joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430f20
Capabilities:
Get disk size

Disassembly:
sub esp, 0x30
mov eax, dword [0x4e2204]
xor eax, esp
mov dword [esp + 0x28], eax
push ebp
push esi
push edi
lea eax, [esp + 0x10]
push eax
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea ecx, [esp + 0x18]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
push eax
push edx
push eax
mov eax, dword [esp + 0x1c]
push eax
push str._d_d_d_d
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], 0
call fcn.00401470
mov ebp, dword [esp + 0x20]
add esp, 0x14
pxor xmm0, xmm0
movq qword [esp + 0x20], xmm0
movq qword [esp + 0x28], xmm0
mov byte [esp + 0x30], 0
test ebp, ebp
je 0x43101b
mov eax, dword [ebp]
shr eax, 8
lea ecx, [ebp + 4]
dec eax
test ecx, ecx
jne 0x430fac
mov ecx, 0x4cb498
push eax
push ecx
lea esi, [esp + 0x28]
call fcn.004789e0
add esp, 8
mov eax, esi
call fcn.00430ec0
mov eax, dword [edi]
test eax, eax
je 0x430fe9
lea ecx, [eax + 4]
test ecx, ecx
je 0x430fe9
cmp byte [ecx], 0
je 0x430fe9
movzx ecx, byte [eax]
cmp ecx, 1
jbe 0x430fe1
push edi
call fcn.0043c230
mov edi, dword [edi]
add edi, 4
mov byte [edi], 0x61
test ebp, ebp
je 0x43102a
push ebp
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
and eax, 0xff
cmp eax, 0x80
jl 0x43101f
push ebp
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
xor eax, eax
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.0049ceb0
add esp, 0x30
ret
xor eax, eax
jmp 0x430fa7
test eax, eax
jne 0x43102a
mov esi, ebp
call fcn.0045f5a0
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
xor ecx, esp
xor eax, eax
call fcn.0049ceb0
add esp, 0x30
ret

Function at 0x431040
Capabilities:
Generate random numbers via winapi

Disassembly:
sub esp, 0x18
mov eax, dword [0x4e2204]
xor eax, esp
mov dword [esp + 0x10], eax
cmp dword [0x567090], 0
push edi
mov edi, ecx
jne 0x431074
push 0xf0000000
push 1
push 0
push 0
push 0x567090
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x4310ad
mov ecx, dword [0x567090]
lea eax, [esp + 4]
push eax
push 0x10
pxor xmm0, xmm0
push ecx
movq qword [esp + 0x10], xmm0
movq qword [esp + 0x18], xmm0
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x4310ad
xor eax, eax
mov edi, edi
cmp byte [esp + eax + 4], 0
jne 0x4310c4
inc eax
cmp eax, 0x10
jb 0x4310a0
mov ecx, edi
call fcn.00430f20
pop edi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.0049ceb0
add esp, 0x18
ret
lea eax, [esp + 4]
call fcn.00430ec0
mov ecx, dword [esp + 0x14]
pop edi
xor ecx, esp
call fcn.0049ceb0
add esp, 0x18
ret

Function at 0x431880
Capabilities:
Hash data using sha256

Disassembly:
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
xor ecx, ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
pxor xmm0, xmm0
movq qword [eax + 0x68], xmm0
movq qword [eax + 0x70], xmm0
movq qword [eax + 0x78], xmm0
movq qword [eax + 0x80], xmm0
ret
Function at 0x43c690
Capabilities:
Get graphical window text

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [ebx]
push edi
test esi, esi
je 0x43c6d0
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
and eax, 0xff
cmp eax, 0x80
jl 0x43c6bf
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x43c6ca
test eax, eax
jne 0x43c6ca
mov esi, dword [ebx]
call fcn.0045f5a0
mov dword [ebx], 0
push ebp
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov esi, eax
inc esi
cmp dword [ebx], 0
jne 0x43c6f9
lea edi, [esi + 8]
call fcn.0045f460
mov ecx, esi
shl ecx, 8
mov dword [ebx], eax
inc ecx
mov dword [eax], ecx
mov edx, dword [ebx]
mov byte [edx + 4], 0
jmp 0x43c702
push 0
push esi
push ebx
call fcn.0043c120
mov ebx, dword [ebx]
test ebx, ebx
je 0x43c71e
push esi
add ebx, 4
push ebx
push ebp
call dword [sym.imp.USER32.dll_GetWindowTextA]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
pop esi
pop ebp
mov eax, 4
pop ebx
pop ecx
ret 8

