joyce8/EMBER2024-capa huggingface dataset:
Function at 0x58adb4
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov byte [ebp - 1], al
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
cmp byte [ebp - 1], 0
jne 0x58adf6
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov eax, dword [ebp - 0x10]
xor edx, edx
mov dword [esi], eax
mov dword [esi + 4], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [edi], eax
mov dword [edi + 4], edx
jmp 0x58ae14
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dword [esi], eax
mov dword [esi + 4], edx
mov eax, dword [ebp - 0xc]
xor edx, edx
mov dword [edi], eax
mov dword [edi + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x58b068
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405f18
xor eax, eax
push ebp
push 0x58b154
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp - 0xc]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp + 0x14]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp + 0x10]
xor edx, edx
mov dword [eax], edx
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
call fcn.00405f28
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x58b13e
mov byte [ebp - 0xd], 1
mov eax, ebx
call fcn.00402fc0
mov esi, eax
push esi
push ebx
push 0
push edi
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x58b168
push esi
call sub.version.dll_VerQueryValueA
mov eax, dword [ebp - 0x18]
mov edx, dword [eax + 8]
mov ecx, edx
shr ecx, 0x10
mov edi, dword [ebp - 8]
mov dword [edi], ecx
mov ecx, edx
and ecx, 0xffff
mov edi, dword [ebp - 0xc]
mov dword [edi], ecx
mov ecx, dword [ebp + 0xc]
mov dword [ecx], edx
mov edx, dword [eax + 0xc]
mov ecx, edx
shr ecx, 0x10
mov edi, dword [ebp + 0x14]
mov dword [edi], ecx
mov ecx, edx
and ecx, 0xffff
mov edi, dword [ebp + 0x10]
mov dword [edi], ecx
mov ecx, dword [ebp + 8]
mov dword [ecx], edx
mov edx, ebx
mov eax, esi
call fcn.00402fdc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58b15b
lea eax, [ebp - 4]
call fcn.00405a98
ret
Function at 0x58b188
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff60
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0xa0], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x58b290
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x98], 0x94
lea eax, [ebp - 0x98]
push eax
call sub.kernel32.dll_GetVersionExA
cmp dword [ebp - 0x88], 2
sete byte [edi]
mov eax, dword [ebp - 0x94]
test eax, eax
jns 0x58b1e9
call fcn.00404a00
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 0x90]
test eax, eax
jns 0x58b1fd
call fcn.00404a00
mov dword [ebx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jne 0x58b223
cmp dword [ebx], 0xa
jne 0x58b223
cmp byte [edi], 0
jne 0x58b223
cmp dword [ebp - 0x8c], 0x40a08ae
jb 0x58b223
mov dword [ebx], 0xb
xor eax, eax
mov dword [esi], eax
mov ebx, 0xa
mov eax, ebx
cdq
push edx
push eax
lea eax, [ebp - 0x9c]
call fcn.0058a1f8
mov eax, dword [ebp - 0x9c]
push eax
lea eax, [ebp - 0xa0]
lea edx, [ebp - 0x84]
mov ecx, 0x80
call fcn.00405d08
mov edx, dword [ebp - 0xa0]
pop eax
call fcn.00406074
test eax, eax
je 0x58b26d
mov dword [esi], ebx
jmp 0x58b272
dec ebx
test ebx, ebx
jne 0x58b22c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58b297
lea eax, [ebp - 0xa0]
mov edx, 2
call fcn.00405abc
ret

Function at 0x58bacc
Capabilities:
Acquire debug privileges

Disassembly:
push ebx
add esp, 0xffffffe8
xor ebx, ebx
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x58bb48
lea eax, [esp + 0xc]
push eax
push 0x58bb50
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
test eax, eax
jne 0x58bb04
mov eax, dword [esp]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x58bb48
mov dword [esp + 8], 1
mov dword [esp + 0x14], 2
lea eax, [esp + 4]
push eax
push 0
push 0
lea eax, [esp + 0x14]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
test eax, eax
jne 0x58bb3d
mov eax, dword [esp]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x58bb48
mov eax, dword [esp]
push eax
call sub.kernel32.dll_CloseHandle_1
mov bl, 1
mov eax, ebx
add esp, 0x18
pop ebx
ret
Function at 0x58bbbc
Capabilities:
Acquire debug privileges

