joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4070a8
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x424], ecx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4072ec
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004035dc
cmp dword [0x4880e0], 1
je 0x407129
mov dword [ebp - 0x14], 0x400
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x420]
push eax
push 1
mov eax, dword [ebp - 4]
call fcn.00403880
push eax
call sub.mpr.dll_WNetGetUniversalNameA
test eax, eax
jne 0x4072ce
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x420]
mov edx, dword [edx]
call fcn.00403674
jmp 0x4072ce
mov eax, dword [ebp - 4]
mov al, byte [eax]
call fcn.004028e4
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0x41
jb 0x4072ce
cmp byte [ebp - 0x15], 0x5a
ja 0x4072ce
mov eax, dword [ebp - 4]
call fcn.004036bc
cmp eax, 3
jl 0x4072ce
mov eax, dword [ebp - 4]
cmp byte [eax + 1], 0x3a
jne 0x4072ce
mov eax, dword [ebp - 4]
cmp byte [eax + 2], 0x5c
jne 0x4072ce
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 1
push 1
call sub.mpr.dll_WNetOpenEnumA
test eax, eax
jne 0x4072ce
xor edx, edx
push ebp
push 0x4072c7
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [ebp - 0x10], 0x640
mov eax, dword [ebp - 0x10]
call fcn.00402650
mov dword [ebp - 0x20], eax
xor edx, edx
push ebp
push 0x4072a9
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x20]
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.mpr.dll_WNetEnumResourceA
cmp eax, 0xea
jne 0x4071f8
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x10]
call fcn.00402680
jmp 0x4071bc
test eax, eax
je 0x40720b
call fcn.00403304
call fcn.00403304
jmp 0x4072ce
mov esi, dword [ebp - 0xc]
dec esi
test esi, esi
jl 0x4071bc
inc esi
xor edi, edi
mov eax, edi
shl eax, 2
mov edx, dword [ebp - 0x20]
lea ebx, [edx + eax*8]
cmp dword [ebx + 0x10], 0
je 0x407287
mov eax, dword [ebx + 0x10]
mov al, byte [eax]
call fcn.004028e4
cmp al, byte [ebp - 0x15]
jne 0x407287
lea eax, [ebp - 0x424]
push eax
mov eax, dword [ebp - 4]
call fcn.004036bc
mov ecx, eax
sub ecx, 2
mov edx, 3
mov eax, dword [ebp - 4]
call fcn.004038c0
mov eax, dword [ebp - 0x424]
push eax
lea eax, [ebp - 0x428]
mov edx, dword [ebx + 0x14]
call fcn.00403674
mov edx, dword [ebp - 0x428]
mov eax, dword [ebp - 8]
pop ecx
call fcn.00403708
call fcn.00403304
call fcn.00403304
jmp 0x4072ce
inc edi
dec esi
jne 0x407216
jmp 0x4071bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4072f3
lea eax, [ebp - 0x428]
mov edx, 2
call fcn.00403568
ret

Function at 0x40742c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push esp
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00403628
add esp, 0x104
pop ebx
ret
Function at 0x408718
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x408751
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403628
jmp 0x40875a
mov eax, ebx
mov edx, esi
call fcn.004035dc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x408764
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x408785
mov al, byte [esp]
jmp 0x408787
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x411254
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00403548
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x4112b5
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
cmp byte [ebp - 0x101], 0
jne 0x4112b5
cmp byte [ebp - 0x102], 0
je 0x4112b5
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.004036a4
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4124f4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x24], 0
je 0x412575
xor eax, eax
mov al, byte [ebx + 4]
mov word [ebp - 6], ax
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x412526
add word [ebp - 6], 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x412538
add word [ebp - 6], 0x4000
test byte [ebx + 0xb], 0x20
je 0x412544
add word [ebp - 6], 0x8000
xor ebx, ebx
movzx edx, word [ebp - 6]
mov cl, 2
mov eax, dword [ebp - 0xc]
call fcn.004123cc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x412569
push ebp
mov eax, dword [ebp - 4]
call fcn.00412468
pop ecx
mov ebx, eax
cmp bl, 2
je 0x412544
cmp dword [ebp - 4], 0
setne al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x419ce8
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x419cee
ret
Function at 0x41f5a8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x489650
cmp dword [edi], 0
jne 0x41f624
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x48964c]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x488598
mov ecx, 2
call fcn.00402740
mov edx, 0x41f580
lea eax, [esi + 5]
call fcn.0041f5a0
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041f5a0
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41f5f9
mov dword [0x48964c], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41f728
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x41f778]
test si, 4
je 0x41f73c
or bl, 1
test si, 8
je 0x41f746
or bl, 4
test si, 1
je 0x41f750
or bl, 8
test si, 2
je 0x41f75a
or bl, 0x10
test si, 0x10
je 0x41f764
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x41f773
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x42e434
Capabilities:
Encode data using xor

