mov edx, dword [ebp - 4]
call fcn.0040a314
lea eax, [ebp - 0x250]
xor ecx, ecx
mov edx, 0x44
call fcn.00403660
mov dword [ebp - 0x250], 0x44
mov dword [ebp - 0x224], 1
mov word [ebp - 0x220], 0
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x250]
push eax
push 0
push 0
push 0x30
push 0xffffffffffffffff
push 0
push 0
lea eax, [ebp - 0x209]
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x4c4a95
push 0xffffffffffffffff
mov eax, dword [ebp - 0x260]
push eax
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x260]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x260]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x25c]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c4ab2
lea eax, [ebp - 4]
call fcn.00404c40
ret
Function at 0x4c4d24
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004050c0
mov eax, dword [ebp - 8]
call fcn.004050c0
xor eax, eax
push ebp
push 0x4c4e5d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4277c8]
call fcn.004278c8
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x4c4e3b
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0x10]
call fcn.00427968
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.00427af0
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.004050d0
mov ebx, eax
push ebx
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov edx, dword [ebp - 0x18]
dec edx
lea eax, [ebp - 0xc]
call fcn.00405360
cmp dword [ebp - 0x18], 1
jbe 0x4c4de2
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push ebx
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4c4dee
sub eax, 4
mov eax, dword [eax]
mov esi, eax
test esi, esi
jle 0x4c4e1b
mov ebx, 1
mov eax, dword [ebp - 0xc]
cmp byte [eax + ebx - 1], 0
jne 0x4c4e17
lea eax, [ebp - 0xc]
push eax
mov ecx, ebx
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00405138
inc ebx
dec esi
jne 0x4c4df9
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00404c94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c4e42
mov eax, dword [ebp - 0x10]
call fcn.00403d40
ret
Function at 0x4c50cc
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
call fcn.004050c0
xor eax, eax
push ebp
push 0x4c52ce
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push dword [ebp + 0xc]
push 0x4c52e8
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404fd4
mov dl, 1
mov eax, dword [0x4277c8]
call fcn.004278c8
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4c529c
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.00427968
test esi, esi
je 0x4c519e
push esi
lea eax, [ebp - 0x18]
push eax
call fcn.004c4e6c
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 0x4c52f4
call fcn.00404f58
mov edx, dword [ebp - 0x14]
mov cl, 1
mov eax, dword [ebp - 8]
call fcn.004279cc
mov edx, 0x4c5344
mov eax, dword [ebp - 8]
call fcn.00427cc0
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4c5179
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
push ebx
mov eax, dword [ebp - 4]
call fcn.004050d0
push eax
push 7
push 0
push 0x4c5354
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
jmp 0x4c527e
mov dl, 1
mov eax, dword [0x41aff4]
call fcn.00403d10
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4c5277
push dword fs:[eax]
mov dword fs:[eax], esp
mov cl, 1
mov edx, 0x4c536c
mov eax, dword [ebp - 8]
call fcn.004279cc
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00427d48
mov eax, dword [ebp - 8]
call fcn.00427938
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4c5261
inc eax
mov dword [ebp - 0x10], eax
xor esi, esi
lea ecx, [ebp - 0x20]
mov edx, esi
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x20]
mov edx, 0x4c536c
lea eax, [ebp - 0x1c]
call fcn.00404f58
mov edx, dword [ebp - 0x1c]
mov cl, 1
mov eax, dword [ebp - 8]
call fcn.004279cc
mov edx, 0x4c5344
mov eax, dword [ebp - 8]
call fcn.00427cc0
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4c5233
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
push ebx
mov eax, dword [ebp - 4]
call fcn.004050d0
push eax
push 7
push 0
push 0x4c5354
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [ebp - 8]
call fcn.00427938
inc esi
dec dword [ebp - 0x10]
jne 0x4c51f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c527e
mov eax, dword [ebp - 0xc]
call fcn.00403d40
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c52a3
mov eax, dword [ebp - 8]
call fcn.00427938
mov eax, dword [ebp - 8]
call fcn.00403d40
ret
Function at 0x4c55a8
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
call fcn.004050c0
xor eax, eax
push ebp
push 0x4c57a2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push dword [ebp + 0xc]
push 0x4c57bc
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404fd4
mov dl, 1
mov eax, dword [0x4277c8]
call fcn.004278c8
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4c5770
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.00427968
test esi, esi
je 0x4c567a
push esi
lea eax, [ebp - 0x18]
push eax
call fcn.004c4e6c
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 0x4c57c8
call fcn.00404f58
mov edx, dword [ebp - 0x14]
mov cl, 1
mov eax, dword [ebp - 8]
call fcn.004279cc
mov edx, 0x4c5810
mov eax, dword [ebp - 8]
call fcn.00427cc0
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4c5655
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
push ebx
mov eax, dword [ebp - 4]
call fcn.004050d0
push eax
push 7
push 0
push 0x4c5820
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
jmp 0x4c575a
mov dl, 1
mov eax, dword [0x41aff4]
call fcn.00403d10
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4c5753
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x4c57c8
mov cl, 1
mov eax, dword [ebp - 8]
call fcn.004279cc
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00427d48
mov eax, dword [ebp - 8]
call fcn.00427938
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4c573d
inc eax
mov dword [ebp - 0x10], eax
xor esi, esi
lea ecx, [ebp - 0x20]
mov edx, esi
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 0x4c57c8
call fcn.00404f58
mov edx, dword [ebp - 0x1c]
mov cl, 1
mov eax, dword [ebp - 8]
call fcn.004279cc
mov edx, 0x4c5810
mov eax, dword [ebp - 8]
call fcn.00427cc0
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4c570f
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
push ebx
mov eax, dword [ebp - 4]
call fcn.004050d0
push eax
push 7
push 0
push 0x4c5820
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [ebp - 8]
call fcn.00427938
inc esi
dec dword [ebp - 0x10]
jne 0x4c56cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c575a
mov eax, dword [ebp - 0xc]
call fcn.00403d40
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c5777
mov eax, dword [ebp - 8]
call fcn.00403d40
ret
Function at 0x4c5f34
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffebc
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x134], eax
mov eax, dword [ebp + 8]
call fcn.004050c0
xor eax, eax
push ebp
push 0x4c60b6
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor edx, edx
mov eax, 2
call fcn.004744bc
mov esi, eax
mov dword [ebp - 0x128], 0x128
lea edx, [ebp - 0x128]
mov eax, esi
call fcn.004744dc
mov edi, eax
jmp 0x4c6082
lea eax, [ebp - 0x134]
lea edx, [ebp - 0x104]
mov ecx, 0x104
call fcn.00404eb0
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.0040a108
mov eax, dword [ebp - 0x130]
lea edx, [ebp - 0x12c]
call fcn.004091e8
mov eax, dword [ebp - 0x12c]
push eax
lea edx, [ebp - 0x138]
mov eax, dword [ebp + 8]
call fcn.004091e8
mov edx, dword [ebp - 0x138]
pop eax
call fcn.00405068
je 0x4c6055
lea eax, [ebp - 0x140]
lea edx, [ebp - 0x104]
mov ecx, 0x104
call fcn.00404eb0
mov eax, dword [ebp - 0x140]
lea edx, [ebp - 0x13c]
call fcn.004091e8
mov eax, dword [ebp - 0x13c]
push eax
lea edx, [ebp - 0x144]
mov eax, dword [ebp + 8]
call fcn.004091e8
mov edx, dword [ebp - 0x144]
pop eax
call fcn.00405068
jne 0x4c6073
push 0
mov eax, dword [ebp - 0x120]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb ebx, ebx
inc ebx
lea edx, [ebp - 0x128]
mov eax, esi
call fcn.004744fc
mov edi, eax
test edi, edi
jne 0x4c5fb0
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c60bd
lea eax, [ebp - 0x144]
mov edx, 7
call fcn.00404c64
lea eax, [ebp + 8]
call fcn.00404c40
ret