Function at 0x43d0b0
Capabilities:
Create thread

Disassembly:
push edi
lea edi, [esi + 0x10]
push edi
mov dword [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
push 0
push 0x43cff0
call fcn.0049dc4e
add esp, 0xc
push edi
mov dword [esi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
pop edi
ret

Function at 0x43d0e0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
push esi
lea esi, [esp + 8]
mov dword [edi + 4], 1
call fcn.0044a930
mov eax, dword [edi + 0xc]
xor esi, esi
cmp eax, esi
je 0x43d155
cmp ebx, esi
je 0x43d10f
mov ecx, ebx
jmp 0x43d112
or ecx, 0xffffffff
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x43d143
mov eax, dword [edi + 0xc]
cmp eax, esi
je 0x43d133
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [edi + 0xc], esi
mov dword [edi + 4], esi
mov eax, 0xf4242
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea esi, [esp + 8]
call fcn.0044aa40
fstp st(0)
mov dword [edi + 4], 0
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x447110
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
mov esi, eax
lea eax, [esp + 4]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x447177
mov ecx, dword [esp + 4]
push ecx
push 0
push 0x411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x447177
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x2710
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ecx
ret

Function at 0x447610
Capabilities:
Get hostname

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov edi, 0x18
call fcn.0045f460
mov esi, eax
mov dword [esi], 0x1001
mov byte [esi + 4], 0
mov eax, dword [esi]
shr eax, 8
mov dword [esp + 0x14], eax
movzx ecx, byte [esi]
mov dword [esp + 0x10], esi
cmp ecx, 1
jbe 0x447654
lea edx, [esp + 0x10]
push edx
call fcn.0043c230
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x14]
lea eax, [esi + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x4476a8
mov dword [ebp], esi
test esi, esi
je 0x4476ed
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push esi
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
and eax, 0xff
cmp eax, 0x80
jl 0x44768c
push esi
call edi
push esi
call edi
and eax, 0xff
cmp eax, 0x80
jl 0x4476e4
push esi
call ebx
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
push 7
push str.Unknown
push ebp
mov dword [ebp], 0
call fcn.0043c500
test esi, esi
je 0x4476ed
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
and eax, 0xff
cmp eax, 0x80
jl 0x4476e4
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
test eax, eax
jne 0x4476ed
call fcn.0045f5a0
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 8
ret
Function at 0x447700
Capabilities:
Get file version info

Disassembly:
sub esp, 0x424
mov eax, dword [0x4e2204]
xor eax, esp
mov dword [esp + 0x41c], eax
mov eax, dword [esp + 0x428]
push ebx
mov ebx, dword [esp + 0x430]
push ebp
push esi
push edi
mov dword [esp + 0x10], eax
test ebx, ebx
jne 0x447733
mov ebx, 0x561e80
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jne 0x447775
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x44776f
push edi
push edi
lea ecx, [esp + 0x1c]
push ecx
push 0x400
push eax
push edi
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor esi, esi
xor ebp, ebp
jmp 0x447784
call fcn.0045f460
mov esi, eax
mov ebp, esi
neg ebp
sbb ebp, ebp
and ebp, edi
push esi
push ebp
push 0
push ebx
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], esi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x4477c5
mov eax, dword [esp + 0x10]
mov edi, 8
mov dword [eax], 0
call fcn.0045f460
mov edi, dword [esp + 0x10]
mov dword [edi], eax
mov dword [eax], 1
mov ecx, dword [edi]
mov byte [ecx + 4], 0
jmp 0x447848
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x28]
push eax
push str.VarFileInfoTranslation
push esi
mov dword [esp + 0x24], 0
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x44783e
cmp dword [esp + 0x18], 4
jb 0x44783e
mov eax, dword [esp + 0x24]
movzx ecx, word [eax + 2]
movzx edx, word [eax]
push ecx
push edx
push str.StringFileInfo_04x_04xFileDescription
lea edx, [esp + 0x34]
call fcn.00449770
add esp, 0xc
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x30]
push edx
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x44783e
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
call fcn.004011f0
lea edi, [esp + 0x1c]
call fcn.0044a7f0
mov eax, esi
jmp 0x447857
mov edi, dword [esp + 0x10]
mov dword [edi], 0
test ebp, ebp
je 0x447855
test esi, esi
je 0x447855
call fcn.0045f5a0
mov eax, edi
mov ecx, dword [esp + 0x42c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0049ceb0
add esp, 0x424
ret
Function at 0x447870
Capabilities:
Get file version info

