joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433d90
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5df98b
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x67432c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00451fed
test al, al
je 0x433ddb
push 0xc6d25a88
mov eax, 0x61a9f09
mov bl, 0xd6
invalid
xor eax, eax
mov dword [ebp - 0x24c], 0
mov dword [ebp - 0x234], 7
mov dword [ebp - 0x238], 0
mov word [ebp - 0x248], ax
push 0x208
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x218]
push eax
call fcn.00480620
add esp, 0xc
lea ecx, [ebp - 0x248]
push 0x43
push str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
call fcn.00402ac0
cmp dword [ebp - 0x234], 8
lea ecx, [ebp - 0x24c]
push ecx
push 0xf013f
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
mov dword [ebp - 0x250], ebx
call fcn.0045225a
test al, al
je 0x433e7b
sub al, 0xe8
iretd
call fcn.004525db
test al, al
je 0x433eaa
sub dh, bh
xor al, cl
ljmp 0x9494
mov edi, dword [ebx + edi - 0x74add942]
popfd
mov al, 0xfd
invalid
call fcn.00451fed
test al, al
je 0x433ed1
xlatb
rcl byte [edi + 4], 0xf7
fcmovne st(0), st(3)
dec esi
pushal
loopne 0x433e9e
retf
test ebx, ebx
jne 0x433f99
push 0x19
xor eax, eax
mov dword [ebp - 0x21c], 7
push str.WanNengWB_Shell_Extension
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], ax
call fcn.00402ac0
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x230]
nop
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x433f20
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x433f40
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push str.B2A6906E_67AA_4613_B7ED_1CEB63834F37
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x21c]
cmp eax, 8
jb 0x433f99
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.00402c10
call fcn.00451fed
test al, al
je 0x433fb6
xor ecx, 0xaf317a0e
enter 0x190a, 0x10
test dword [ecx - 7], 0xf943fe02
cmpsd dword [esi], dword es:[edi]
and ecx, dword [ecx - 0x75]
test esp, ecx
std
invalid
mov eax, dword [ebp - 0x234]
cmp eax, 8
jb 0x433fd4
inc eax
lea ecx, [ebp - 0x248]
push eax
push dword [ebp - 0x248]
call fcn.00402c10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046d802
mov esp, ebp
pop ebp
ret
Function at 0x438080
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x67432c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
push 0x208
push 0
push eax
call fcn.00480620
push esi
lea eax, [ebp - 0x20c]
push str.SYSTEMCurrentControlSet_services_s
push eax
call fcn.00407df0
add esp, 0x18
call fcn.004524c7
test al, al
je 0x4380dc
int1
invalid
lea eax, [ebp - 0x210]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0x20c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x438115
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046d802
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x218]
mov dword [ebp - 0x214], 0
push eax
lea eax, [ebp - 0x214]
mov dword [ebp - 0x218], 4
push eax
push 0
push 0
push str.Start
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.004523f8
test al, al
je 0x43817c
into
or al, 0x5f
mov al, ah
ljmp 0xfbc0
call fcn.0045225a
test al, al
je 0x43819a
mov ebx, 0xa5aff43b
imul ebx, dword [ebx - 0x7c], 0xffffffac
insd dword es:[edi], dx
mov ebp, 0xd3aa0c41