Disassembly:
push ebx
push esi
mov esi, eax
xor ebx, ebx
mov edx, 0x58bd74
mov ecx, 4
mov eax, esi
call fcn.0058bb64
test al, al
je 0x58bd6e
mov edx, 0x58bd8c
mov ecx, 4
mov eax, esi
call fcn.0058bb64
test al, al
je 0x58bd6e
mov edx, 0x58bda0
mov ecx, 4
mov eax, esi
call fcn.0058bb64
test al, al
je 0x58bd6e
mov edx, 0x58bdbc
mov ecx, 4
mov eax, esi
call fcn.0058bb64
test al, al
je 0x58bd6e
mov edx, 0x58bddc
mov ecx, 4
mov eax, esi
call fcn.0058bb64
test al, al
je 0x58bd6e
mov edx, 0x58bdf0
mov ecx, 4
mov eax, esi
call fcn.0058bb64
test al, al
je 0x58bd6e
mov edx, 0x58be08
mov ecx, 4
mov eax, esi
call fcn.0058bb64
test al, al
je 0x58bd6e
mov edx, 0x58be28
mov ecx, 4
mov eax, esi
call fcn.0058bb64
test al, al
je 0x58bd6e
mov edx, 0x58be44
mov ecx, 4
mov eax, esi
call fcn.0058bb64
test al, al
je 0x58bd6e
mov edx, 0x58be5c
mov ecx, 4
mov eax, esi
call fcn.0058bb64
test al, al
je 0x58bd6e
mov edx, 0x58be74
mov ecx, 4
mov eax, esi
call fcn.0058bb64
test al, al
je 0x58bd6e
mov edx, 0x58be94
mov ecx, 4
mov eax, esi
call fcn.0058bb64
test al, al
je 0x58bd6e
mov edx, 0x58beb0
mov ecx, 4
mov eax, esi
call fcn.0058bb64
test al, al
je 0x58bd6e
mov edx, 0x58bec4
mov ecx, 4
mov eax, esi
call fcn.0058bb64
test al, al
je 0x58bd6e
mov edx, 0x58bed8
mov ecx, 4
mov eax, esi
call fcn.0058bb64
test al, al
je 0x58bd6e
mov edx, 0x58bef8
mov ecx, 4
mov eax, esi
call fcn.0058bb64
test al, al
je 0x58bd6e
mov edx, 0x58bf14
mov ecx, 4
mov eax, esi
call fcn.0058bb64
test al, al
je 0x58bd6e
mov edx, 0x58bf2c
mov ecx, 4
mov eax, esi
call fcn.0058bb64
test al, al
je 0x58bd6e
mov bl, 1
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x58bf48
Capabilities:
Check os version

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff64
mov ebp, edx
mov esi, eax
xor ebx, ebx
mov dword [esp + 8], 0x94
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 0xc], 6
jb 0x58c031
xor eax, eax
mov dword [esp + 4], eax
push esi
push 0
push 0x400
call sub.kernel32.dll_OpenProcess
mov edi, eax
test edi, edi
je 0x58c031
lea eax, [esp + 4]
push eax
push 0x18
push edi
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x58c02b
xor esi, esi
xor eax, eax
mov dword [esp], eax
push esp
push 0
push 0
push 0x19
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x58bfe0
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x7a
jne 0x58bfe0
cmp dword [esp], 0
je 0x58bfe0
mov eax, dword [esp]
push eax
push 0
call sub.kernel32.dll_LocalAlloc_1
mov esi, eax
push esp
mov eax, dword [esp + 4]
push eax
push esi
push 0x19
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
je 0x58c017
mov eax, dword [esi]
push eax
call sub.advapi32.dll_GetSidSubAuthorityCount
test eax, eax
je 0x58c017
movzx ebx, byte [eax]
dec ebx
push ebx
mov eax, dword [esi]
push eax
call sub.advapi32.dll_GetSidSubAuthority
mov eax, dword [eax]
mov dword [ebp], eax
mov bl, 1
test esi, esi
je 0x58c021
push esi
call sub.kernel32.dll_LocalFree
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_CloseHandle_1
push edi
call sub.kernel32.dll_CloseHandle_1
mov eax, ebx
add esp, 0x9c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x58e4f8
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405f18
mov eax, dword [ebp - 8]
call fcn.00405f18
xor eax, eax
push ebp
push 0x58e591
push dword fs:[eax]
mov dword fs:[eax], esp
or esi, 0xffffffff
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00405f28
push eax
call sub.advapi32.dll_OpenSCManagerA
mov ebx, eax
test ebx, ebx
jbe 0x58e574
push 4
mov eax, dword [ebp - 8]
call fcn.00405f28
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov edi, eax
test edi, edi
jbe 0x58e56e
lea eax, [ebp - 0x24]
push eax
push edi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x58e568
mov esi, dword [ebp - 0x20]
push edi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
mov ebx, esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58e598
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405abc
ret