Disassembly:
in eax, dx
popal
xchg ebp, eax
popal
leave
mov al, byte [0x7fe4301c]
cwde
add dword [edi], 0xcfdda45
or al, 0x5d
pop esp
lds esp, [edx + edi + 0x15]
dec eax
aas
dec esp
xor ax, 0xdc24
pop edx
jnp 0x42e44e
idiv dword [ecx]
dec ecx
aaa
invalid
Function at 0x4359a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov bl, 1
mov eax, dword [ebp + 8]
mov esi, dword [eax - 0x18]
dec esi
test esi, esi
jl 0x435b4c
inc esi
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x10]
mov edx, 5
call fcn.004347f4
pop ecx
test al, al
jne 0x4359e5
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 0xd
call fcn.00435c80
xor ebx, ebx
jmp 0x435b4c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x20]
cmp eax, dword [ebp - 0x10]
ja 0x435a04
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 2
call fcn.00435c80
xor ebx, ebx
jmp 0x435b4c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x34]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x10]
mov edx, dword [eax + edx*4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x3c]
call fcn.00446eec
test eax, eax
jne 0x435a3c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 2
call fcn.00435c80
xor ebx, ebx
jmp 0x435b4c
test byte [ebp - 0xc], 1
je 0x435b45
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 4]
mov edx, 4
call fcn.004347f4
pop ecx
test al, al
jne 0x435a70
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 0xd
call fcn.00435c80
xor ebx, ebx
jmp 0x435b4c
mov edx, 0x43277c
mov eax, 0xc
call fcn.00403cc8
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x435b18
push dword fs:[eax]
mov dword fs:[eax], esp
mov edi, dword [ebp - 8]
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.004039ec
mov eax, dword [ebp + 8]
push eax
mov eax, edi
call fcn.0040388c
mov edx, dword [ebp - 4]
call fcn.004347f4
pop ecx
test al, al
jne 0x435adb
mov edx, 0x43277c
mov eax, dword [ebp - 8]
call fcn.00403cdc
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 0xd
call fcn.00435c80
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x435b4c
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00430de8
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x3c]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 8]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x30]
mov edx, dword [ebp - 8]
call fcn.00431080
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x435b45
dec esi
jne 0x4359bb
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44b064
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push ebx
xor ebx, ebx
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x44b0b0
cmp dword [ebp - 0x84], 2
jne 0x44b0b0
cmp dword [ebp - 0x90], 5
jg 0x44b0ae
cmp dword [ebp - 0x90], 5
jne 0x44b0b0
cmp dword [ebp - 0x8c], 1
jl 0x44b0b0
mov bl, 1
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4503f4
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x48976c
mov eax, esi
mov edx, 8
test al, 1
je 0x450410
shr eax, 1
xor eax, 0xedb88320
jmp 0x450412
shr eax, 1
dec edx
jne 0x450403
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4503fc
pop esi
ret

