joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44d968
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x44daaa
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
je 0x44d999
mov eax, dword [ebp - 0xc]
cmp byte [eax], 0
jne 0x44d9a3
mov ebx, 0x57
jmp 0x44da94
mov eax, dword [0x4bec00]
cmp dword [eax], 2
jne 0x44da84
push 0
push 8
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov al, byte [ebp - 1]
call fcn.0044d8c4
test eax, eax
jne 0x44da84
xor edx, edx
push ebp
push 0x44da7d
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x14]
mov ecx, pe_nt_image_headers32
xor edx, edx
call fcn.00403ba0
xor ebx, ebx
mov eax, dword [ebp - 0x14]
call fcn.00403d38
mov dword [ebp - 0x18], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
call fcn.00403f08
push eax
push ebx
mov eax, dword [ebp - 0x10]
push eax
call fcn.00407478
cmp eax, 0xea
jne 0x44da46
mov eax, dword [ebp - 0x14]
call fcn.00403d38
cmp eax, 0x10000
jge 0x44da66
mov eax, dword [ebp - 0x14]
call fcn.00403d38
mov ecx, eax
add ecx, ecx
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.00403ba0
jmp 0x44d9ee
test eax, eax
jne 0x44da66
mov eax, dword [ebp - 0x14]
call fcn.00403efc
mov ecx, eax
mov edx, dword [ebp - 0x10]
mov al, byte [ebp - 1]
call fcn.0044d968
test eax, eax
je 0x44d9ee
inc ebx
jmp 0x44d9ee
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44da84
mov eax, dword [ebp - 0x10]
push eax
call fcn.00407458
ret
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov al, byte [ebp - 1]
call fcn.0044d8ec
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44dab1
lea eax, [ebp - 0x14]
call fcn.00403ab8
ret

Function at 0x44dab8
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebp, ecx
mov edi, edx
mov ebx, eax
push 0
push 1
lea eax, [esp + 8]
push eax
mov ecx, ebp
mov edx, edi
mov eax, ebx
call fcn.0044d8c4
mov esi, eax
test esi, esi
jne 0x44db36
push 0
push 0
push 0
push 0
lea eax, [esp + 0x18]
push eax
push 0
push 0
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
mov eax, dword [esp + 0x2c]
push eax
call fcn.00407490
mov esi, eax
mov eax, dword [esp]
push eax
call fcn.00407458
test esi, esi
jne 0x44db36
cmp dword [esp + 4], 0
jne 0x44db31
cmp dword [esp + 8], 0
jne 0x44db31
mov ecx, ebp
mov edx, edi
mov eax, ebx
call fcn.0044d8ec
mov esi, eax
jmp 0x44db36
mov esi, 0x91
mov eax, esi
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x44db40
Capabilities:
Check os version
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
mov ebx, eax
mov eax, dword [0x4bec00]
cmp dword [eax], 2
je 0x44db5d
mov byte [ebp - 1], 1
jmp 0x44dd2d
mov byte [ebp - 1], 0
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push 0x20
push 2
push 0x4bdb18
call fcn.00407418
test eax, eax
je 0x44dd2d
xor eax, eax
push ebp
push 0x44dd26
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call fcn.004076a0
and eax, 0xff
cmp ax, 5
jb 0x44dbbf
push 0x44dd38
push 0x44dd50
call fcn.00407640
push eax
call fcn.00407658
mov ebx, eax
test ebx, ebx
je 0x44dbe8
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
call ebx
test eax, eax
je 0x44dd0f
mov eax, dword [ebp - 0xc]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 1], al
jmp 0x44dd0f
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
push 0xffffffffffffffff
push 8
call fcn.004075c0
push eax
call fcn.00407450
test eax, eax
jne 0x44dc39
call fcn.00407618
cmp eax, 0x3f0
je 0x44dc1a
call fcn.00403628
jmp 0x44dd2d
lea eax, [ebp - 0x10]
push eax
push 8
call fcn.004075b0
push eax
call fcn.00407448
test eax, eax
jne 0x44dc39
call fcn.00403628
jmp 0x44dd2d
xor eax, eax
push ebp
push 0x44dd08
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 2
mov eax, dword [ebp - 0x10]
push eax
call fcn.00407430
test eax, eax
jne 0x44dc7c
call fcn.00407618
cmp eax, 0x7a
je 0x44dc7c
call fcn.00403628
call fcn.00403628
jmp 0x44dd2d
mov eax, dword [ebp - 0x14]
call fcn.0040271c
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 2
mov eax, dword [ebp - 0x10]
push eax
call fcn.00407430
test eax, eax
jne 0x44dcae
call fcn.00403628
call fcn.00403628
jmp 0x44dd2d
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
dec esi
test esi, esi
jl 0x44dce9
inc esi
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 4]
push eax
mov eax, dword [ebp - 8]
push eax
call fcn.00407420
test eax, eax
je 0x44dce5
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 8]
and eax, 0x14
cmp eax, 4
jne 0x44dce5
mov byte [ebp - 1], 1
jmp 0x44dce9
inc ebx
dec esi
jne 0x44dcbb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44dd0f
mov eax, dword [ebp - 0x18]
call fcn.00402734
mov eax, dword [ebp - 0x10]
push eax
call fcn.004074a8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44dd2d
mov eax, dword [ebp - 8]
push eax
call fcn.00407428
ret
mov al, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44e5b8
Capabilities:
Check if file exists
Move file