Disassembly:
sub esp, 8
push ebx
push esi
push edi
push 0
push 0x561e80
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jne 0x44788e
xor esi, esi
xor ebx, ebx
jmp 0x44789d
call fcn.0045f460
mov esi, eax
mov ebx, esi
neg ebx
sbb ebx, ebx
and ebx, edi
push esi
push ebx
push 0
push 0x561e80
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x447906
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
push 0x4baac8
push esi
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x447906
mov eax, dword [esp + 0xc]
movzx edx, word [eax + 0x12]
mov ecx, dword [esp + 0x18]
mov dword [ecx], edx
movzx edx, word [eax + 0x10]
mov eax, dword [esp + 0x1c]
mov dword [eax], edx
test ebx, ebx
je 0x4478fd
test esi, esi
je 0x4478fd
call fcn.0045f5a0
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 8
ret
test ebx, ebx
je 0x447913
test esi, esi
je 0x447913
call fcn.0045f5a0
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 8
ret
Function at 0x4484d0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x3c
push 0x3c
lea eax, [esp + 4]
push 0
push eax
call fcn.004a1b50
mov ecx, dword [esp + 0x4c]
add esp, 0xc
lea edx, [esp]
push edx
mov dword [esp + 4], 0x3c
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], str.runas
mov dword [esp + 0x14], 0x561e80
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 5
mov dword [esp + 8], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
cmp byte [esp + 0x44], 0
je 0x448549
mov eax, dword [esp + 0x38]
test eax, eax
je 0x448549
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add esp, 0x3c
ret

Function at 0x448550
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x40
push esi
push edi
mov edi, 0x208
call fcn.0045f460
mov esi, eax
mov edi, esi
push 0x3c
neg edi
lea eax, [esp + 0x10]
sbb edi, edi
push 0
push eax
and edi, 0x208
call fcn.004a1b50
mov ecx, dword [esp + 0x58]
add esp, 0xc
push ecx
push str._select___s_
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 0x3c
mov dword [esp + 0x20], str.open
mov dword [esp + 0x24], str.explorer
mov dword [esp + 0x30], 5
mov dword [esp + 0x28], esi
mov dword [esp + 0x10], esi
call fcn.00449790
add esp, 8
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test edi, edi
je 0x4485d4
test esi, esi
je 0x4485d4
call fcn.0045f5a0
pop edi
xor eax, eax
pop esi
add esp, 0x40
ret

Function at 0x4487a0
Capabilities:
Create process on windows
Create thread

Disassembly:
cmp byte [esp + 0xc], 0
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
je 0x44880e
push 0x567098
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov edi, 0x30
call fcn.0045f460
mov esi, eax
test esi, esi
je 0x4487da
push ebx
mov eax, ebp
call fcn.00448610
mov esi, eax
jmp 0x4487dc
xor esi, esi
lea edi, [esi + 0x10]
push edi
mov dword [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
push 0
push 0x43cff0
call fcn.0049dc4e
add esp, 0xc
push edi
mov dword [esi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
push 5
push 0
push ebx
push ebp
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ecx, ecx
cmp eax, 0x20
setg cl
pop edi
pop esi
pop ebp
pop ebx
dec ecx
mov eax, ecx
ret
Function at 0x448920
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x28
mov eax, dword [0x4e2204]
xor eax, esp
mov dword [esp + 0x20], eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 9
lea eax, [esp + 8]
push eax
pxor xmm0, xmm0
push 0x59
push 0x800
movq qword [esp + 0x14], xmm0
movq qword [esp + 0x1c], xmm0
movq qword [esp + 0x24], xmm0
movq qword [esp + 0x2c], xmm0
call edi
push 9
lea eax, [esp + eax + 8]
push eax
push 0x5a
push 0x800
mov byte [eax - 1], 0x2d
call edi
lea eax, [esp + 4]
mov dword [esi], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x448982
sub eax, edx
push eax
lea ecx, [esp + 8]
push ecx
push esi
call fcn.0043c500
mov ecx, dword [esp + 0x24]
pop edi
xor ecx, esp
mov eax, esi
call fcn.0049ceb0
add esp, 0x28
ret
Function at 0x448c60
Capabilities:
Get token membership

Disassembly:
sub esp, 0x58
mov eax, dword [0x4e2204]
xor eax, esp
mov dword [esp + 0x54], eax
push esi
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0
push 0x1a
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x44
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
je 0x448cbc
mov ecx, dword [esp + 4]
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x448cbc
xor esi, esi
jmp 0x448cc4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [esp + 4]
test eax, eax
je 0x448cdb
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 4], 0
test esi, esi
je 0x448cf2
push 0x4def30
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x18], esi
call fcn.004a18e7
mov ecx, dword [esp + 0x58]
mov al, byte [esp + 8]
pop esi
xor ecx, esp
call fcn.0049ceb0
add esp, 0x58
ret