push ds
push 0xaafdba93
call fcn.004523b3
test al, al
je 0x4381b5
and dword [eax + 0x49], eax
dec edi
cli
cdq
lcall 0x8f08, 0x5f432e3b
iretd
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [ebp - 0x214], 2
pop edi
sete al
xor ecx, ebp
pop esi
pop ebx
call fcn.0046d802
mov esp, ebp
pop ebp
ret 4
Function at 0x447d00
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e1723
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x67432c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x6794b4
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ebp - 4], 0
mov dword [ecx], 0x6794b4
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
push 0
push 0x5e674a
mov byte [ebp - 4], 1
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.0044b930
mov dword [esi + 0x40], 0
mov eax, esi
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x44e550
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor eax, eax
mov edx, eax
mov ecx, eax
and edx, 1
shr ecx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov dword [eax*4 + 0x67d9a0], ecx
inc eax
cmp eax, 0x100
jb 0x44e552
cmp eax, 0x800
jae 0x44e623
nop
mov edx, dword [eax*4 + 0x67d5a0]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x67d9a0]
mov dword [eax*4 + 0x67d9a0], edx
inc eax
cmp eax, 0x800
jb 0x44e600
mov dword [0x6794c0], 0x44f3c0
call fcn.0044f1f0
mov ecx, dword [0x6794c0]
test eax, eax
mov edx, 0x44f460
cmove ecx, edx
mov dword [0x6794c0], ecx
ret
Function at 0x44f740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
sub esp, 0x10
mov ecx, dword [ebp + 0xc]
mov eax, dword [eax]
push ebx
xor ebx, ebx
and eax, 7
cmp ecx, 5
jae 0x44f760
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
add dword [ebp + 0x10], 5
lea edx, [ecx - 4]
push esi
mov esi, dword [ebp + 8]
push edi
or edi, 0xffffffff
add edx, esi
mov dword [ebp - 4], edx
add esi, ebx
mov dword [ebp + 0xc], esi
cmp esi, edx
jae 0x44f792
nop dword [eax]
mov cl, byte [esi]
and cl, 0xfe
cmp cl, 0xe8
je 0x44f78f
inc esi
cmp esi, edx
jb 0x44f780
mov dword [ebp + 0xc], esi
mov ebx, esi
sub ebx, dword [ebp + 8]
mov ecx, ebx
sub ecx, edi
cmp esi, edx
jae 0x44f8bc
cmp ecx, 3
jbe 0x44f7d2
xor eax, eax
mov cl, byte [esi + 4]
mov edi, ebx
mov dword [ebp - 0x10], edi
test cl, cl
je 0x44f810
cmp cl, 0xff
je 0x44f810
mov edx, dword [ebp - 4]
and eax, 3
mov esi, dword [ebp + 8]
add eax, eax
mov ecx, 1
or eax, 1
add ebx, ecx
jmp 0x44f774
dec ecx
shl eax, cl
and eax, 7
je 0x44f7aa
movzx ecx, byte [eax + 0x5eb254]
mov edx, esi
sub edx, ecx
cmp byte [eax + 0x5eb24c], 0
mov cl, byte [edx + 4]
je 0x44f7fa
test cl, cl
je 0x44f7fa
cmp cl, 0xff
jne 0x44f7aa
mov edx, dword [ebp - 4]
and eax, 3
mov esi, dword [ebp + 8]
add eax, eax
mov edi, ebx
or eax, 1
inc ebx
jmp 0x44f774
movzx edi, cl
movzx ecx, byte [esi + 3]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 2]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 1]
mov esi, dword [ebp + 0x10]
shl edi, 8
or edi, ecx
cmp dword [ebp + 0x18], 0
je 0x44f83e
lea edx, [edi + ebx]
add edx, esi
jmp 0x44f844
mov edx, edi
sub edx, ebx
sub edx, esi
test eax, eax
je 0x44f882
movzx edi, byte [eax + 0x5eb254]
mov ecx, 0x18
shl edi, 3
sub ecx, edi
mov dword [ebp - 0xc], edi
mov edi, edx
shr edi, cl
mov ecx, edi
