joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42dfc4
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
mov ebx, eax
cmp dword [0x4980dc], 2
je 0x42dfe0
mov byte [ebp - 1], 1
jmp 0x42e1af
mov byte [ebp - 1], 0
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push 0x20
push 2
push 0x498788
call fcn.00405754
test eax, eax
je 0x42e1af
xor eax, eax
push ebp
push 0x42e1a8
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetVersion
and ax, 0xff
cmp ax, 5
jb 0x42e041
push 0x42e1b8
push 0x42e1d0
call sub.kernel32.dll_GetModuleHandleA_1
push eax
call sub.kernel32.dll_GetProcAddress
mov ebx, eax
test ebx, ebx
je 0x42e06a
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
call ebx
test eax, eax
je 0x42e191
mov eax, dword [ebp - 0xc]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 1], al
jmp 0x42e191
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
push 1
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call fcn.0040578c
test eax, eax
jne 0x42e0bb
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x3f0
je 0x42e09c
call fcn.004031bc
jmp 0x42e1af
lea eax, [ebp - 0x10]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call fcn.00405784
test eax, eax
jne 0x42e0bb
call fcn.004031bc
jmp 0x42e1af
xor eax, eax
push ebp
push 0x42e18a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 2
mov eax, dword [ebp - 0x10]
push eax
call fcn.0040576c
test eax, eax
jne 0x42e0fe
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x7a
je 0x42e0fe
call fcn.004031bc
call fcn.004031bc
jmp 0x42e1af
mov eax, dword [ebp - 0x14]
call fcn.00402648
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 2
mov eax, dword [ebp - 0x10]
push eax
call fcn.0040576c
test eax, eax
jne 0x42e130
call fcn.004031bc
call fcn.004031bc
jmp 0x42e1af
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
dec esi
test esi, esi
jl 0x42e16b
inc esi
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 4]
push eax
mov eax, dword [ebp - 8]
push eax
call fcn.0040575c
test eax, eax
je 0x42e167
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 8]
and eax, 0x14
cmp eax, 4
jne 0x42e167
mov byte [ebp - 1], 1
jmp 0x42e16b
inc ebx
dec esi
jne 0x42e13d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42e191
mov eax, dword [ebp - 0x18]
call fcn.00402660
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42e1af
mov eax, dword [ebp - 8]
push eax
call fcn.00405764
ret
mov al, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44ae58
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push ebx
xor ebx, ebx
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x44aea4
cmp dword [ebp - 0x84], 2
jne 0x44aea4
cmp dword [ebp - 0x90], 5
jg 0x44aea2
cmp dword [ebp - 0x90], 5
jne 0x44aea4
cmp dword [ebp - 0x8c], 1
jl 0x44aea4
mov bl, 1
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x450470
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x49a830
mov eax, esi
mov edx, 8
test al, 1
je 0x45048c
shr eax, 1
xor eax, 0xedb88320
jmp 0x45048e
shr eax, 1
dec edx
jne 0x45047f
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x450478
pop esi
ret

Function at 0x4504bb
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [reloc.shell32.dll_SHGetMalloc], 0
jne 0x4504c7
call fcn.00450470
push 1
push 0x49a82c
call sub.kernel32.dll_InterlockedExchange
mov eax, edi
test esi, esi
je 0x4504f2
mov edx, ebx
and dx, 0xff
xor ecx, ecx
mov cl, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x49a830]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x4504cd
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x450ea4
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
ret

Function at 0x451de0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00451d94
test al, al
jne 0x451e01
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x451e4f
xor eax, eax
push ebp
push 0x451e3f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, esi
call fcn.00403738
push eax
call sub.kernel32.dll_CreateDirectoryA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451e46
lea eax, [ebp - 0xc]
call fcn.00451dd0
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x451e58
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00451d94
test al, al
jne 0x451e7c
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x451ee2
xor eax, eax
push ebp
push 0x451ed2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x1c]
push eax
mov eax, dword [ebp + 0x20]
push eax
mov eax, dword [ebp + 0x24]
push eax
push edi
push esi
call sub.kernel32.dll_CreateProcessA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451ed9
lea eax, [ebp - 0xc]
call fcn.00451dd0
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20

