joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51bebb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x57792a
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x51bf13
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push 0x57794b
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x51bf09
mov bx, 0x2a04
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x51bf17
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x52a2ec
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x52a3a3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.00404db0
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jne 0x52a32e
call fcn.004042f4
jmp 0x52a3aa
mov eax, ebx
call fcn.00402b84
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push ebx
push 0
mov eax, esi
call fcn.00404db0
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
jne 0x52a357
call fcn.004042f4
jmp 0x52a3aa
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x52a3b4
mov eax, dword [ebp - 8]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
jne 0x52a378
call fcn.004042f4
jmp 0x52a3aa
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
mov dword [edi], eax
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52a3aa
mov eax, dword [ebp - 8]
call fcn.00402bb4
ret
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x52a618
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x52a689
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x168]
xor ecx, ecx
mov edx, 0x160
call fcn.0040333c
cmp dword [ebp - 4], 0
jne 0x52a65b
mov word [ebp - 6], 0
lea eax, [ebp - 6]
mov dword [ebp - 4], eax
or ebx, 0x4008
push ebx
push 0x160
lea eax, [ebp - 0x168]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetFileInfoA
mov ebx, dword [ebp - 0x164]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52a695
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x52a978
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
push 0x52ab24
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x52ab1c
xor eax, eax
push ebp
push 0x52ab15
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebp - 6], 0
push 0x4001
push 0x160
lea eax, [ebp - 0x168]
push eax
push 0
push 0x52ab30
call sub.shell32.dll_SHGetFileInfoA
mov esi, eax
test esi, esi
jne 0x52a9f0
push 0x4009
push 0x160
lea eax, [ebp - 0x168]
push eax
push 0
lea eax, [ebp - 6]
push eax
call sub.shell32.dll_SHGetFileInfoA
mov esi, eax
push 0x4000
push 0x160
lea eax, [ebp - 0x168]
push eax
push 0
push 0x52ab30
call sub.shell32.dll_SHGetFileInfoA
mov edi, eax
test edi, edi
jne 0x52aa31
push 0x4008
push 0x160
lea eax, [ebp - 0x168]
push eax
push 0
lea eax, [ebp - 6]
push eax
call sub.shell32.dll_SHGetFileInfoA
mov edi, eax
push 0x8000
push 0x10
push 0x10
push 1
push 0x1d
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_LoadImageA
mov ebx, eax
push 1
mov edx, ebx
mov eax, esi
call fcn.00433750
push eax
push esi
call sub.comctl32.dll_ImageList_SetOverlayImage
push ebx
call sub.user32.dll_DestroyIcon
push 0x8000
push 0x20
push 0x20
push 1
push 0x1d
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_LoadImageA
mov ebx, eax
push 1
mov edx, ebx
mov eax, edi
call fcn.00433750
push eax
push edi
call sub.comctl32.dll_ImageList_SetOverlayImage
push ebx
call sub.user32.dll_DestroyIcon
push 0x8000
push 0x10
push 0x10
push 1
push 0x1e
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_LoadImageA
mov ebx, eax
push 2
mov edx, ebx
mov eax, esi
call fcn.00433750
push eax
push esi
call sub.comctl32.dll_ImageList_SetOverlayImage
push ebx
call sub.user32.dll_DestroyIcon
push 0x8000
push 0x20
push 0x20
push 1
push 0x1e
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_LoadImageA
mov ebx, eax
push 2
mov edx, ebx
mov eax, edi
call fcn.00433750
push eax
push edi
call sub.comctl32.dll_ImageList_SetOverlayImage
push ebx
call sub.user32.dll_DestroyIcon
mov byte [0x577b70], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52ab1c
cmp dword [ebp - 4], 0
je 0x52ab14
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x52ab34
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffe9c
mov ebx, eax
call fcn.0052a2e0
test al, al
je 0x52ab61
cmp dword [0x57a12c], 0x40047
jl 0x52ab61
cmp byte [0x577b70], 0
jne 0x52ab61
call fcn.0052a978
mov esi, ebx
and esi, 0x7f
mov eax, dword [esi*4 + 0x577b74]
or eax, 0x4000
push eax
push 0x160
lea eax, [esp + 0xc]
push eax
push 0
push 0x52abc4
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
jne 0x52abb9
mov word [esp], 0
mov eax, dword [esi*4 + 0x577b74]
or eax, 0x4000
or eax, 8
push eax
push 0x160
lea eax, [esp + 0xc]
push eax
push 0
lea eax, [esp + 0x10]
