joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42df14
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebp, ecx
mov edi, edx
mov ebx, eax
push 0
push 1
lea eax, [esp + 8]
push eax
mov ecx, ebp
mov edx, edi
mov eax, ebx
call fcn.0042dd1c
mov esi, eax
test esi, esi
jne 0x42df92
push 0
push 0
push 0
push 0
lea eax, [esp + 0x18]
push eax
push 0
push 0
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
mov eax, dword [esp + 0x2c]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
mov esi, eax
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey
test esi, esi
jne 0x42df92
cmp dword [esp + 4], 0
jne 0x42df8d
cmp dword [esp + 8], 0
jne 0x42df8d
mov ecx, ebp
mov edx, edi
mov eax, ebx
call fcn.0042dd44
mov esi, eax
jmp 0x42df92
mov esi, 0x91
mov eax, esi
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x42df9c
Capabilities:
Check os version
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
mov ebx, eax
cmp dword [0x4980dc], 2
je 0x42dfb8
mov byte [ebp - 1], 1
jmp 0x42e187
mov byte [ebp - 1], 0
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push 0x20
push 2
push 0x498788
call sub.advapi32.dll_AllocateAndInitializeSid
test eax, eax
je 0x42e187
xor eax, eax
push ebp
push 0x42e180
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetVersion
and ax, 0xff
cmp ax, 5
jb 0x42e019
push 0x42e190
push 0x42e1a8
call sub.kernel32.dll_GetModuleHandleA_1
push eax
call sub.kernel32.dll_GetProcAddress
mov ebx, eax
test ebx, ebx
je 0x42e042
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
call ebx
test eax, eax
je 0x42e169
mov eax, dword [ebp - 0xc]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 1], al
jmp 0x42e169
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
push 1
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
test eax, eax
jne 0x42e093
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x3f0
je 0x42e074
call fcn.004031bc
jmp 0x42e187
lea eax, [ebp - 0x10]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x42e093
call fcn.004031bc
jmp 0x42e187
xor eax, eax
push ebp
push 0x42e162
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x42e0d6
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x7a
je 0x42e0d6
call fcn.004031bc
call fcn.004031bc
jmp 0x42e187
mov eax, dword [ebp - 0x14]
call fcn.00402648
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x42e108
call fcn.004031bc
call fcn.004031bc
jmp 0x42e187
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
dec esi
test esi, esi
jl 0x42e143
inc esi
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x42e13f
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 8]
and eax, 0x14
cmp eax, 4
jne 0x42e13f
mov byte [ebp - 1], 1
jmp 0x42e143
inc ebx
dec esi
jne 0x42e115
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42e169
mov eax, dword [ebp - 0x18]
call fcn.00402660
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42e187
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_FreeSid
ret
mov al, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4309c0
Capabilities:
Hash data using sha1

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
xor edx, edx
mov dword [eax + 0x14], edx
xor edx, edx
mov dword [eax + 0x18], edx
ret
Function at 0x434d60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov bl, 1
mov eax, dword [ebp + 8]
mov esi, dword [eax - 0x18]
dec esi
test esi, esi
jl 0x434f0c
inc esi
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x10]
mov edx, 5
call fcn.00433bb4
pop ecx
test al, al
jne 0x434da5
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 0xd
call fcn.00435040
xor ebx, ebx
jmp 0x434f0c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x20]
cmp eax, dword [ebp - 0x10]
ja 0x434dc4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 2
call fcn.00435040
xor ebx, ebx
jmp 0x434f0c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x34]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x10]
mov edx, dword [eax + edx*4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x3c]
call fcn.004466bc
test eax, eax
jne 0x434dfc
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 2
call fcn.00435040
xor ebx, ebx
jmp 0x434f0c
test byte [ebp - 0xc], 1
je 0x434f05
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 4]
mov edx, 4
call fcn.00433bb4
pop ecx
test al, al
jne 0x434e30
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 0xd
call fcn.00435040
xor ebx, ebx
jmp 0x434f0c
mov edx, 0x431b98
mov eax, 0xc
call fcn.00403b80
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x434ed8
push dword fs:[eax]
mov dword fs:[eax], esp
mov edi, dword [ebp - 8]
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.004038a4
mov eax, dword [ebp + 8]
push eax
mov eax, edi
call fcn.00403744
mov edx, dword [ebp - 4]
call fcn.00433bb4
pop ecx
test al, al
jne 0x434e9b
mov edx, 0x431b98
mov eax, dword [ebp - 8]
call fcn.00403b94
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 0xd
call fcn.00435040
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x434f0c
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00431040
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x3c]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 8]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x30]
mov edx, dword [ebp - 8]
call fcn.004312d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x434f05
dec esi
jne 0x434d7b
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44ac3c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push ebx
xor ebx, ebx
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x44ac88
cmp dword [ebp - 0x84], 2
jne 0x44ac88
cmp dword [ebp - 0x90], 5
jg 0x44ac86
cmp dword [ebp - 0x90], 5
jne 0x44ac88
cmp dword [ebp - 0x8c], 1
jl 0x44ac88
mov bl, 1
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x450160
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x49a828
mov eax, esi
mov edx, 8
test al, 1
je 0x45017c
shr eax, 1
xor eax, 0xedb88320
jmp 0x45017e
shr eax, 1
dec edx
jne 0x45016f
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x450168
pop esi
ret