Function at 0x451f78
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00451d94
test al, al
jne 0x451f99
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x451fe5
xor eax, eax
push ebp
push 0x451fd5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403738
push eax
call sub.kernel32.dll_DeleteFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451fdc
lea eax, [ebp - 0xc]
call fcn.00451dd0
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x452150
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00451d94
test al, al
jne 0x452173
mov dword [ebp - 4], 0xffffffff
jmp 0x4521bf
xor eax, eax
push ebp
push 0x4521af
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403738
push eax
call sub.kernel32.dll_GetFileAttributesA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4521b6
lea eax, [ebp - 0xc]
call fcn.00451dd0
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4522f0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00451d94
test al, al
jne 0x452314
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x452368
xor eax, eax
push ebp
push 0x452358
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00403738
push eax
mov eax, esi
call fcn.00403738
push eax
call sub.kernel32.dll_MoveFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45235f
lea eax, [ebp - 0xc]
call fcn.00451dd0
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x452374
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 8]
test edi, edi
jne 0x452397
test esi, 4
je 0x452397
xor edi, edi
jmp 0x4523a0
mov eax, edi
call fcn.00403738
mov edi, eax
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.00451d94
test al, al
jne 0x4523b5
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x452404
xor eax, eax
push ebp
push 0x4523f4
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
push edi
mov eax, dword [ebp - 4]
call fcn.00403738
push eax
call sub.kernel32.dll_MoveFileExA
mov dword [ebp - 8], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x14], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4523fb
lea eax, [ebp - 0x10]
call fcn.00451dd0
ret
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x452480
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00451d94
test al, al
jne 0x4524a1
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4524ed
xor eax, eax
push ebp
push 0x4524dd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403738
push eax
call sub.kernel32.dll_RemoveDirectoryA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4524e4
lea eax, [ebp - 0xc]
call fcn.00451dd0
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4524f8
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00451d94
test al, al
jne 0x45251c
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x452569
xor eax, eax
push ebp
push 0x452559
push dword fs:[eax]
mov dword fs:[eax], esp
push edi
mov eax, esi
call fcn.00403738
push eax
call sub.kernel32.dll_SetFileAttributesA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452560
lea eax, [ebp - 0xc]
call fcn.00451dd0
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4547bc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x18]
call fcn.00403728
xor eax, eax
push ebp
push 0x4548a1
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp + 0x18], 0
jne 0x454803
lea edx, [ebp + 0x18]
mov eax, edi
call fcn.0042c870
cmp dword [ebp + 0x18], 0
jne 0x454803
lea eax, [ebp + 0x18]
call fcn.0042d890
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x3c
call fcn.00402934
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x540
test ebx, ebx
je 0x45482e
mov eax, ebx
call fcn.00403738
mov dword [ebp - 0x34], eax
mov eax, edi
call fcn.00403738
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
call fcn.00403738
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x18]
call fcn.00403738
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
push eax
call sub.shell32.dll_ShellExecuteExA
mov ebx, eax
neg ebx
sbb ebx, ebx
neg ebx
test bl, bl
jne 0x454872
call sub.kernel32.dll_GetLastError_1
mov dword [esi], eax
jmp 0x45488b
mov dword [esi], 0x103
mov eax, dword [ebp - 8]
test eax, eax
je 0x45488b
push esi
mov ecx, dword [ebp + 0xc]
mov dl, byte [ebp + 0x14]
call fcn.004544a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4548a8
lea eax, [ebp + 0x18]
call fcn.00403400
ret