push eax
call sub.shell32.dll_SHGetFileInfoA
add esp, 0x164
pop esi
pop ebx
ret
Function at 0x5354a4
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x5354ac
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x5355f9
push dword fs:[eax]
mov dword fs:[eax], esp
test dl, dl
je 0x535502
lea edx, [ebp - 4]
mov eax, dword [0x577e7c]
call fcn.00406d84
cmp ebx, 1
jbe 0x535539
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x535610
call fcn.0040ad58
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.00404bb8
jmp 0x535539
lea eax, [ebp - 4]
mov edx, 0x535620
call fcn.0040496c
cmp ebx, 1
jbe 0x535539
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x535630
call fcn.0040ad58
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 4]
call fcn.00404bb8
push 0
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 4]
call fcn.00404bfc
mov eax, dword [ebp - 0x18]
call fcn.00404db0
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x5355c1
call sub.kernel32.dll_GetLastError
mov ebx, eax
cmp ebx, 0xb7
jne 0x535571
mov bl, 1
jmp 0x5355d1
push 0
lea eax, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.0040d4f4
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x24]
mov eax, dword [0x578584]
call fcn.00406d84
mov eax, dword [ebp - 0x24]
mov ecx, 1
pop edx
call fcn.0052b9f4
mov eax, dword [ebp - 0x1c]
mov cx, word [0x535634]
xor edx, edx
call fcn.00447cf0
mov bl, 2
jmp 0x5355d1
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov edx, dword [ebp - 4]
call fcn.00404928
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x535600
lea eax, [ebp - 0x24]
mov edx, 5
call fcn.004048f8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004048f8
ret

Function at 0x535c70
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffea0
mov ebx, ecx
mov esi, eax
test edx, 0x40000000
jne 0x535c92
mov edx, ebx
mov eax, dword [0x578580]
call fcn.00406d84
jmp 0x535cc9
push 0x408
push 0x160
lea eax, [esp + 8]
push eax
push 0
push esi
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x535cc2
mov eax, ebx
lea edx, [esp + 0x110]
mov ecx, 0x50
call fcn.00404b44
jmp 0x535cc9
mov eax, ebx
call fcn.004048d4
add esp, 0x160
pop esi
pop ebx
ret
Function at 0x536650
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x164], ebx
mov dword [ebp - 0x15c], ebx
mov dword [ebp - 0x160], ebx
mov dword [ebp - 0x158], ebx
mov ebx, ecx
test ebx, ebx
js 0x536683
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x53667c
mov edx, esp
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404da0
mov ecx, dword [ebp - 0xc]
inc ecx
mov eax, dword [ebp - 8]
mov edx, dword [0x401138]
call fcn.00405630
xor eax, eax
push ebp
push 0x536811
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
test eax, eax
jl 0x5367d9
inc eax
mov dword [ebp - 0x14], eax
mov esi, dword [ebp - 8]
lea eax, [ebp - 0x154]
push eax
push dword [ebp - 4]
push 0x536838
push dword [esi]
lea eax, [ebp - 0x158]
mov edx, 3
call fcn.00404c70
mov eax, dword [ebp - 0x158]
call fcn.00404db0
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x5367cd
mov eax, dword [ebp - 0x154]
test al, 0x10
jne 0x5367b2
test al, 2
jne 0x5367b2
xor eax, eax
mov dword [ebp - 0x10], eax
push dword [ebp - 4]
push 0x536838
lea eax, [ebp - 0x160]
lea edx, [ebp - 0x128]
mov ecx, 0x104
call fcn.00404b44
push dword [ebp - 0x160]
lea eax, [ebp - 0x15c]
mov edx, 3
call fcn.00404c70
mov eax, dword [ebp - 0x15c]
lea edx, [ebp - 0x10]
call fcn.0052a470
call fcn.0041bdfc
test al, al
je 0x536770
or edi, 0xffffffff
jmp 0x53677f
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.0052a618
mov edi, eax
mov eax, dword [ebp - 0x10]
call fcn.0052a3d4
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x128]
mov ecx, 0x104
call fcn.00404b44
mov edx, dword [ebp - 0x164]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax]
mov ecx, edi
mov edi, dword [eax]
call dword [edi + 0x3c]
lea eax, [ebp - 0x154]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x536705
push ebx
call sub.kernel32.dll_FindClose_1
add esi, 4
dec dword [ebp - 0x14]
jne 0x5366c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x536818
lea eax, [ebp - 0x164]
mov edx, 4
call fcn.004048f8
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
inc ecx
mov edx, dword [0x401138]
call fcn.004054f0
lea eax, [ebp - 4]
call fcn.004048d4
ret
Function at 0x537984
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x537a51
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x537a34
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x700f0037
mov eax, dword [0x578444]
cmp dword [eax + 4], 0x60000
jl 0x5379d4
or dword [ebp - 4], 0x400000