mov dword [ebp - 8], edi
test cl, cl
je 0x44f86e
cmp cl, 0xff
jne 0x44f882
mov ecx, 0x20
mov edi, 1
sub ecx, dword [ebp - 0xc]
shl edi, cl
dec edi
xor edi, edx
jmp 0x44f831
mov esi, dword [ebp + 0xc]
mov ecx, edx
mov edi, dword [ebp - 0x10]
shr ecx, 0x18
and cl, 1
dec cl
mov byte [esi + 1], dl
not cl
mov byte [esi + 4], cl
mov ecx, edx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, edx
mov edx, dword [ebp - 4]
shr ecx, 8
mov byte [esi + 2], cl
mov ecx, 5
mov esi, dword [ebp + 8]
add ebx, ecx
jmp 0x44f774
pop edi
pop esi
cmp ecx, 3
jbe 0x44f8d1
mov ecx, dword [ebp + 0x14]
xor eax, eax
mov dword [ecx], eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
dec ecx
shl eax, cl
mov ecx, dword [ebp + 0x14]
and eax, 7
mov dword [ecx], eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x454832
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 0
push 0x80
push 2
push 0
xor ebx, ebx
inc ebx
push ebx
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 8], esi
cmp esi, 0xffffffff
jne 0x454868
xor eax, eax
jmp 0x454919
call fcn.004524c7
test al, al
je 0x454889
fdiv st(7), st(0)
inc dword [eax + eax*8 - 0x3d3e78c]
sub al, 0xfc
invalid
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push 0
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004523f8
test al, al
je 0x4548ce
sub dh, byte [edx - 0x73]
loop 0x45486a
das
sbb dh, byte [ecx]
push esp
pop edi
test dword [edx + 0x4e885a01], edi
invalid
call fcn.0045225a
test al, al
je 0x4548ec
adc dh, byte [edi + eax*2 - 0x53580628]
mov ecx, dword [eax]
fldln2
sbb dword [eax + 0x1a27702], ebx
ror dword [edx], 1
dec dh
call fcn.004523b3
test al, al
je 0x454907
sbb esi, ebp
pop es
sbb eax, 0x80c8d483
push edi
mov ch, byte [esi + 0x59]
inc esp
adc eax, edx
push esp
hlt
cmp dword [ebp - 8], 0
je 0x454915
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 4]
je 0x454917
xor ebx, ebx
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4584c0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x67432c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00480620
push 0x5e6c34
lea eax, [ebp - 0x20c]
push str.C:log_s.log
push eax
call fcn.00407df0
add esp, 0x18
call fcn.00451f63
test al, al
je 0x45851a
mov ecx, 0xd7fc9376
arpl word [ecx], bx
xor al, 0x35
sub esp, dword [eax + 0x1c3540f5]
add cl, byte [ebp - 0x20b7b]
call dword [eax - 1]
adc eax, sym.imp.SHLWAPI.dll_PathFileExistsW
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp - 4]
neg eax
pop edi
sbb eax, eax
xor ecx, ebp
neg eax
pop esi
call fcn.0046d802
mov esp, ebp
pop ebp
ret
Function at 0x458634
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2018
call fcn.0046d920
mov eax, dword [0x67432c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x200c], edi
mov dword [ebp - 0x2008], eax
call fcn.004584c0
test eax, eax
je 0x4587de
xor ebx, ebx
push ebx
call fcn.00483f7c
mov dword [ebp - 0x2018], eax
lea eax, [ebp - 0x2018]
push eax
mov dword [ebp - 0x2014], edx
call fcn.0048ccee
pop ecx
pop ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push dword [ebp - 0x2008]
mov ecx, dword [esi + 0x10]
push eax
push dword [esi]
mov eax, dword [esi + 0x14]
inc ecx
push dword [esi + 4]
add eax, 0x76c
push dword [esi + 8]
push dword [esi + 0xc]
push ecx