Function at 0x4501ab
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x49a824], 0
jne 0x4501b7
call fcn.00450160
push 1
push 0x49a824
call sub.kernel32.dll_InterlockedExchange
mov eax, edi
test esi, esi
je 0x4501e2
mov edx, ebx
and dx, 0xff
xor ecx, ecx
mov cl, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x49a828]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x4501bd
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x450b94
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
ret

Function at 0x451870
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
mov byte [ebp - 5], 0
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.00403738
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jle 0x451912
mov eax, ebx
call fcn.00402648
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x45190b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
push edi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4518f5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x451934
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4518f5
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451928
mov eax, dword [ebp - 0x10]
call fcn.00402660
ret
cmp dword [0x4980dc], 1
je 0x451928
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00451694
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x451ad0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00451a84
test al, al
jne 0x451af1
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x451b3f
xor eax, eax
push ebp
push 0x451b2f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, esi
call fcn.00403738
push eax
call sub.kernel32.dll_CreateDirectoryA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451b36
lea eax, [ebp - 0xc]
call fcn.00451ac0
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x451b48
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00451a84
test al, al
jne 0x451b6c
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x451bd2
xor eax, eax
push ebp
push 0x451bc2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x1c]
push eax
mov eax, dword [ebp + 0x20]
push eax
mov eax, dword [ebp + 0x24]
push eax
push edi
push esi
call sub.kernel32.dll_CreateProcessA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451bc9
lea eax, [ebp - 0xc]
call fcn.00451ac0
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20

Function at 0x451be0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00451a84
test al, al
jne 0x451c04
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x451c5c
xor eax, eax
push ebp
push 0x451c4c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov eax, edi
call fcn.00403738
push eax
mov eax, esi
call fcn.00403738
push eax
call sub.kernel32.dll_CopyFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451c53
lea eax, [ebp - 0xc]
call fcn.00451ac0
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x451c68
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00451a84
test al, al
jne 0x451c89
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x451cd5
xor eax, eax
push ebp
push 0x451cc5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403738
push eax
call sub.kernel32.dll_DeleteFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451ccc
lea eax, [ebp - 0xc]
call fcn.00451ac0
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x451e40
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00451a84
test al, al
jne 0x451e63
mov dword [ebp - 4], 0xffffffff
jmp 0x451eaf
xor eax, eax
push ebp
push 0x451e9f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403738
push eax
call sub.kernel32.dll_GetFileAttributesA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451ea6
lea eax, [ebp - 0xc]
call fcn.00451ac0
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x451fe0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00451a84
test al, al
jne 0x452004
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x452058
xor eax, eax
push ebp
push 0x452048
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00403738
push eax
mov eax, esi
call fcn.00403738
push eax
call sub.kernel32.dll_MoveFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45204f
lea eax, [ebp - 0xc]
call fcn.00451ac0
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x452064
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 8]
test edi, edi
jne 0x452087
test esi, 4
je 0x452087
xor edi, edi
jmp 0x452090
mov eax, edi
call fcn.00403738
mov edi, eax
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.00451a84
test al, al
jne 0x4520a5
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x4520f4
xor eax, eax
push ebp
push 0x4520e4
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
push edi
mov eax, dword [ebp - 4]
call fcn.00403738
push eax
call sub.kernel32.dll_MoveFileExA
mov dword [ebp - 8], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x14], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4520eb
lea eax, [ebp - 0x10]
call fcn.00451ac0
ret
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x452170
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00451a84
test al, al
jne 0x452191
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4521dd
xor eax, eax
push ebp
push 0x4521cd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403738
push eax
call sub.kernel32.dll_RemoveDirectoryA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4521d4
lea eax, [ebp - 0xc]
call fcn.00451ac0
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4521e8
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00451a84
test al, al
jne 0x45220c
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x452259
xor eax, eax
push ebp
push 0x452249
push dword fs:[eax]
mov dword fs:[eax], esp
push edi
mov eax, esi
call fcn.00403738
push eax
call sub.kernel32.dll_SetFileAttributesA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452250
lea eax, [ebp - 0xc]
call fcn.00451ac0
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x452d84
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x452e73
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.0042d918
mov edx, dword [ebp - 8]
mov ecx, 0x452e8c
xor eax, eax
call fcn.00452b10
push 0
mov eax, dword [ebp - 4]
call fcn.00403738
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x452e41
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 0xb7
je 0x452da4
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov al, 0x2f
call fcn.004507b8
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.00406d48
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.0042e714
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x14]
mov ecx, 2
mov al, 0x60
call fcn.00450788
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, 0x4063e0
call fcn.00408bec
call fcn.0040311c
jmp 0x452da4
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00403494
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452e7a
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00403420
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403420
ret
Function at 0x4544ac
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x18]
call fcn.00403728
xor eax, eax
push ebp
push 0x454591
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp + 0x18], 0
jne 0x4544f3
lea edx, [ebp + 0x18]
mov eax, edi
call fcn.0042c848
cmp dword [ebp + 0x18], 0
jne 0x4544f3
lea eax, [ebp + 0x18]
call fcn.0042d868
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x3c
call fcn.00402934
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x540
test ebx, ebx
je 0x45451e
mov eax, ebx
call fcn.00403738
mov dword [ebp - 0x34], eax
mov eax, edi
call fcn.00403738
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
call fcn.00403738
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x18]
call fcn.00403738
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
push eax
call sub.shell32.dll_ShellExecuteExA
mov ebx, eax
neg ebx
sbb ebx, ebx
neg ebx
test bl, bl
jne 0x454562
call sub.kernel32.dll_GetLastError_1
mov dword [esi], eax
jmp 0x45457b
mov dword [esi], 0x103
mov eax, dword [ebp - 8]
test eax, eax
je 0x45457b
push esi
mov ecx, dword [ebp + 0xc]
mov dl, byte [ebp + 0x14]
call fcn.00454198
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x454598
lea eax, [ebp + 0x18]
call fcn.00403400
ret