Function at 0x58ea18
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push ebx
xor ecx, ecx
mov dword [ebp - 0x60], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405f18
xor eax, eax
push ebp
push 0x58eaf5
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
je 0x58ea55
lea eax, [ebp - 8]
mov edx, 0x58eb0c
call fcn.00405b30
jmp 0x58ea62
lea eax, [ebp - 8]
mov edx, 0x58eb20
call fcn.00405b30
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.00403d74
mov dword [ebp - 0x4c], 0x44
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
lea eax, [ebp - 0x60]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00405db0
mov eax, dword [ebp - 0x60]
call fcn.00405f28
push eax
mov eax, dword [ebp - 4]
call fcn.00405f28
push eax
call sub.kernel32.dll_CreateProcessA
call fcn.004113c8
mov ebx, eax
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_CloseHandle_1
cmp ebx, 1
sbb eax, eax
inc eax
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58eafc
lea eax, [ebp - 0x60]
call fcn.00405a98
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405abc
ret
Function at 0x58f3f4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405f18
mov eax, dword [ebp - 8]
call fcn.00405f18
xor eax, eax
push ebp
push 0x58f549
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
cmp dword [ebp - 4], 0
jne 0x58f43e
cmp dword [ebp - 8], 0
je 0x58f521
mov eax, 0x104
call fcn.00402fc0
mov edi, eax
mov eax, 0x104
call fcn.00402fc0
mov dword [ebp - 0x10], eax
call sub.user32.dll_GetDesktopWindow
push 5
push eax
call sub.user32.dll_GetWindow
mov esi, eax
test esi, esi
je 0x58f512
push 0x104
push edi
push esi
call sub.user32.dll_GetClassNameA
push 0x104
mov eax, dword [ebp - 0x10]
push eax
push esi
call sub.user32.dll_GetWindowTextA
cmp dword [ebp - 4], 0
je 0x58f4ac
lea eax, [ebp - 0x14]
mov edx, edi
call fcn.00405c90
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.0041038c
test eax, eax
setne byte [ebp - 0xa]
jmp 0x58f4b0
mov byte [ebp - 0xa], 1
cmp dword [ebp - 8], 0
je 0x58f4d4
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x10]
call fcn.00405c90
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
call fcn.0041038c
test eax, eax
setne byte [ebp - 0xb]
jmp 0x58f4d8
mov byte [ebp - 0xb], 1
movzx ebx, byte [ebp - 0xa]
and bl, byte [ebp - 0xb]
test byte [ebp - 9], bl
je 0x58f4fc
push 0
push 0
push 0x1f
push esi
call sub.user32.dll_PostMessageA
push 0
push 0
push 0x10
push esi
call sub.user32.dll_PostMessageA
test bl, bl
jne 0x58f512
push 2
push esi
call sub.user32.dll_GetWindow
mov esi, eax
test esi, esi
jne 0x58f46e
mov eax, dword [ebp - 0x10]
call fcn.00402fdc
mov eax, edi
call fcn.00402fdc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58f550
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00405abc
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405abc
ret