push eax
lea eax, [ebp - 0x2004]
push str.__d__d__d__d__d__d___d_:_s
push eax
call fcn.004582f1
add esp, 0x28
call fcn.00452329
test al, al
je 0x4586ec
invalid
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor esi, esi
inc esi
test eax, eax
cmovne ebx, esi
mov dword [ebp - 0x200c], ebx
call fcn.00452596
test al, al
je 0x45871d
xor eax, dword [edi - 0x6953742]
sbb cl, byte [ebx - 0x24]
insb byte es:[edi], dx
invalid
push 0x5eb294
push edi
call fcn.0048d829
mov ebx, eax
mov dword [ebp - 0x2010], ebx
pop ecx
pop ecx
test ebx, ebx
je 0x4587de
cmp dword [ebp - 0x200c], 0
jne 0x458760
push ebx
push 2
lea eax, [ebp - 0x200c]
mov dword [ebp - 0x200c], 0xfeff
push esi
push eax
call fcn.0048ecbb
add esp, 0x10
call fcn.004524c7
test al, al
je 0x458781
dec eax
cmp ecx, dword [0xdd026e9a]
popfd
in al, dx
push edi
pop ss
js 0x458788
mov eax, 0x895176c8
mov ebx, dword [ebp - 0x2010]
lea eax, [ebp - 0x2004]
push eax
call fcn.0048ed77
push ebx
add eax, eax
push eax
lea eax, [ebp - 0x2004]
push 1
push eax
call fcn.0048ecbb
push ebx
push 2
lea eax, [ebp - 0x2008]
mov dword [ebp - 0x2008], 0xd
push 1
push eax
call fcn.0048ecbb
push ebx
push 2
lea eax, [ebp - 0x2008]
mov dword [ebp - 0x2008], 0xa
push 1
push eax
call fcn.0048ecbb
push ebx
call fcn.0048d627
add esp, 0x38
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046d802
mov esp, ebp
pop ebp
ret
Function at 0x458c36
Capabilities:
Check if file exists
Create directory

Disassembly:
invalid
int 0x5b
call fcn.0046d802
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.0048ed77
mov dword [ebp - 8], eax
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046d813
push dword [ebp + 8]
mov edi, eax
push edi
mov dword [ebp - 4], edi
call fcn.0048edc3
add esp, 0x10
call fcn.00452596
test al, al
je 0x458c89
xchg byte [eax + 0x5b6bcc97], bl
outsd dx, dword [esi]
push esp
xchg edx, eax
dec eax
sbb al, 0xc5
aaa
jle 0x458c2b
jge 0x458c15
mov eax, dword [ebp - 8]
inc ebp
clc
xor esi, esi
xor ebx, ebx
inc esi
mov dword [ebp - 0xc], ebx
test eax, eax
js 0x458d53
cmp word [edi + ebx*2], 0x5c
jne 0x458d44
call fcn.004522e4
test al, al
je 0x458cc4
pop ecx
inc eax
add eax, 0xab846288
dec eax
pop ds
js 0x458ca1
lock xor byte [edi], bl
jle 0xc721b418
call fcn.00452101
test al, al
je 0x458cee
xor al, 2
mov ecx, 0x1f17e0fc
pop ecx
push ds
sbb bl, byte [edi + edx*2]
ret
call fcn.004521d0
test al, al
je 0x458d19
pop ds
or dword [ecx - 0x13], eax
jo 0x458d42
cmp ebx, dword [eax]
push ebp
sub bh, byte [eax + 0x7a]
in eax, 0xbf
mov bh, 0xc0
adc bl, byte [ecx - 0x6a]
insd dword es:[edi], dx
inc ebx
inc ebx
fidivr dword [eax + 0x679a2843]
sbb dh, al
xchg ebx, eax
mov edi, dword [ebp - 4]
mov ebx, dword [ebp - 0xc]
xor eax, eax
push edi
movzx esi, word [edi + ebx*2]
mov word [edi + ebx*2], ax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x458d3d
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x458d63
mov eax, dword [ebp - 8]
mov word [edi + ebx*2], si
xor al, 0x5f
inc ebx
mov dword [ebp - 0xc], ebx
cmp ebx, eax
jle 0x458c9c
xor esi, esi
inc esi
push edi
call fcn.0046d81c
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor esi, esi
jmp 0x458d53
Function at 0x45903a