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x44e655
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4bec00]
cmp dword [eax], 2
jne 0x44e5fb
push 1
mov eax, esi
call fcn.00403efc
push eax
mov eax, edi
call fcn.00403efc
push eax
call fcn.00407758
neg eax
sbb ebx, ebx
neg ebx
jmp 0x44e63f
mov eax, esi
call fcn.00403efc
mov edx, eax
lea eax, [ebp - 4]
call fcn.00403c70
mov eax, dword [ebp - 4]
call fcn.00409e00
mov ebx, eax
test bl, bl
jne 0x44e624
call fcn.00407618
cmp eax, 2
jne 0x44e63f
mov eax, esi
call fcn.00403efc
push eax
mov eax, edi
call fcn.00403efc
push eax
call fcn.00407750
neg eax
sbb ebx, ebx
neg ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44e65c
lea eax, [ebp - 4]
call fcn.00403ab8
ret

Function at 0x450f98
Capabilities:
Hash data using sha1

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
xor edx, edx
mov dword [eax + 0x14], edx
xor edx, edx
mov dword [eax + 0x18], edx
ret
Function at 0x46cff8
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push ebx
xor ebx, ebx
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call fcn.004076a8
test eax, eax
je 0x46d044
cmp dword [ebp - 0x84], 2
jne 0x46d044
cmp dword [ebp - 0x90], 5
ja 0x46d042
cmp dword [ebp - 0x90], 5
jne 0x46d044
cmp dword [ebp - 0x8c], 1
jb 0x46d044
mov bl, 1
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x471178
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov byte [0x4bf9b4], 0
mov eax, dword [0x4bec00]
cmp dword [eax], 2
jne 0x4711ac
mov dword [esp], 0x94
push esp
call fcn.004076a8
test eax, eax
je 0x4711ac
cmp dword [esp + 4], 5
setae byte [0x4bf9b4]
add esp, 0x94
ret

Function at 0x472b24
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x4bfaa0
mov eax, esi
mov edx, 8
test al, 1
je 0x472b40
shr eax, 1
xor eax, 0xedb88320
jmp 0x472b42
shr eax, 1
dec edx
jne 0x472b33
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x472b2c
pop esi
ret

Function at 0x472b58
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x4bfa9c], 0
jne 0x472b7b
call fcn.00472b24
push 1
push 0x4bfa9c
call fcn.00407578
mov eax, edi
test esi, esi
je 0x472ba7
mov edx, ebx
and edx, 0xff
xor ecx, ecx
mov cl, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x4bfaa0]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x472b81
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x4735e8
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
ret

Function at 0x4742fc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
mov byte [ebp - 5], 0
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.00403efc
mov edi, eax
push edi
call fcn.00407890
mov ebx, eax
test ebx, ebx
jle 0x47439e
mov eax, ebx
call fcn.0040271c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x474397
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
push edi
call fcn.00407888
test eax, eax
je 0x474381
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x4743c0
mov eax, dword [ebp - 0x10]
push eax
call fcn.00407898
test eax, eax
je 0x474381
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4743b5
mov eax, dword [ebp - 0x10]
call fcn.00402734
ret
mov eax, dword [0x4bec00]
cmp dword [eax], 1
je 0x4743b5
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00474120
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4745dc
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00474590
test al, al
jne 0x4745fd
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x47464b
xor eax, eax
push ebp
push 0x47463b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, esi
call fcn.00403efc
push eax
call fcn.004074c8
mov dword [ebp - 4], eax
call fcn.00407618
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474642
lea eax, [ebp - 0xc]
call fcn.004745cc
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x474654
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00474590
test al, al
jne 0x474678
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4746de
xor eax, eax
push ebp
push 0x4746ce
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x1c]
push eax
mov eax, dword [ebp + 0x20]
push eax
mov eax, dword [ebp + 0x24]
push eax
push edi
push esi
call fcn.004074f8
mov dword [ebp - 4], eax
call fcn.00407618
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4746d5
lea eax, [ebp - 0xc]
call fcn.004745cc
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20