Function at 0x45043f
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x489768], 0
jne 0x45044b
call fcn.004503f4
push 1
push 0x489768
call sub.kernel32.dll_InterlockedExchange
mov eax, edi
test esi, esi
je 0x450476
mov edx, ebx
and dx, 0xff
xor ecx, ecx
mov cl, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x48976c]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x450451
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x450a14
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov esi, eax
cmp edi, 0x50
jle 0x450a35
mov eax, esi
mov edx, 0x488878
mov ecx, 0x40
call fcn.004029f4
je 0x450a3a
call fcn.004509ac
mov eax, esi
add eax, 0x40
mov ebx, eax
mov eax, dword [ebx + 4]
mov edx, dword [ebx + 8]
not edx
cmp eax, edx
jne 0x450a59
cmp edi, eax
jne 0x450a59
cmp dword [ebx], 0xcc
je 0x450a5e
call fcn.004509ac
mov eax, ebx
add eax, 0x10
mov ebp, eax
add esi, dword [ebx + 4]
mov dword [esp], esi
mov edx, dword [esp]
sub edx, ebp
mov eax, ebp
call fcn.0045047c
cmp eax, dword [ebx + 0xc]
jne 0x450a85
mov eax, dword [esp]
cmp byte [eax - 1], 0
je 0x450a8a
call fcn.004509ac
mov bl, 0xcc
mov esi, 0x489b6c
cmp ebp, dword [esp]
jb 0x450a9b
call fcn.004509ac
mov eax, ebp
call fcn.004074a0
mov edi, eax
mov eax, esi
mov ecx, edi
mov edx, ebp
call fcn.00403628
inc edi
add ebp, edi
add esi, 4
dec bl
jne 0x450a91
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x451290
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x45137c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.0042d8a8
mov eax, dword [ebp - 8]
lea ecx, [ebp - 4]
mov edx, 0x451394
call fcn.00451024
push 0
mov eax, dword [ebp - 4]
call fcn.00403880
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x45134a
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 0xb7
je 0x4512b0
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov al, 0x2f
call fcn.0045096c
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.00406dd0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.0042e684
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x14]
mov ecx, 2
mov al, 0x60
call fcn.0045093c
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, 0x406430
call fcn.00408dbc
call fcn.00403264
jmp 0x4512b0
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.004035dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451383
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00403568
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403568
ret
Function at 0x4519c0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x14c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x451ad2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x148]
push eax
lea edx, [ebp - 0x14c]
mov eax, ebx
call int.0042c5e0
lea eax, [ebp - 0x14c]
mov edx, 0x451aec
call fcn.004036c4
mov eax, dword [ebp - 0x14c]
call fcn.00403880
push eax
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x451ab5
xor eax, eax
push ebp
push 0x451aae
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 1
test byte [ebp - 0x148], 0x10
jne 0x451a47
mov byte [ebp - 1], 0
jmp 0x451a97
mov edx, 0x451af0
lea eax, [ebp - 0x11c]
call fcn.004075ec
test eax, eax
je 0x451a75
mov edx, 0x451af4
lea eax, [ebp - 0x11c]
call fcn.004075ec
test eax, eax
je 0x451a75
mov byte [ebp - 1], 0
jmp 0x451a97
lea eax, [ebp - 0x148]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x451a38
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x12
je 0x451a97
mov byte [ebp - 1], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451ab9
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindClose
ret
mov byte [ebp - 1], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451ad9
lea eax, [ebp - 0x14c]
call fcn.00403548
ret
Function at 0x45245c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00403870
xor eax, eax
push ebp
push 0x45266a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 1
push 0x452688
push ebx
push 0x452688
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040377c
test edi, edi
je 0x4524c6
push dword [ebp - 0xc]
push 0x452694
push edi
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040377c
lea edx, [ebp - 0x64]
mov eax, ebx
call fcn.0042c984
mov eax, dword [ebp - 0x64]
mov edx, 0x4526a0
call fcn.00406af4
test eax, eax
je 0x4524fc
lea edx, [ebp - 0x64]
mov eax, ebx
call fcn.0042c984
mov eax, dword [ebp - 0x64]
mov edx, 0x4526b0
call fcn.00406af4
test eax, eax
jne 0x45256c
call fcn.0042da90
test al, al
je 0x45253c
push 0x452688
lea eax, [ebp - 0x68]
call fcn.0042d87c
mov eax, dword [ebp - 0x68]
lea edx, [ebp - 0x64]
call int.0042c5e0
push dword [ebp - 0x64]
push 0x4526c0
push dword [ebp - 0xc]
push 0x452688
lea eax, [ebp - 0xc]
mov edx, 5
call fcn.0040377c
jmp 0x45256c
push 0x452688
lea eax, [ebp - 0x68]
call fcn.0042d850
mov eax, dword [ebp - 0x68]
lea edx, [ebp - 0x64]
call int.0042c5e0
push dword [ebp - 0x64]
push 0x4526d8
push dword [ebp - 0xc]
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.0040377c
cmp dword [ebp - 4], 0
jne 0x45257c
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0042c92c
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x44
call fcn.00402a64
mov dword [ebp - 0x50], 0x44
mov dword [ebp - 0x24], 1
mov ax, word [ebp + 0x10]
mov word [ebp - 0x20], ax
cmp dword [ebp - 4], 0
je 0x4525b3
mov eax, dword [ebp - 4]
call fcn.00403880
mov ebx, eax
jmp 0x4525b5
xor ebx, ebx
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x50]
push eax
push ebx
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.00403880
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x4525ec
mov byte [ebp - 5], 0
call sub.kernel32.dll_GetLastError_1
mov edx, dword [ebp + 8]
mov dword [edx], eax
jmp 0x45263f
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_CloseHandle_1
cmp byte [ebp + 0x14], 0
je 0x452606
push 0xffffffffffffffff
mov eax, dword [ebp - 0x60]
push eax
call sub.user32.dll_WaitForInputIdle
cmp byte [ebp + 0x18], 0
je 0x452629
test esi, esi
je 0x452612
call esi
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x60]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x45260c
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452671
lea eax, [ebp - 0x68]
mov edx, 2
call fcn.00403568
lea eax, [ebp - 0xc]
call fcn.00403548
lea eax, [ebp - 4]
call fcn.00403548
ret
Function at 0x45299c
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffec
mov ebx, eax
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4529ca
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x10
call fcn.004036a4
jmp 0x4529d1
mov eax, ebx
call fcn.00403548
add esp, 0x14
pop ebx
ret