Function at 0x45477c
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffec
mov ebx, eax
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4547aa
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x10
call fcn.0040355c
jmp 0x4547b1
mov eax, ebx
call fcn.00403400
add esp, 0x14
pop ebx
ret

Function at 0x4547b8
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
mov dword [esp], 0x101
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x4547e9
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x101
call fcn.0040355c
jmp 0x4547f0
mov eax, ebx
call fcn.00403400
add esp, 0x108
pop ebx
ret

Function at 0x454800
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffec
cmp dword [0x4980dc], 2
jne 0x454867
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x454822
xor eax, eax
jmp 0x454876
lea eax, [esp + 8]
push eax
push 0x45487c
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError_1
test eax, eax
je 0x454867
xor eax, eax
jmp 0x454876
push 0
push 2
call sub.user32.dll_ExitWindowsEx
neg eax
sbb eax, eax
neg eax
add esp, 0x14
ret
Function at 0x454890
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x4548ea
inc esi
xor edi, edi
cmp edi, 1
jne 0x4548b6
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep
jmp 0x4548c4
cmp edi, 1
jle 0x4548c4
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00451c68
test eax, eax
jne 0x4548ea
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
je 0x4548ea
call sub.kernel32.dll_GetLastError_1
cmp eax, 3
je 0x4548ea
inc edi
dec esi
jne 0x4548a6
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x454fb8
Capabilities:
Delete registry value

Disassembly:
push ebx
push esi
push ecx
mov ebx, edx
mov esi, eax
push 0
push 2
lea eax, [esp + 8]
push eax
call fcn.0042daf4
and eax, 0x7f
mov ecx, dword [eax*4 + 0x498a50]
mov edx, 0x80000002
xor eax, eax
call fcn.0042dd1c
test eax, eax
jne 0x455002
mov eax, esi
call fcn.00403738
push eax
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey
mov eax, ebx
call fcn.00403738
push eax
call sub.gdi32.dll_RemoveFontResourceA
test eax, eax
je 0x455023
push 0
push 0
push 0x1d
push 0xffff
call sub.user32.dll_SendNotifyMessageA
pop edx
pop esi
pop ebx
ret
Function at 0x455028
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov edi, ecx
mov esi, edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x45515c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x455170
push 0x455184
call sub.kernel32.dll_GetModuleHandleA_1
push eax
call sub.kernel32.dll_GetProcAddress
mov ebx, eax
lea edx, [ebp - 0xc]
mov al, byte [ebp - 1]
call fcn.00451a84
test al, al
jne 0x45507d
mov byte [ebp - 2], 0
jmp 0x455141
xor eax, eax
push ebp
push 0x45513a
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x4550b6
push 0
mov eax, dword [ebp + 8]
push eax
push edi
lea edx, [ebp - 0x20]
mov eax, esi
call fcn.0042c3e4
mov eax, dword [ebp - 0x20]
call fcn.00403738
push eax
call ebx
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 2], al
jmp 0x455124
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x20]
mov eax, esi
call fcn.0042c7a8
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x24]
call fcn.0042c870
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.0042c3e4
mov eax, dword [ebp - 0x20]
call fcn.00403738
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 2], al
cmp byte [ebp - 2], 0
je 0x455124
mov ecx, edi
mov eax, dword [ebp - 0x14]
imul dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
call fcn.00430834
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x14]
imul dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.00430834
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x455141
lea eax, [ebp - 0xc]
call fcn.00451ac0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x455163
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00403420
ret