Function at 0x448d10
Capabilities:
Check os version

Disassembly:
sub esp, 0x98
mov eax, dword [0x4e2204]
xor eax, esp
mov dword [esp + 0x94], eax
push 0x94
lea eax, [esp + 4]
push 0
push eax
call fcn.004a1b50
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x448d65
xor al, al
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.0049ceb0
add esp, 0x98
ret
cmp dword [esp + 4], 6
mov ecx, dword [esp + 0x94]
setae al
xor ecx, esp
call fcn.0049ceb0
add esp, 0x98
ret
Function at 0x44dae0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, eax
mov ecx, esi
xor ecx, 0x15231239
cmp esi, 4
jb 0x44db2a
push ebx
push edi
mov edi, esi
shr edi, 2
jmp 0x44db00
mov eax, dword [edx]
imul ecx, ecx, 0x5bd1e995
imul eax, eax, 0x5bd1e995
mov ebx, eax
shr ebx, 0x18
xor ebx, eax
imul ebx, ebx, 0x5bd1e995
xor ecx, ebx
add edx, 4
sub esi, 4
sub edi, 1
jne 0x44db00
pop edi
pop ebx
sub esi, 1
je 0x44db4b
sub esi, 1
je 0x44db42
sub esi, 1
jne 0x44db58
movzx eax, byte [edx + 2]
shl eax, 0x10
xor ecx, eax
movzx eax, byte [edx + 1]
shl eax, 8
xor ecx, eax
movzx edx, byte [edx]
xor edx, ecx
imul edx, edx, 0x5bd1e995
mov ecx, edx
mov edx, ecx
shr edx, 0xd
xor edx, ecx
imul edx, edx, 0x5bd1e995
mov eax, edx
shr eax, 0xf
xor eax, edx
pop esi
ret
Function at 0x455220
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x4e2204]
xor eax, esp
mov dword [esp + 0x208], eax
push edi
push 0
push 0x1c
lea eax, [esp + 0xc]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
lea edi, [esi + 0x40e]
push edi
lea edx, [esi + 0x30d]
push edx
mov dword [esi + 0x510], 0
lea ecx, [esi + 0x20c]
lea eax, [esi + 0x208]
push ecx
mov byte [edx], 0
push eax
lea edx, [esp + 0x14]
push edx
mov byte [esi], 0
mov byte [eax], 0
mov byte [ecx], 0
mov byte [edi], 0
call fcn.004a055c
mov ecx, dword [esp + 0x220]
add esp, 0x14
pop edi
xor ecx, esp
mov eax, esi
call fcn.0049ceb0
add esp, 0x20c
ret

Function at 0x4552b0
Capabilities:
Read file on windows

Disassembly:
push ecx
push eax
push 1
lea ecx, [esp + 8]
push 2
push ecx
mov dword [esp + 0x10], 0
call fcn.0049ea18
add esp, 0x10
cmp eax, 1
je 0x4552d5
or eax, 0xffffffff
pop ecx
ret
mov dx, word [esp]
mov eax, dword [esp + 8]
rol dx, 8
mov word [eax], dx
xor eax, eax
pop ecx
ret

Function at 0x4552f0
Capabilities:
Read file on windows

Disassembly:
push ecx
push eax
push 1
lea ecx, [esp + 8]
push 4
push ecx
mov dword [esp + 0x10], 0
call fcn.0049ea18
add esp, 0x10
cmp eax, 1
je 0x455315
or eax, 0xffffffff
pop ecx
ret
mov eax, dword [esp]
rol eax, 0x10
mov edx, eax
mov ecx, eax
shr edx, 8
shl ecx, 8
xor edx, ecx
shl eax, 8
and edx, 0xff00ff
xor edx, eax
mov eax, dword [esp + 8]
mov dword [eax], edx
xor eax, eax
pop ecx
ret

Function at 0x455340
Capabilities:
Read file on windows

Disassembly:
push ecx
push eax
push 1
lea ecx, [esp + 8]
push 4
push ecx
mov dword [esp + 0x10], 0
call fcn.0049ea18
add esp, 0x10
cmp eax, 1
jne 0x45539d
mov eax, dword [esp]
rol eax, 0x10
mov ecx, eax
shr ecx, 8
mov edx, eax
shl edx, 8
xor ecx, edx
and ecx, 0xff00ff
shl eax, 8
xor ecx, eax
mov dword [esp], ecx
fild dword [esp]
test ecx, ecx
jge 0x45538d
fadd qword [0x4d35b8]
fmul qword [0x4d3888]
mov eax, dword [esp + 8]
fstp dword [eax]
xor eax, eax
pop ecx
ret
or eax, 0xffffffff
pop ecx
ret