Function at 0x4746ec
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00474590
test al, al
jne 0x474710
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x474768
xor eax, eax
push ebp
push 0x474758
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov eax, edi
call fcn.00403efc
push eax
mov eax, esi
call fcn.00403efc
push eax
call fcn.004074c0
mov dword [ebp - 4], eax
call fcn.00407618
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47475f
lea eax, [ebp - 0xc]
call fcn.004745cc
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x474774
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00474590
test al, al
jne 0x474795
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4747e1
xor eax, eax
push ebp
push 0x4747d1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403efc
push eax
call fcn.00407510
mov dword [ebp - 4], eax
call fcn.00407618
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4747d8
lea eax, [ebp - 0xc]
call fcn.004745cc
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47494c
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00474590
test al, al
jne 0x47496f
mov dword [ebp - 4], 0xffffffff
jmp 0x4749bb
xor eax, eax
push ebp
push 0x4749ab
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403efc
push eax
call fcn.00407600
mov dword [ebp - 4], eax
call fcn.00407618
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4749b2
lea eax, [ebp - 0xc]
call fcn.004745cc
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x474aec
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00474590
test al, al
jne 0x474b10
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x474b64
xor eax, eax
push ebp
push 0x474b54
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00403efc
push eax
mov eax, esi
call fcn.00403efc
push eax
call fcn.00407750
mov dword [ebp - 4], eax
call fcn.00407618
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474b5b
lea eax, [ebp - 0xc]
call fcn.004745cc
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x474b70
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 8]
test edi, edi
jne 0x474b93
test esi, 4
je 0x474b93
xor edi, edi
jmp 0x474b9c
mov eax, edi
call fcn.00403efc
mov edi, eax
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.00474590
test al, al
jne 0x474bb1
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x474c00
xor eax, eax
push ebp
push 0x474bf0
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
push edi
mov eax, dword [ebp - 4]
call fcn.00403efc
push eax
call fcn.00407758
mov dword [ebp - 8], eax
call fcn.00407618
mov dword [ebp - 0x14], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474bf7
lea eax, [ebp - 0x10]
call fcn.004745cc
ret
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x474c7c
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00474590
test al, al
jne 0x474c9d
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x474ce9
xor eax, eax
push ebp
push 0x474cd9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403efc
push eax
call fcn.00407798
mov dword [ebp - 4], eax
call fcn.00407618
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474ce0
lea eax, [ebp - 0xc]
call fcn.004745cc
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x474cf4
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00474590
test al, al
jne 0x474d18
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x474d65
xor eax, eax
push ebp
push 0x474d55
push dword fs:[eax]
mov dword fs:[eax], esp
push edi
mov eax, esi
call fcn.00403efc
push eax
call fcn.004077c0
mov dword [ebp - 4], eax
call fcn.00407618
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474d5c
lea eax, [ebp - 0xc]
call fcn.004745cc
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4758e4
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4758ec
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4759d9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.0044d4c8
mov edx, dword [ebp - 8]
mov ecx, 0x4759f0
xor eax, eax
call fcn.00475670
push 0
mov eax, dword [ebp - 4]
call fcn.00403efc
push eax
call fcn.004074c8
test eax, eax
jne 0x4759a7
call fcn.00407618
mov ebx, eax
cmp ebx, 0xb7
je 0x475906
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 4]
mov al, 0x2f
call fcn.004731d0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.00409ca8
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x24]
mov eax, ebx
call fcn.0044e218
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x18]
mov ecx, 2
mov al, 0x60
call fcn.004731a0
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x408a18]
call fcn.0040c3f4
call fcn.00403588
jmp 0x475906
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00403b0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4759e0
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00403adc
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403adc
ret
Function at 0x477018
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x18]
call fcn.00403eec
xor eax, eax
push ebp
push 0x4770fb
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp + 0x18], 0
jne 0x47705f
lea edx, [ebp + 0x18]
mov eax, edi
call fcn.0044c320
cmp dword [ebp + 0x18], 0
jne 0x47705f
lea eax, [ebp + 0x18]
call fcn.0044d418
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x3c
call fcn.00402acc
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x540
test ebx, ebx
je 0x47708a
mov eax, ebx
call fcn.00403efc
mov dword [ebp - 0x34], eax
mov eax, edi
call fcn.00403efc
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
call fcn.00403efc
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x18]
call fcn.00403efc
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
push eax
call fcn.0044c6f0
neg eax
sbb ebx, ebx
neg ebx
test bl, bl
jne 0x4770cc
call fcn.00407618
mov dword [esi], eax
jmp 0x4770e5
mov dword [esi], 0x103
mov eax, dword [ebp - 8]
test eax, eax
je 0x4770e5
push esi
mov ecx, dword [ebp + 0xc]
mov dl, byte [ebp + 0x14]
call fcn.00476cf8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x477102
lea eax, [ebp + 0x18]
call fcn.00403ab8
ret

