joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42d89c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42d92a
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x42d8e7
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [ebp - 0x108]
mov eax, esi
call fcn.004034e0
jmp 0x42d914
call sub.kernel32.dll_GetCommandLineA_1
cmp byte [eax], 0
jne 0x42d8fb
lea eax, [ebp - 4]
call fcn.00403400
jmp 0x42d90a
lea edx, [ebp - 4]
call fcn.0042d6f0
test ebx, ebx
je 0x42d90a
dec ebx
jmp 0x42d8ec
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00403494
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42d931
lea eax, [ebp - 4]
call fcn.00403400
ret

Function at 0x42dce8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.00407934
add esp, 0x104
pop ebx
ret

Function at 0x42dd14
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov edx, ebx
mov eax, esp
call fcn.00407934
add esp, 0x104
pop ebx
ret

Function at 0x42ddc4
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42de41
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
je 0x42de1f
call sub.kernel32.dll_GetVersion
and ax, 0xff
cmp ax, 6
jb 0x42de1f
lea eax, [ebp - 8]
call fcn.0042dd14
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.0042c84c
lea eax, [ebp - 4]
mov edx, 0x42de58
call fcn.0040357c
mov eax, dword [ebp - 4]
mov edx, esi
call fcn.0042cc54
jmp 0x42de26
mov eax, esi
call fcn.00403400
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42de48
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403420
ret
Function at 0x42e050
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x42e188
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x42e172
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
je 0x42e0ad
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 8]
jne 0x42e172
cmp dword [ebp - 0x10], 0
jne 0x42e0c2
mov eax, dword [ebp - 8]
call fcn.00403400
mov bl, 1
jmp 0x42e172
cmp dword [ebp - 0x10], 0x70000000
jb 0x42e0d0
call fcn.00409050
mov esi, dword [ebp - 0x10]
test esi, esi
sar esi, 0
lea eax, [ebp - 0x14]
mov ecx, esi
xor edx, edx
call fcn.004034e0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
call fcn.00403744
push eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExA
cmp eax, 0xea
je 0x42e076
test eax, eax
jne 0x42e172
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
je 0x42e120
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 8]
jne 0x42e172
mov esi, dword [ebp - 0x10]
test esi, esi
sar esi, 0
jmp 0x42e12b
dec esi
test esi, esi
je 0x42e139
mov eax, dword [ebp - 0x14]
cmp byte [eax + esi - 1], 0
je 0x42e12a
cmp dword [ebp - 0xc], 7
jne 0x42e144
test esi, esi
je 0x42e144
inc esi
lea eax, [ebp - 0x14]
mov edx, esi
call fcn.004038a4
cmp dword [ebp - 0xc], 7
jne 0x42e165
test esi, esi
je 0x42e165
lea eax, [ebp - 0x14]
call fcn.00403744
mov byte [eax + esi - 1], 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
call fcn.00403450
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42e18f
lea eax, [ebp - 0x14]
call fcn.00403400
ret

Function at 0x42e1b4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov esi, edx
mov edi, eax
push 0
push 0
push 0
push 0
push esi
push edi
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
sete bl
test bl, bl
je 0x42e229
test esi, esi
je 0x42e1df
cmp byte [esi], 0
jne 0x42e229
cmp dword [0x49b0dc], 2
je 0x42e229
xor ebx, ebx
xor esi, esi
mov dword [esp + 4], 2
push 0
push 0
push 0
push 0
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
push esi
push edi
call sub.advapi32.dll_RegEnumValueA
test eax, eax
je 0x42e218
cmp eax, 0xea
jne 0x42e229
test eax, eax
jne 0x42e226
cmp byte [esp], 0
jne 0x42e226
mov bl, 1
jmp 0x42e229
inc esi
jmp 0x42e1ec
mov eax, ebx
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x42e294
Capabilities:
Delete registry key

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, edx
cmp al, 2
je 0x42e2a8
push esi
push ebx
call sub.advapi32.dll_RegDeleteKeyA
pop esi
pop ebx
ret
cmp dword [0x49d660], 0
jne 0x42e2cb
push 0x42e2f0
push 0x42e300
call sub.kernel32.dll_GetModuleHandleA_1
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x49d660], eax
cmp dword [0x49d660], 0
je 0x42e2e5
push 0
push pe_nt_image_headers32
push esi
push ebx
call dword [0x49d660]
jmp 0x42e2ea
mov eax, 0x7f
pop esi
pop ebx
ret