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x67432c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x20c]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x218], eax
xor eax, eax
push eax
push 0x1a
push ecx
push eax
mov dword [ebp - 0x210], ebx
call fcn.0045a15d
lea eax, [ebp - 0x20c]
push eax
call fcn.0048ed77
add esp, 0x14
mov dword [ebp - 0x214], eax
call fcn.00452077
test al, al
je 0x4590b1
out 0x3c, al
sub eax, 0x5883149
ror dword [ecx], 0x13
adc byte [esi], ch
invalid
cmp dword [ebp - 0x214], 0
je 0x4591bd
mov esi, 0x5e6bac
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0048ed92
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.0048ed92
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0048ed92
add esp, 0x18
call fcn.00452620
test al, al
je 0x459111
inc edi
or byte [ebx], dh
in al, 0xc6
xchg edi, eax
push edx
aad 0x24
lodsb al, byte [esi]
ret
jb 0x459132
popfd
push cs
mov ch, 0xab
mov byte [edi - 0x6ea13613], bl
inc byte [esi - 0xb7a72ac]
std
invalid
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x45912f
lea eax, [ebp - 0x20c]
push eax
call fcn.00458c36
pop ecx
call fcn.00452146
test al, al
je 0x45914c
invalid
js 0x45911e
add eax, 0x5e7e847d
cmp al, 0xeb
xchg edi, eax
jg 0x459153
cmp byte [0x44e48b25], bh
or esp, 0xff92a7e8
inc dword [eax + eax*8 - 0x5489e38c]
call fcn.004523f8
test al, al
je 0x459171
jbe 0x459102
mov ah, 0x12
invalid
call fcn.00452620
test al, al
je 0x45918f
push edx
das
fld st(4)
scasb al, byte es:[edi]
lea ecx, [edx*2 + 0x3ff254be]
pop ds
mov ch, 0x59
jae 0x4591f5
fst dword [esi - 0x7c994197]
mov ebp, 0xfffffdf4
add byte [ebp + 4], dh
cmp word [ebp - 0x20c], 0
jne 0x45919d
xor eax, eax
jmp 0x4591aa
lea eax, [ebp - 0x20c]
push eax
call fcn.0048ed77
pop ecx
mov ecx, dword [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00402ac0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046d802
mov esp, ebp
pop ebp
ret
add byte [ecx - 0x2137b], cl
dec dword [ebp - 0x20f7b]
jmp [edx]
Function at 0x45a15d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
call fcn.00459419
xor edi, edi
inc edi
test al, al
je 0x45a1fa
call fcn.0045218b
test al, al
je 0x45a199
mov edi, dword [eax - 0x3b5cc5a8]
pop esi
pop ss
cmp ecx, dword [eax + 0x10]
xchg ecx, eax
xchg ebx, eax
pop ebx
pop edx
or dword [ebx], esi
xor edi, edi
xor ebx, ebx
inc edi
call fcn.00452101
test al, al
je 0x45a1ba
fiadd word [esi - 0x7ced2a8f]
dec eax
outsd dx, dword [esi]
cli
xlatb
sub eax, 0xec8f4754
sub ebx, dword [ebx]
jle 0x45a1ec
mov ah, 0xd7
mov bl, 0x33
fisttp dword [ebp + 0x5d89f845]
clc
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
call fcn.004592ae
pop ecx
test al, al
je 0x45a1fa
push dword [ebp + 0xc]
push edi
push dword [ebp - 8]
push dword [ebp + 0x10]
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
movzx ebx, bl
cmove ebx, edi
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
adc eax, sym.imp.ADVAPI32.dll_RevertToSelf
add bh, bh
jne 0x45a1e8
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x45a245
call fcn.00452215
test al, al
je 0x45a222
sub al, 0x4f
xchg edi, eax
xor byte [ecx - 0x10666b7a], 0xbd
imul ebx, edi, 0x4c633546
int 0x8e
push edx
xchg byte [ebp + 0x1c43507], bl
dec ecx
bound edx, qword [edi + 0x78]
out dx, al
jp 0x45a222
push dword [ebp + 0x14]