Function at 0x58f55c
Capabilities:
Shutdown system

Disassembly:
push ebx
add esp, 0xffffffd8
mov ebx, eax
mov eax, dword [0x5d5110]
cmp dword [eax], 2
jne 0x58f5d6
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x58f5d6
lea eax, [esp + 0xc]
push eax
push 0x58f5ec
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
cmp eax, 1
sbb eax, eax
inc eax
mov dword [esp + 8], 1
mov dword [esp + 0x14], 2
mov edx, 0x10
xor ecx, ecx
mov dword [esp + 4], ecx
test al, al
je 0x58f5d6
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x1c]
push eax
push edx
lea eax, [esp + 0x14]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
push 0
push ebx
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x28
pop ebx
ret
Function at 0x58fbfc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405f18
xor eax, eax
push ebp
push 0x58fd5a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00405a98
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x58fc46
sub eax, 4
mov eax, dword [eax]
mov esi, eax
test esi, esi
jle 0x58fc75
mov ebx, 1
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
movzx edx, byte [edx + ebx - 1]
xor edx, dword [ebp - 0xc]
call fcn.00405c80
mov edx, dword [ebp - 0x10]
mov eax, edi
call fcn.00405d64
inc dword [ebp - 0xc]
inc ebx
dec esi
jne 0x58fc51
lea eax, [ebp - 4]
mov edx, dword [edi]
call fcn.00405b30
mov eax, edi
call fcn.00405a98
mov eax, dword [ebp - 4]
test eax, eax
je 0x58fc92
sub eax, 4
mov eax, dword [eax]
mov esi, eax
test esi, esi
jle 0x58fd2a
mov ebx, 1
mov eax, ebx
and eax, 0x80000001
jns 0x58fcaf
dec eax
or eax, 0xfffffffe
inc eax
dec eax
jne 0x58fd22
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
movzx edx, byte [edx + ebx]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x18]
call fcn.00403bd4
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 4]
movzx edx, byte [edx + ebx - 1]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov cl, 2
call fcn.00403ba4
lea edx, [ebp - 0x18]
lea eax, [ebp - 8]
call fcn.00405cfc
lea eax, [ebp - 0x24]
mov ecx, dword [ebp - 8]
mov edx, 0x58fd70
call fcn.00405db0
mov eax, dword [ebp - 0x24]
call fcn.0040b328
mov edx, eax
lea eax, [ebp - 0x20]
call fcn.00405c80
mov edx, dword [ebp - 0x20]
mov eax, edi
call fcn.00405d64
inc ebx
dec esi
jne 0x58fca1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58fd61
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00405abc
lea eax, [ebp - 0x10]
call fcn.00405a98
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405abc
ret
Function at 0x592344
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
call fcn.00405f18
xor eax, eax
push ebp
push 0x59244b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x59245c
push 0x59246c
call sub.kernel32.dll_GetModuleHandleA_2
push eax
call sub.kernel32.dll_GetProcAddress_1
mov esi, eax
xor ebx, ebx
mov edx, dword [ebp - 4]
mov al, 0x5c
call fcn.005922dc
mov edi, eax
test edi, edi
jle 0x592430
lea eax, [ebp - 8]
push eax
mov ecx, edi
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00405f90
lea eax, [ebp - 0x10]
push eax
push 0x20006
push 0
mov eax, dword [ebp - 8]
call fcn.00405f28
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x592430
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x5923dc
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 8]
push eax
mov ecx, ebx
sub ecx, edi
lea edx, [edi + 1]
mov eax, dword [ebp - 4]
call fcn.00405f90
test esi, esi
je 0x592410
push 0
push pe_nt_image_headers32
mov eax, dword [ebp - 8]
call fcn.00405f28
push eax
mov eax, dword [ebp - 0x10]
push eax
call esi
test eax, eax
sete bl
jmp 0x592427
mov eax, dword [ebp - 8]
call fcn.00405f28
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete bl
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x592452
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405abc
ret
Function at 0x593adc
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 8]
call fcn.00405f18
xor eax, eax
push ebp
push 0x593c7e
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x593c51
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, edi
mov edx, esi
mov eax, ebx
call fcn.005955a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x593c5b
cmp byte [0x5dbc8c], 0
jne 0x593c50
mov eax, dword [ebp + 8]
call fcn.0058f038
lea edx, [ebp - 4]
call fcn.0058f120