Function at 0x42e310
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x42e453
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
je 0x42e343
mov eax, dword [ebp - 0xc]
cmp byte [eax], 0
jne 0x42e34d
mov ebx, 0x57
jmp 0x42e43d
cmp dword [0x49b0dc], 2
jne 0x42e42d
push 0
push 8
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov al, byte [ebp - 1]
call fcn.0042e26c
test eax, eax
jne 0x42e42d
xor edx, edx
push ebp
push 0x42e426
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x14]
mov ecx, pe_nt_image_headers32
xor edx, edx
call fcn.004034e0
xor ebx, ebx
mov eax, dword [ebp - 0x14]
call fcn.00403574
mov dword [ebp - 0x18], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
call fcn.00403744
push eax
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegEnumKeyExA
cmp eax, 0xea
jne 0x42e3ef
mov eax, dword [ebp - 0x14]
call fcn.00403574
cmp eax, 0x10000
jge 0x42e40f
mov eax, dword [ebp - 0x14]
call fcn.00403574
mov ecx, eax
add ecx, ecx
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.004034e0
jmp 0x42e397
test eax, eax
jne 0x42e40f
mov eax, dword [ebp - 0x14]
call fcn.00403738
mov ecx, eax
mov edx, dword [ebp - 0x10]
mov al, byte [ebp - 1]
call fcn.0042e310
test eax, eax
je 0x42e397
inc ebx
jmp 0x42e397
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42e42d
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov al, byte [ebp - 1]
call fcn.0042e294
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42e45a
lea eax, [ebp - 0x14]
call fcn.00403400
ret
Function at 0x42e464
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebp, ecx
mov edi, edx
mov ebx, eax
push 0
push 1
lea eax, [esp + 8]
push eax
mov ecx, ebp
mov edx, edi
mov eax, ebx
call fcn.0042e26c
mov esi, eax
test esi, esi
jne 0x42e4e2
push 0
push 0
push 0
push 0
lea eax, [esp + 0x18]
push eax
push 0
push 0
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
mov eax, dword [esp + 0x2c]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
mov esi, eax
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey
test esi, esi
jne 0x42e4e2
cmp dword [esp + 4], 0
jne 0x42e4dd
cmp dword [esp + 8], 0
jne 0x42e4dd
mov ecx, ebp
mov edx, edi
mov eax, ebx
call fcn.0042e294
mov esi, eax
jmp 0x42e4e2
mov esi, 0x91
mov eax, esi
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x44baa4
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push ebx
xor ebx, ebx
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x44baf0
cmp dword [ebp - 0x84], 2
jne 0x44baf0
cmp dword [ebp - 0x90], 5
jg 0x44baee
cmp dword [ebp - 0x90], 5
jne 0x44baf0
cmp dword [ebp - 0x8c], 1
jl 0x44baf0
mov bl, 1
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44baf8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov edx, ebx
lea eax, [ebp - 0x104]
call fcn.00407934
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44cd18
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov edx, ebx
lea eax, [ebp - 0x104]
call fcn.00407934
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44fcac
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov byte [0x49d770], 0
cmp dword [0x49b0dc], 2
jne 0x44fcdf
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x44fcdf
cmp dword [esp + 4], 5
setge byte [0x49d770]
add esp, 0x94
ret

Function at 0x450360
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov edx, ebx
lea eax, [ebp - 0x104]
call fcn.00407934
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x450964
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov edx, ebx
lea eax, [ebp - 0x104]
call fcn.00407934
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x451544
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x49d854
mov eax, esi
mov edx, 8
test al, 1
je 0x451560
shr eax, 1
xor eax, 0xedb88320
jmp 0x451562
shr eax, 1
dec edx
jne 0x451553
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x45154c
pop esi
ret