Function at 0x455680
Capabilities:
Set registry value

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test edx, edx
jne 0x45569e
mov eax, dword [ebx]
push edx
push edx
push 1
push edx
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor eax, eax
pop ebx
ret 4
mov eax, edx
push esi
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4556a4
sub eax, esi
pop esi
cmp eax, 0x8000
jbe 0x4556bc
or eax, 0xffffffff
pop ebx
ret 4
mov ecx, dword [ebx]
inc eax
push eax
push edx
push 1
push 0
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop ebx
ret 4
Function at 0x4556e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [ecx + 0xc]
sub esp, 8
test eax, eax
je 0x4556ef
add eax, 4
jmp 0x4556f1
xor eax, eax
mov edx, dword [esi]
mov dword [esp], edx
lea edx, [esp]
push edx
mov edx, dword [esp + 0x10]
push edx
lea edx, [esp + 0xc]
push edx
push 0
push eax
mov eax, dword [ecx]
push eax
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x455721
mov ecx, dword [esp]
mov dword [esi], ecx
add esp, 8
ret 4
Function at 0x45c170
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
sub esp, 0xc
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov dword [esp + 0x14], 0
mov byte [esp + 0x10], 1
test eax, eax
jne 0x45c190
mov eax, str.rootwmi
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
push 0
push 0
mov esi, eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
cmp byte [esp + 0x10], 0
je 0x45c1ba
mov eax, dword [esp + 0x14]
test eax, eax
je 0x45c1ba
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
lea eax, [esp + 0x14]
push eax
push 0x4ba938
push 1
push 0
push 0x4baa08
mov dword [esp + 0x28], 0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x45c20d
test esi, esi
je 0x45c1ea
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp byte [esp + 0x10], 0
je 0x45c201
mov eax, dword [esp + 0x14]
test eax, eax
je 0x45c201
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
or eax, 0xffffffff
pop edi
pop esi
pop ebp
add esp, 0xc
ret 4
cmp byte [ebp + 0x2c], 0
mov edi, dword [esp + 0x14]
je 0x45c226
mov eax, dword [ebp + 0x30]
test eax, eax
je 0x45c226
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
lea eax, [ebp + 0x30]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [eax], 0
mov ecx, dword [edi]
mov edx, dword [ecx + 0xc]
push esi
push edi
call edx
test eax, eax
jne 0x45c1df
mov ebp, dword [ebp + 0x30]
push eax
push eax
push 3
push 4
push eax
push eax
push 0xa
push ebp
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jne 0x45c1df
test esi, esi
je 0x45c270
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp byte [esp + 0x10], 0
je 0x45c287
mov eax, dword [esp + 0x14]
test eax, eax
je 0x45c287
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0xc
ret 4

Function at 0x45c380
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push edi
call fcn.00448d10
test al, al
jne 0x45c393
or eax, 0xffffffff
pop edi
pop esi
pop ecx
ret
mov eax, dword [0x567120]
test eax, eax
jne 0x45c3c5
push 0x567098
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov edi, 0x4c
call fcn.0045f460
test eax, eax
je 0x45c3be
mov esi, eax
call fcn.0045abd0
jmp 0x45c3c0
xor eax, eax
mov dword [0x567120], eax
cmp dword [eax + 0xc], 0
jne 0x45c3f8
lea edi, [eax + 0x10]
push edi
mov esi, eax
mov dword [eax + 4], 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
push 0
push 0x43cff0
call fcn.0049dc4e
add esp, 0xc
push edi
mov dword [esi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
xor eax, eax
pop esi
pop ecx
ret
Function at 0x45fdc0
Capabilities:
Create directory

Disassembly:
sub esp, 0x514
push esi
push edi
push 0
push ecx
mov esi, ecx
call fcn.0045fac0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x45fe3b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x45fe3b
cmp eax, 0xb7
je 0x45fe3b
cmp eax, 3
jne 0x45fe3d
call fcn.0045fd70
test al, al
jne 0x45fe3b
lea eax, [esp + 8]
push eax
mov ecx, esi
call fcn.0045fc30
mov ecx, eax
call fcn.0045fdc0
lea ecx, [esp + 8]
mov edi, eax
call fcn.00403870
test edi, edi
je 0x45fe2c
mov eax, edi
pop edi
pop esi
add esp, 0x514
ret
mov ecx, esi
pop edi
pop esi
add esp, 0x514
jmp fcn.0045fdc0
xor eax, eax
pop edi
pop esi
add esp, 0x514
ret