cmp dword [0x5dbd74], 3
jne 0x593b83
push dword [ebp - 4]
push dword [0x5dbd14]
push 0x593c98
lea eax, [ebp - 4]
mov edx, 3
call fcn.00405e2c
jmp 0x593b9e
push dword [ebp - 4]
push dword [0x5dbd10]
push 0x593c98
lea eax, [ebp - 4]
mov edx, 3
call fcn.00405e2c
push 2
mov eax, dword [ebp - 4]
call fcn.00405f28
push eax
call sub.kernel32.dll_SetFileAttributesA
lea edx, [ebp - 8]
mov eax, 0x593ca4
call fcn.0058fff8
mov eax, dword [ebp - 8]
call fcn.005936d4
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.004c95c0
push dword [ebp - 4]
lea edx, [ebp - 0xc]
mov eax, dword [ebp + 8]
call fcn.00589d2c
push dword [ebp - 0xc]
push 0x593ccc
lea eax, [ebp - 4]
mov edx, 3
call fcn.00405e2c
mov eax, dword [0x5dbd88]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
je 0x593c50
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0040bbcc
mov eax, dword [ebp - 0x10]
call fcn.0040b938
test al, al
je 0x593c50
lea edx, [ebp - 0x14]
mov eax, 0x593ca4
call fcn.0058fff8
mov eax, dword [ebp - 0x14]
call fcn.005936d4
push eax
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.0040bbcc
mov eax, dword [ebp - 0x18]
pop edx
call fcn.004c95c0
movzx ecx, byte [0x5dbc8d]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00591b08
ret
Function at 0x593cd4
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405f18
xor eax, eax
push ebp
push 0x593e6c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x593e3d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x20
lea edx, [ebp - 0xc]
xor eax, eax
call fcn.00412bb0
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x41c96c]
call fcn.004222bc
mov ebx, eax
push 0xffff
lea eax, [ebp - 0x10]
mov ecx, 0x593e84
mov edx, dword [ebp - 4]
call fcn.00405db0
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x41c96c]
call fcn.004222bc
mov dword [ebp - 8], eax
mov eax, dword [0x5d87f8]
call fcn.0058fd74
call fcn.00402fc0
mov esi, eax
mov eax, dword [0x5d87f8]
call fcn.0058fd74
mov ecx, eax
mov edx, esi
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [0x5d87f8]
call fcn.0058fd74
mov ecx, eax
mov edx, esi
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0x10]
mov eax, esi
call fcn.00402fdc
mov eax, ebx
call fcn.00404b38
push 0x20
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x41c96c]
call fcn.004222bc
mov ebx, eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
call fcn.00402fc0
mov esi, eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov ecx, eax
mov edx, esi
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov ecx, eax
mov edx, esi
mov eax, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi + 0x10]
mov eax, ebx
call fcn.00404b38
mov eax, dword [ebp - 8]
call fcn.00404b38
lea eax, [ebp - 0x14]
mov ecx, 0x593e90
mov edx, dword [ebp - 4]
call fcn.00405db0
mov eax, dword [ebp - 0x14]
call fcn.00405f28
push eax
mov eax, dword [ebp - 4]
call fcn.00405f28
mov ebx, eax
push ebx
call sub.kernel32.dll_MoveFileA
push ebx
lea eax, [ebp - 0x18]
mov ecx, 0x593e84
mov edx, dword [ebp - 4]
call fcn.00405db0
mov eax, dword [ebp - 0x18]
call fcn.00405f28
push eax
call sub.kernel32.dll_MoveFileA
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x593e49
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x593e73
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00405abc
lea eax, [ebp - 4]
call fcn.00405a98
ret

Function at 0x594f08
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push ebx
xor ebx, ebx
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
cmp dword [ebp - 0x90], 5
jb 0x594f37
mov bl, 1
jmp 0x594f4b
cmp dword [ebp - 0x90], 4
jne 0x594f4b
cmp dword [ebp - 0x8c], 0x5a
jb 0x594f4b
mov bl, 1
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5b3a58
Capabilities:
Check os version

Disassembly:
push ebx
add esp, 0xffffff6c
mov ebx, eax
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 4], 6
jb 0x5b3a79
mov al, 1
jmp 0x5b3a7b
xor eax, eax
test al, al
je 0x5b3a8a
mov eax, ebx
call fcn.0048777c
movzx eax, byte [eax + 8]
add esp, 0x94
pop ebx
ret

Function at 0x5b3a94
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
mov eax, dword [esp + 4]
cmp eax, 5
jbe 0x5b3ab4
mov al, 1
jmp 0x5b3aca
cmp eax, 5
jae 0x5b3abd
xor eax, eax
jmp 0x5b3aca
cmp dword [esp + 8], 1
jb 0x5b3ac8
mov al, 1
jmp 0x5b3aca
xor eax, eax
add esp, 0x94
ret