jne 0x45a239
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov edx, dword [ebp - 4]
test eax, eax
push 1
movzx ecx, dl
pop eax
cmovne ecx, eax
mov byte [ebp - 4], cl
call fcn.00452620
test al, al
je 0x45a269
cmp ch, 0x20
mov dword [edx], ebp
pop edx
invalid
mov edx, dword [ebp - 4]
mov al, dl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45a50c
Capabilities:
Delete file

Disassembly:
push 0
mov eax, 0x5e2430
call fcn.0046dc86
and dword [ebp - 4], 0
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x45a60b
pop esi
add byte [ebp - 0x2a7af040], al
add byte [eax], al
add al, ch
sar dword [edi - 1], 1
call fcn.0045250c
test al, al
je 0x45a550
inc dword [eax + eax*8 + 0x5fcf1174]
mov edi, 0xe6f80333
test al, 0x89
push ss
jmp 0x1efa8951
iretd
call fcn.00452215
test al, al
je 0x45a578
xchg ebp, eax
dec esp
push eax
cmp al, 0x77
push edi
cld
pop eax
inc ecx
jmp 0x45a5cb
mov edi, dword [0xf475c368]
xor al, 0xe1
dec ecx
enter 0xffffffffffffe8e4, 0xffffffffffffffb5
jp 0x45a57b
call fcn.00452032
test al, al
je 0x45a597
invalid
inc dword [eax + eax*8 - 0x151ee98c]
loope 0x45a56d
jo 0x45a5ee
mov ebx, 0xc833d73a
insb byte es:[edi], dx
insd dword es:[edi], dx
jns 0x45a53a
das
lodsd eax, dword [esi]
int1
cmp ecx, 0x24
adc byte [edx + 0x1c7d8395], al
or byte [ebp + 0x430f0845], cl
inc ebp
or byte [eax - 0x18], dl
fst dword [ecx - 0x17a60001]
jb 0x45a52c
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
call int.00453781
pop ecx
call fcn.00452620
test al, al
je 0x45a5c5
invalid
jnp 0x45a550
invalid
call fcn.00452596
test al, al
je 0x45a5e9
sal byte [ebx + ebx - 0x26], 0x12
ficom dword [edx]
hlt
call fcn.00452551
test al, al
je 0x45a60b
out 0x2c, eax
dec ebx
movsb byte es:[edi], byte [esi]
xchg ebx, eax
stosd dword es:[edi], eax
invalid
push 0
push 1
lea ecx, [ebp + 8]
call fcn.0041ece0
xor eax, eax
inc eax
call fcn.0046dc4f
ret
Function at 0x45b329
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x67432c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, 0x11c
lea eax, [ebp - 0x120]
push esi
push 0
push eax
call fcn.00480620
add esp, 0xc
mov dword [ebp - 0x120], esi
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
call fcn.004523f8
test al, al
je 0x45b39c
xor bh, byte [ebp - 0x22]
pop eax
push edx
out 0x67, eax
push ss
or dword ss:[edx], eax
outsb dx, byte [esi]
jecxz 0x45b3e0
jg 0x45b3aa
xor eax, 0x323d8d35
inc eax
mov dword [eax + eax*2 - 0xc34e6d4], edi
call fcn.0045250c
test al, al
je 0x45b3c3
fmulp st(7)
mov al, byte [0xdf6ec77]
test eax, 0x57920fd6
test byte [0x920fd6a9], 0x57
scasb al, byte es:[edi]
mov esp, 0xc7cb31f9
sbb dword [eax + esi], edx
pushal
jle 0x45b37d
ror byte [ebx - 3], cl
dec ebx
std
out 0x62, al
cmpsd dword [esi], dword es:[edi]
mov edi, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x118]
call fcn.004520bc
test al, al
je 0x45b3f7
out 0xb0, al
cmp byte [ebx - 0x5e], cl
iretd
push esi
pushal
arpl word [ecx - 0x277e62ec], bp
loope 0x45b3be
outsd dx, dword [esi]
jns 0x45b370
pop ds
sahf
das
pop edx
and al, 0x13
mov ah, 0xdb
arpl word [ebx + 0xa7f05ff], ax
cmp edi, 5
jg 0x45b406
cmp esi, 2
jg 0x45b406
xor eax, eax
inc eax
jmp 0x45b408
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046d802
mov esp, ebp
pop ebp
ret