Function at 0x4529d8
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
mov dword [esp], pe_nt_image_headers32
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x452a09
mov eax, ebx
lea edx, [esp + 4]
mov ecx, pe_nt_image_headers32
call fcn.004036a4
jmp 0x452a10
mov eax, ebx
call fcn.00403548
add esp, 0x104
pop ebx
ret

Function at 0x452ad8
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, eax
mov esi, edx
dec esi
test esi, esi
jl 0x452b35
inc esi
xor ebx, ebx
cmp ebx, 1
jne 0x452afe
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_Sleep
jmp 0x452b0c
cmp ebx, 1
jle 0x452b0c
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov eax, edi
call fcn.00403880
push eax
call sub.kernel32.dll_DeleteFileA
test eax, eax
jne 0x452b35
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
je 0x452b35
call sub.kernel32.dll_GetLastError_1
cmp eax, 3
je 0x452b35
inc ebx
dec esi
jne 0x452aee
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4

Function at 0x4534e8
Capabilities:
Delete registry value

Disassembly:
push ebx
push esi
push ecx
mov ebx, edx
mov esi, eax
cmp dword [0x4880e0], 1
je 0x45350e
push 0
mov eax, esi
call fcn.00403880
push eax
push 0x453568
call sub.kernel32.dll_WriteProfileStringA
jmp 0x453541
push esp
push 2
push 0
push 0x453570
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x453541
mov eax, esi
call fcn.00403880
push eax
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey
mov eax, ebx
call fcn.00403880
push eax
call sub.gdi32.dll_RemoveFontResourceA
test eax, eax
je 0x453562
push 0
push 0
push 0x1d
push 0xffff
call sub.user32.dll_SendNotifyMessageA
pop edx
pop esi
pop ebx
ret
Function at 0x4535a0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x45368d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4536a0
push 0x4536b4
call sub.kernel32.dll_GetModuleHandleA_1
push eax
call sub.kernel32.dll_GetProcAddress
mov ebx, eax
test ebx, ebx
je 0x453607
push 0
mov eax, dword [ebp - 4]
push eax
push edi
lea edx, [ebp - 0x18]
mov eax, esi
call int.0042c5e0
mov eax, dword [ebp - 0x18]
call fcn.00403880
push eax
call ebx
neg eax
sbb eax, eax
neg eax
mov ebx, eax
jmp 0x453672
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x18]
mov eax, esi
call fcn.0042c88c
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x1c]
call fcn.0042c954
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call int.0042c5e0
mov eax, dword [ebp - 0x18]
call fcn.00403880
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
mov ebx, eax
neg ebx
sbb ebx, ebx
neg ebx
test bl, bl
je 0x453672
mov ecx, edi
mov eax, dword [ebp - 0xc]
imul dword [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.004300a0
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
imul dword [ebp - 8]
mov edx, dword [ebp - 0x14]
call fcn.004300a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x453694
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00403568
ret