Function at 0x4772e8
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffec
mov ebx, eax
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
call fcn.004075a0
test eax, eax
je 0x477316
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x10
call fcn.00403ce8
jmp 0x47731d
mov eax, ebx
call fcn.00403ab8
add esp, 0x14
pop ebx
ret

Function at 0x477324
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
mov dword [esp], 0x101
push esp
lea eax, [esp + 8]
push eax
call fcn.00407438
test eax, eax
je 0x477355
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x101
call fcn.00403ce8
jmp 0x47735c
mov eax, ebx
call fcn.00403ab8
add esp, 0x108
pop ebx
ret

Function at 0x47736c
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffec
mov eax, dword [0x4bec00]
cmp dword [eax], 2
jne 0x4773d4
push esp
push 0x28
call fcn.004075b0
push eax
call fcn.00407448
test eax, eax
jne 0x47738f
xor eax, eax
jmp 0x4773e3
lea eax, [esp + 8]
push eax
push 0x4773e8
push 0
call fcn.00407440
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call fcn.00477364
call fcn.00407618
test eax, eax
je 0x4773d4
xor eax, eax
jmp 0x4773e3
push 0
push 2
call fcn.00407c20
neg eax
sbb eax, eax
neg eax
add esp, 0x14
ret
Function at 0x4773fc
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x477456
inc esi
xor edi, edi
cmp edi, 1
jne 0x477422
mov eax, dword [ebp + 0xc]
push eax
call fcn.004077f8
jmp 0x477430
cmp edi, 1
jle 0x477430
mov eax, dword [ebp + 8]
push eax
call fcn.004077f8
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00474774
test eax, eax
jne 0x477456
call fcn.00407618
cmp eax, 2
je 0x477456
call fcn.00407618
cmp eax, 3
je 0x477456
inc edi
dec esi
jne 0x477412
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x477b24
Capabilities:
Delete registry value

Disassembly:
push ebx
push esi
push ecx
mov ebx, edx
mov esi, eax
push 0
push 2
lea eax, [esp + 8]
push eax
call fcn.0044d6a0
and eax, 0x7f
mov ecx, dword [eax*4 + 0x4be064]
mov edx, 0x80000002
xor eax, eax
call fcn.0044d8c4
test eax, eax
jne 0x477b6e
mov eax, esi
call fcn.00403efc
push eax
mov eax, dword [esp + 4]
push eax
call fcn.00407470
mov eax, dword [esp]
push eax
call fcn.00407458
mov eax, ebx
call fcn.00403efc
push eax
call fcn.00407a30
test eax, eax
je 0x477b8f
push 0
push 0
push 0x1d
push 0xffff
call fcn.00407f10
pop edx
pop esi
pop ebx
ret
Function at 0x477b94
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov edi, ecx
mov esi, edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x477cdc
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x477cf0
push 0x477d04
call fcn.00407640
push eax
call fcn.00407658
mov ebx, eax
lea edx, [ebp - 0xc]
mov al, byte [ebp - 1]
call fcn.00474590
test al, al
jne 0x477bf2
mov byte [ebp - 2], 0
jmp 0x477cc1
xor eax, eax
push ebp
push 0x477cba
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x477c36
push 0
mov eax, dword [ebp + 8]
push eax
push edi
lea edx, [ebp - 0x24]
mov eax, esi
call fcn.0044c280
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.0044bec0
mov eax, dword [ebp - 0x20]
call fcn.00403efc
push eax
call ebx
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 2], al
jmp 0x477ca4
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x30]
mov eax, esi
call fcn.0044c280
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
call fcn.0044c348
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.0044bec0
mov eax, dword [ebp - 0x28]
call fcn.00403efc
push eax
call fcn.004075e0
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 2], al
cmp byte [ebp - 2], 0
je 0x477ca4
mov ecx, edi
mov eax, dword [ebp - 0x14]
imul dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
call fcn.00450dd4
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x14]
imul dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.00450dd4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x477cc1
lea eax, [ebp - 0xc]
call fcn.004745cc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x477ce3
lea eax, [ebp - 0x30]
mov edx, 5
call fcn.00403adc
ret