Function at 0x4c61e8
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffdc
call sub.kernel32.dll_GetCurrentProcess
push esp
push 0x28
push eax
call sub.advapi32.dll_OpenProcessToken
lea eax, [esp + 8]
push eax
push 0x4c6260
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [esp + 0x10], 2
mov dword [esp + 0x14], 1
mov eax, dword [esp + 8]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp + 4], eax
lea eax, [esp + 4]
push eax
push 0
push 0x10
lea eax, [esp + 0x20]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
push 0
push 0xc
call sub.user32.dll_ExitWindowsEx
add esp, 0x24
ret
Function at 0x4c6274
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov eax, dword [ebp + 8]
call fcn.004050c0
mov eax, dword [ebp + 0xc]
call fcn.004050c0
xor eax, eax
push ebp
push 0x4c631a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
lea eax, [ebp - 0x14]
push eax
push 0x4c6328
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
test eax, eax
je 0x4c62e2
mov dword [ebp - 0xc], 2
mov dword [ebp - 0x18], 1
lea eax, [ebp - 4]
push eax
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xf
mov eax, dword [ebp + 0xc]
call fcn.004050d0
push eax
mov eax, dword [ebp + 8]
call fcn.004050d0
push eax
call sub.advapi32.dll_InitiateSystemShutdownA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c6321
lea eax, [ebp + 8]
mov edx, 2
call fcn.00404c64
ret