Function at 0x454a8c
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffec
mov ebx, eax
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x454aba
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x10
call fcn.0040355c
jmp 0x454ac1
mov eax, ebx
call fcn.00403400
add esp, 0x14
pop ebx
ret
Function at 0x455338
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov edi, ecx
mov esi, edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x455477
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x45548c
push 0x4554a0
call sub.kernel32.dll_GetModuleHandleA_1
push eax
call sub.kernel32.dll_GetProcAddress
mov ebx, eax
lea edx, [ebp - 0xc]
mov al, byte [ebp - 1]
call fcn.00451d94
test al, al
jne 0x45538d
mov byte [ebp - 2], 0
jmp 0x45545c
xor eax, eax
push ebp
push 0x455455
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x4553d1
push 0
mov eax, dword [ebp + 8]
push eax
push edi
lea edx, [ebp - 0x24]
mov eax, esi
call fcn.0042c7d0
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.0042c40c
mov eax, dword [ebp - 0x20]
call fcn.00403738
push eax
call ebx
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 2], al
jmp 0x45543f
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x20]
mov eax, esi
call fcn.0042c7d0
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x24]
call fcn.0042c898
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.0042c40c
mov eax, dword [ebp - 0x20]
call fcn.00403738
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 2], al
cmp byte [ebp - 2], 0
je 0x45543f
mov ecx, edi
mov eax, dword [ebp - 0x14]
imul dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
call fcn.00430a50
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x14]
imul dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.00430a50
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45545c
lea eax, [ebp - 0xc]
call fcn.00451dd0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45547e
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00403420
ret
Function at 0x458264
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
add esp, 0xfffffff4
mov ebx, edx
mov esi, eax
cmp byte [esi + 4], 0
je 0x45833e
mov byte [esi + 5], 1
mov eax, dword [esi + 0x10]
mov dword [esp + 4], eax
mov byte [esp + 8], 0
lea edx, [esp + 4]
xor ecx, ecx
mov eax, 0x45834c
call fcn.00457214
mov eax, dword [esi + 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4582bc
mov eax, 0x458380
call fcn.00457008
push 1
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_TerminateProcess
push 0x2710
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x4582a7
push esp
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
je 0x45830f
cmp dword [esp], 0
jne 0x4582f1
mov eax, 0x4583b0
call fcn.00457008
jmp 0x458319
mov eax, dword [esp]
mov dword [esp + 4], eax
mov byte [esp + 8], 0
lea edx, [esp + 4]
xor ecx, ecx
mov eax, 0x4583d0
call fcn.00457214
jmp 0x458319
mov eax, 0x458408
call fcn.00457008
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [esi + 8], eax
xor eax, eax
mov dword [esi + 0x10], eax
mov byte [esi + 4], 0
test bl, bl
je 0x45833e
push 0xfa
call sub.kernel32.dll_Sleep
add esp, 0xc
pop esi
pop ebx
ret
Function at 0x45843c
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45867e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
inc dword [eax + 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
mov ebx, dword [ebp - 4]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x24], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x28], ecx
xor eax, eax
lea ebx, [eax + 0xc]
add ebx, ecx
xor edx, edx
push ebp
push 0x45861b
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
push 1
push 0
call sub.kernel32.dll_CreateEventA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4584b1
mov eax, 0x458698
call fcn.00452b0c
xor edx, edx
push ebp
push 0x4585b0
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x14
call fcn.00402934
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 8]
push eax
push 0x14
mov eax, dword [ebp - 4]
add eax, 0x4034
push eax
push ebx
mov eax, dword [ebp - 4]
add eax, 0x20
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_TransactNamedPipe
test eax, eax
jne 0x458599
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x3e5
je 0x458519
mov eax, 0x4586ac
call fcn.00452b0c
xor edx, edx
push ebp
push 0x458582
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [ebp + 8], 0
je 0x458557
mov eax, dword [ebp - 4]
cmp word [eax + 0x1a], 0
je 0x458557
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x1c]
call dword [edx + 0x18]
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xc]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x458537
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x458589
push 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_GetOverlappedResult
mov ebx, eax
call sub.kernel32.dll_GetLastError_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4585b7
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
Function at 0x45bf68
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffe14
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x11e8], ebx
mov dword [ebp - 0x11ec], ebx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x11cc], edx
mov dword [ebp - 0x11d0], eax
lea esi, [ebp - 0x11e0]
lea edi, [ebp - 0x11d0]
xor eax, eax
push ebp
push 0x45c151
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x11d4], eax
xor eax, eax
mov dword [ebp - 0x11c8], eax
mov eax, dword [edi]
add eax, 0x10
push eax
lea ecx, [ebp - 0x11c4]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x11cc]
call fcn.004593c8
cmp dword [ebp - 0x1084], 0x30
jle 0x45c00c
lea ecx, [ebp - 0x11e8]
mov edx, dword [ebp - 4]
mov al, 0xb7
call fcn.00450ac8
mov ecx, dword [ebp - 0x11e8]
mov dl, 1
mov eax, 0x406408
call fcn.00408c14
call fcn.0040311c
lea eax, [ebp - 0x11ec]
lea edx, [ebp - 0x1184]
mov ecx, 0x80
call fcn.0040355c
mov edx, dword [ebp - 0x11ec]
lea ecx, [ebp - 0x11e8]
mov eax, dword [edi]
mov eax, dword [eax]
call fcn.0045b974
mov edx, dword [ebp - 0x11e8]
mov eax, dword [edi]
add eax, 0x14
call fcn.00403450
lea eax, [ebp - 0x11ec]
lea edx, [ebp - 0x1104]
mov ecx, 0x80
call fcn.0040355c
mov edx, dword [ebp - 0x11ec]
lea ecx, [ebp - 0x11e8]
mov eax, dword [edi]
mov eax, dword [eax]
call fcn.0045b974
mov edx, dword [ebp - 0x11e8]
mov eax, dword [edi]
add eax, 0x18
call fcn.00403450
lea eax, [ebp - 0x1078]
mov al, byte [eax]
mov edx, dword [edi]
mov byte [edx + 0x1d], al
mov ebx, dword [ebp - 0x1080]
test ebx, ebx
jle 0x45c133
push ebp
mov eax, esi
mov edx, 0xa
call fcn.0045bef0
pop ecx
mov eax, dword [esi + 6]
push eax
mov eax, dword [edi]
mov eax, dword [eax]
mov ecx, dword [esi + 2]
mov dx, word [esi]
call fcn.004599c8
mov dword [ebp - 0x11e4], eax
cmp dword [ebp - 0x11e4], 0
jne 0x45c0d4
push ebp
call fcn.0045bd44
pop ecx
xor eax, eax
push ebp
push 0x45c105
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
mov eax, dword [ebp - 0x11e4]
add eax, 0x12
mov edx, dword [ebp - 0x11e4]
mov edx, dword [edx + 0xc]
call fcn.0045bef0
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45c11f
mov edx, dword [ebp - 0x11e4]
mov eax, dword [edi]
call fcn.00459a04
dec ebx
jne 0x45c09d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c158
lea eax, [ebp - 0x11ec]
mov edx, 2
call fcn.00403420
ret
Function at 0x461f78
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x14c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46204c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea eax, [ebp - 0x148]
push eax
lea edx, [ebp - 0x14c]
mov eax, ebx
call fcn.0042c40c
lea eax, [ebp - 0x14c]
mov edx, 0x462068
call fcn.0040357c
mov eax, dword [ebp - 0x14c]
call fcn.00403738
push eax
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x462033
xor eax, eax
push ebp
push 0x46202c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x148]
call fcn.00461f2c
test al, al
je 0x462001
mov byte [ebp - 1], 1
jmp 0x462015
lea eax, [ebp - 0x148]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x461fec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462033
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindClose
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462053
lea eax, [ebp - 0x14c]
call fcn.00403400
ret