lea edx, [ebp - 8]
mov eax, ebx
call fcn.00537ae4
mov eax, dword [ebp - 8]
call fcn.00535828
test al, al
je 0x537a04
mov eax, dword [ebp - 8]
call fcn.00404db0
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
jne 0x537a04
and dword [ebp - 4], 0xfffbffff
lea eax, [ebp - 4]
push eax
lea eax, [ebx + 0xc]
push eax
push 1
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x428]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x537a3b
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x53b52c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, eax
mov eax, ebx
call fcn.00404db0
push eax
call sub.kernel32.dll_GetDriveTypeA
sub eax, 3
je 0x53b56d
dec eax
je 0x53b54f
sub eax, 2
je 0x53b56d
jmp 0x53b57e
mov al, byte [ebx]
call fcn.0052bea4
test al, al
je 0x53b57e
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, ebx
mov si, 0xffa1
call fcn.00403bac
jmp 0x53b57e
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, ebx
mov si, 0xffa1
call fcn.00403bac
pop esi
pop ebx
pop ebp
ret

Function at 0x53b584
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x53b633
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x3f8], 0
jne 0x53b5d2
push 0x465
mov eax, dword [ebp - 4]
call fcn.004558d8
mov ecx, eax
mov dl, 1
mov eax, dword [0x537c80]
call fcn.00537cec
mov edx, dword [ebp - 4]
mov dword [edx + 0x3f8], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3f8]
call fcn.005381cc
lea eax, [ebp - 8]
mov edx, 0x53b648
call fcn.0040496c
call sub.kernel32.dll_GetLogicalDrives
mov ebx, eax
xor esi, esi
test ebx, ebx
je 0x53b61d
test bl, 1
je 0x53b616
lea eax, [ebp - 8]
call fcn.00404e08
lea edx, [esi + 0x41]
mov byte [eax], dl
push ebp
mov eax, dword [ebp - 8]
call fcn.0053b52c
pop ecx
shr ebx, 1
inc esi
test ebx, ebx
jne 0x53b5fa
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53b63a
lea eax, [ebp - 8]
call fcn.004048d4
ret
Function at 0x53c1d4
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x150], ecx
mov dword [ebp - 0x154], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404da0
xor eax, eax
push ebp
push 0x53c2f2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x53c2c5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
or eax, 1
push eax
call sub.kernel32.dll_SetErrorMode
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 4]
call fcn.00404db0
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x53c2a2
test byte [ebp - 0x14c], 0x10
jne 0x53c285
lea eax, [ebp - 0x154]
lea edx, [ebp - 0x120]
mov ecx, 0x104
call fcn.00404b44
mov eax, dword [ebp - 0x154]
lea edx, [ebp - 0x150]
call fcn.004094f4
mov edx, dword [ebp - 0x150]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x14c]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x53c248
push ebx
call sub.kernel32.dll_FindClose_1
mov byte [ebp - 5], 1
jmp 0x53c2ae
call sub.kernel32.dll_GetLastError
cmp eax, 2
sete byte [ebp - 5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53c2cc
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x540e64
Capabilities:
Get common file path

Disassembly:
push ebx
push ecx
mov ebx, eax
mov al, byte [ebx + 4]
sub al, 1
jb 0x540e73
je 0x540e7b
jmp 0x540ea3
mov eax, dword [ebx + 8]
mov dword [esp], eax
jmp 0x540ea8
cmp dword [ebx + 8], 0
jne 0x540e9b
lea eax, [ebx + 8]
push eax
xor eax, eax
mov al, byte [ebx + 0xc]
push eax
mov eax, dword [0x578464]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
mov eax, dword [ebx + 8]
mov dword [esp], eax
jmp 0x540ea8
xor eax, eax
mov dword [esp], eax
mov eax, dword [esp]
pop edx
pop ebx
ret
Function at 0x544bd4
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x544cd9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41cbec]
call fcn.00403974
mov dword [ebp - 4], eax
mov dl, 1
mov eax, dword [0x470df0]
call fcn.00470f5c
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x544cb7
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.00471038
mov edx, 0x544cf0
mov eax, dword [ebp - 8]
call fcn.004711c4
test al, al
je 0x544c99
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.0047157c
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x544c99
inc esi
xor ebx, ebx
lea ecx, [ebp - 0x10]
mov edx, ebx
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x10]
lea ecx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00471738
mov eax, dword [ebp - 0xc]
call fcn.00404db0
push eax
lea ecx, [ebp - 0x14]
mov edx, ebx
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x14]
call fcn.00404db0
push eax
call sub.kernel32.dll_SetEnvironmentVariableA
inc ebx
dec esi
jne 0x544c56
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x544cbe