Function at 0x4c6a20
Capabilities:
List user accounts

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4c6b35
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 1
xor edx, edx
push ebp
push 0x4c6afb
push dword fs:[edx]
mov dword fs:[edx], esp
xor ebx, ebx
mov eax, ebx
add eax, eax
inc eax
call fcn.00402f4c
mov dword [ebp - 0x24], eax
lea ecx, [ebx + 1]
mov edx, dword [ebp - 0x24]
xor eax, eax
call fcn.00405c94
or ebx, 0xffffffff
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
lea eax, [ebp - 0x14]
push eax
push 2
push 0xa
mov eax, dword [ebp - 0x24]
push eax
call sub.netapi32.dll_NetUserEnum
test eax, eax
jne 0x4c6af1
mov ebx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
dec edi
test edi, edi
jl 0x4c6af1
inc edi
lea eax, [ebp - 4]
mov esi, ebx
mov edx, dword [esi]
call fcn.00404e68
lea eax, [ebp - 8]
mov edx, dword [esi + 0xc]
call fcn.00404e68
lea eax, [ebp - 0xc]
mov edx, dword [esi + 4]
call fcn.00404e68
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [0x4ef268]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
mov edx, 0x4c6b50
call fcn.004d7798
add ebx, 0x10
dec edi
jne 0x4c6ab0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c6b12
mov eax, dword [ebp - 0x24]
call fcn.00402f68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c6b3c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404c64
ret
Function at 0x4c6b58
Capabilities:
Add user account
Add user account to group

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebp, edx
mov esi, eax
mov bl, 1
mov eax, 0x20
call fcn.00402f4c
mov edi, eax
mov eax, edi
mov dword [eax], esi
mov dword [eax + 4], ebp
xor edx, edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], 1
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
mov dword [eax + 0x18], 1
xor edx, edx
mov dword [eax + 0x1c], edx
push 0
push edi
push 1
push 0
call sub.netapi32.dll_NetUserAdd
test eax, eax
je 0x4c6bb3
xor ebx, ebx
mov eax, edi
call fcn.00402f68
jmp 0x4c6bd2
mov eax, edi
call fcn.00402f68
mov dword [esp], esi
push 1
lea eax, [esp + 4]
push eax
push 3
push 0x4c6bdc
push 0
call sub.netapi32.dll_NetLocalGroupAddMembers
mov eax, ebx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4c6bfc
Capabilities:
Delete user account

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, 1
push esi
push 0
call sub.netapi32.dll_NetUserDel
test eax, eax
je 0x4c6c10
xor ebx, ebx
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x4c6d74
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
add eax, 0xc
mov eax, dword [eax]
mov dword [edx + 0xc], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0xc]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
movzx ebx, cl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
movzx ebx, bl
mov esi, dword [ebx*4 + str.cwko0]
mov ebx, ecx
shr ebx, 0x10
movzx ebx, bl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 8], ebx
shr ecx, 0x18
movzx ecx, cl
mov ecx, dword [ecx*4 + str.cwko0]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x4ee59c]
mov dword [edx + eax*4 + 0x10], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x14], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x18], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x1c], ecx
add eax, 4
cmp eax, 0x28
jl 0x4c6d9f
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x4d14bc
Capabilities:
Link many functions at runtime

Disassembly:
cmp dword [0x4eee30], 0
jne 0x4d15a9
cmp dword [0x4eee2c], 0
jne 0x4d15a9
mov eax, dword [0x4ef700]
cmp dword [eax], 2
jne 0x4d1552
push 0x4d15b0
call sub.kernel32.dll_LoadLibraryA
mov dword [0x4eee2c], eax
cmp dword [0x4eee2c], 0
jbe 0x4d15a9
push 0x4d15c0
mov eax, dword [0x4eee2c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4f737c], eax
push 0x4d15cc
mov eax, dword [0x4eee2c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4f7384], eax
push 0x4d15d8
mov eax, dword [0x4eee2c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4f738c], eax
push 0x4d15e8
mov eax, dword [0x4eee2c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4f7390], eax
jmp 0x4d15a9
push 0x4d15fc
call sub.kernel32.dll_LoadLibraryA
mov dword [0x4eee2c], eax
cmp dword [0x4eee2c], 0
jbe 0x4d15a9
push 0x4d15c0
mov eax, dword [0x4eee2c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4f7378], eax
push 0x4d15cc
mov eax, dword [0x4eee2c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4f7380], eax
push 0x4d15d8
mov eax, dword [0x4eee2c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4f7388], eax
inc dword [0x4eee30]
ret

Function at 0x4d1a20
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4d1ad3
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4d1ab6
push dword fs:[edx]
mov dword fs:[edx], esp
xor esi, esi
lea ebx, [esi + 0x41]
lea eax, [ebp - 0xc]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x10]
call fcn.00403544
mov edx, 0x4d1ae0
lea eax, [ebp - 0x10]
mov cl, 2
call fcn.00403514
lea edx, [ebp - 0x10]
lea eax, [ebp - 4]
call fcn.00404ea4
mov eax, dword [ebp - 4]
call fcn.004050d0
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp ax, 3
jne 0x4d1aa2
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
cmp esi, 0x1a
jne 0x4d1a4e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d1abd
ret