Function at 0x46206c
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffea0
mov ebx, edx
mov esi, eax
push 0x200
push 0x160
lea eax, [esp + 8]
push eax
push 0
mov eax, esi
call fcn.00403738
push eax
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x4620ac
mov eax, ebx
lea edx, [esp + 0xc]
mov ecx, 0x104
call fcn.0040355c
jmp 0x4620b3
mov eax, ebx
call fcn.00403400
add esp, 0x160
pop esi
pop ebx
ret

Function at 0x4620bc
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffea0
mov ebx, edx
mov esi, eax
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x498b44]
or eax, 0x4001
push eax
push 0x160
lea eax, [esp + 8]
push eax
push 0
mov eax, esi
call fcn.00403738
push eax
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x4620fc
mov eax, dword [esp + 4]
jmp 0x4620fe
xor eax, eax
add esp, 0x160
pop esi
pop ebx
ret

Function at 0x462108
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffea0
mov ebx, eax
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x498b4c]
or eax, 0x4011
push eax
push 0x160
lea eax, [esp + 8]
push eax
push 0x10
push 0x46214c
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x462142
mov eax, dword [esp + 4]
jmp 0x462144
xor eax, eax
add esp, 0x160
pop ebx
ret

Function at 0x46212c
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffea0
mov ebx, eax
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x498b4c]
or eax, 0x4011
push eax
push 0x160
lea eax, [esp + 8]
push eax
push 0x10
push 0x46214c
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x462142
mov eax, dword [esp + 4]
jmp 0x462144
xor eax, eax
add esp, 0x160
pop ebx
ret