mov eax, dword [ebp - 4]
call fcn.004039a4
mov eax, dword [ebp - 8]
call fcn.004039a4
ret

Function at 0x544d30
Capabilities:
Get hostname

Disassembly:
add esp, 0xfffffefc
lea eax, [esp + 4]
xor ecx, ecx
mov edx, pe_nt_image_headers32
call fcn.0040333c
mov dword [esp], pe_nt_image_headers32
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
mov eax, 0x57a2d4
lea edx, [esp + 4]
mov ecx, pe_nt_image_headers32
call fcn.00404b44
add esp, 0x104
ret
Function at 0x546d8c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff90
push ebx
xor eax, eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x58], eax
xor eax, eax
push ebp
push 0x546eef
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x44
call fcn.0040333c
mov dword [ebp - 0x44], 0x44
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push eax
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp + 8]
movzx eax, byte [eax - 3]
mov ecx, dword [eax*4 + 0x577c98]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 8]
lea eax, [ebp - 0x58]
call fcn.00404bfc
mov eax, dword [ebp - 0x58]
call fcn.00404db0
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.00404db0
push eax
call sub.kernel32.dll_CreateProcessA
call fcn.0040f544
mov ebx, eax
mov eax, dword [ebp - 0x50]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle
test ebx, ebx
je 0x546e7c
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x5c]
push eax
mov eax, dword [ebp + 8]
movzx eax, byte [eax - 3]
mov ecx, dword [eax*4 + 0x577c98]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 8]
lea eax, [ebp - 0x68]
call fcn.00404bfc
mov eax, dword [ebp - 0x68]
call fcn.00404db0
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 6
lea edx, [ebp - 0x64]
xor ecx, ecx
mov eax, 0x546f04
call fcn.0040ad58
mov eax, dword [ebp - 0x5c]
call fcn.0054653c
pop ecx
jmp 0x546ec7
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [ebp + 8]
movzx eax, byte [eax - 3]
mov ecx, dword [eax*4 + 0x577c98]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 8]
lea eax, [ebp - 0x70]
call fcn.00404bfc
mov eax, dword [ebp - 0x70]
call fcn.00404db0
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 6
lea edx, [ebp - 0x64]
xor ecx, ecx
mov eax, 0x546f24
call fcn.0040ad58
mov eax, dword [ebp - 0x6c]
call fcn.0054653c
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x546ef6
lea eax, [ebp - 0x70]
mov edx, 3
call fcn.004048f8
lea eax, [ebp - 0x5c]
mov edx, 2
call fcn.004048f8
ret
Function at 0x548420
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404da0
xor eax, eax
push ebp
push 0x54855f
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp + 0x10], 0
jne 0x548544
mov eax, dword [ebp - 4]
call fcn.0040a03c
test al, al
jne 0x548544
lea eax, [ebp - 0xc]
mov ecx, 0x548578
mov edx, dword [ebp - 4]
call fcn.00404bfc
mov edx, dword [ebp - 0xc]
lea ecx, [ebp - 8]
mov eax, ebx
call fcn.00545ef8
cmp dword [ebp - 8], 0
je 0x5484c7
push 0x548584
push dword [ebp - 8]
push 0x548594
push 0x5485a0
lea edx, [ebp - 0x14]
mov eax, esi
call fcn.00409a48
push dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 5
call fcn.00404c70
mov edx, dword [ebp - 0x10]
mov eax, dword [ebx + 0x84]
call fcn.0042048c
mov eax, dword [ebp - 4]
call fcn.0040a060
mov eax, dword [ebp - 4]
call fcn.0040a03c
test al, al
jne 0x54851e
mov al, byte [0x5485b4]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, 0x5485c0
mov edx, 0x5485e4
mov eax, ebx
call fcn.0054bde0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
mov edx, 0x548600
call fcn.0040f36c
mov ecx, dword [ebp - 0x18]
mov dl, 1
mov eax, dword [0x40868c]
call fcn.0040dd30
call fcn.00404248
mov ebx, 0x10
cmp byte [ebp + 0xc], 0
je 0x54852c
or ebx, 1
cmp byte [ebp + 8], 0
je 0x548535
or ebx, 2
push ebx
mov eax, dword [ebp - 4]
call fcn.00404db0
push eax
call sub.kernel32.dll_SetFileAttributesA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x548566
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.004048f8
ret

Function at 0x54aa7c
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x54ab0d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
push 0xf01ff
push 0x54ab18
push eax
call sub.advapi32.dll_OpenServiceA
xor edx, edx
mov dword [ebp - 4], edx
test eax, eax
je 0x54aaca
lea edx, [ebp - 4]
push edx
push 0
push eax
call sub.advapi32.dll_StartServiceA
jmp 0x54aaf7
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, 0x54ab2c
mov edx, 0x54ab4c
call fcn.0054bde0
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x40868c]
call fcn.0040dd30
call fcn.00404248
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54ab14
lea eax, [ebp - 8]
call fcn.004048d4
ret