Function at 0x451578
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x49d850], 0
jne 0x45159b
call fcn.00451544
push 1
push 0x49d850
call sub.kernel32.dll_InterlockedExchange
mov eax, edi
test esi, esi
je 0x4515c6
mov edx, ebx
and dx, 0xff
xor ecx, ecx
mov cl, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x49d854]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x4515a1
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x451f78
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
ret
Function at 0x452c54
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
mov byte [ebp - 5], 0
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.00403738
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jle 0x452cf6
mov eax, ebx
call fcn.00402648
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x452cef
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
push edi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x452cd9
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x452d18
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x452cd9
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452d0c
mov eax, dword [ebp - 0x10]
call fcn.00402660
ret
cmp dword [0x49b0dc], 1
je 0x452d0c
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00452a78
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x452eb4
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00452e68
test al, al
jne 0x452ed5
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x452f23
xor eax, eax
push ebp
push 0x452f13
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, esi
call fcn.00403738
push eax
call sub.kernel32.dll_CreateDirectoryA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452f1a
lea eax, [ebp - 0xc]
call fcn.00452ea4
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x452f2c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00452e68
test al, al
jne 0x452f50
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x452fb6
xor eax, eax
push ebp
push 0x452fa6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x1c]
push eax
mov eax, dword [ebp + 0x20]
push eax
mov eax, dword [ebp + 0x24]
push eax
push edi
push esi
call sub.kernel32.dll_CreateProcessA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452fad
lea eax, [ebp - 0xc]
call fcn.00452ea4
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
Function at 0x452fc4
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00452e68
test al, al
jne 0x452fe8
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x453040
xor eax, eax
push ebp
push 0x453030
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov eax, edi
call fcn.00403738
push eax
mov eax, esi
call fcn.00403738
push eax
call sub.kernel32.dll_CopyFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x453037
lea eax, [ebp - 0xc]
call fcn.00452ea4
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x45304c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00452e68
test al, al
jne 0x45306d
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4530b9
xor eax, eax
push ebp
push 0x4530a9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403738
push eax
call sub.kernel32.dll_DeleteFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4530b0
lea eax, [ebp - 0xc]
call fcn.00452ea4
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x453224
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00452e68
test al, al
jne 0x453247
mov dword [ebp - 4], 0xffffffff
jmp 0x453293
xor eax, eax
push ebp
push 0x453283
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403738
push eax
call sub.kernel32.dll_GetFileAttributesA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45328a
lea eax, [ebp - 0xc]
call fcn.00452ea4
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4533c4
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00452e68
test al, al
jne 0x4533e8
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x45343c
xor eax, eax
push ebp
push 0x45342c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00403738
push eax
mov eax, esi
call fcn.00403738
push eax
call sub.kernel32.dll_MoveFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x453433
lea eax, [ebp - 0xc]
call fcn.00452ea4
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x453448
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 8]
test edi, edi
jne 0x45346b
test esi, 4
je 0x45346b
xor edi, edi
jmp 0x453474
mov eax, edi
call fcn.00403738
mov edi, eax
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.00452e68
test al, al
jne 0x453489
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x4534d8
xor eax, eax
push ebp
push 0x4534c8
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
push edi
mov eax, dword [ebp - 4]
call fcn.00403738
push eax
call sub.kernel32.dll_MoveFileExA
mov dword [ebp - 8], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x14], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4534cf
lea eax, [ebp - 0x10]
call fcn.00452ea4
ret
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x453554
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00452e68
test al, al
jne 0x453575
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4535c1
xor eax, eax
push ebp
push 0x4535b1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403738
push eax
call sub.kernel32.dll_RemoveDirectoryA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4535b8
lea eax, [ebp - 0xc]
call fcn.00452ea4
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4535cc
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00452e68
test al, al
jne 0x4535f0
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x45363d
xor eax, eax
push ebp
push 0x45362d
push dword fs:[eax]
mov dword fs:[eax], esp
push edi
mov eax, esi
call fcn.00403738
push eax
call sub.kernel32.dll_SetFileAttributesA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x453634
lea eax, [ebp - 0xc]
call fcn.00452ea4
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45418c
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x45427b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.0042de68
mov edx, dword [ebp - 8]
mov ecx, 0x454294
xor eax, eax
call fcn.00453f18
push 0
mov eax, dword [ebp - 4]
call fcn.00403738
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x454249
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 0xb7
je 0x4541ac
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov al, 0x36
call fcn.00451b9c
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.004071b8
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.0042ed18
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x14]
mov ecx, 2
mov al, 0x68
call fcn.00451b6c
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, 0x406850
call fcn.0040905c
call fcn.0040311c
jmp 0x4541ac
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00403494
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x454282
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00403420
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403420
ret
Function at 0x4559f8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x18]
call fcn.00403728
xor eax, eax
push ebp
push 0x455add
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp + 0x18], 0
jne 0x455a3f
lea edx, [ebp + 0x18]
mov eax, edi
call fcn.0042ccf4
cmp dword [ebp + 0x18], 0
jne 0x455a3f
lea eax, [ebp + 0x18]
call fcn.0042dd14
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x3c
call fcn.00402934
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x540
test ebx, ebx
je 0x455a6a
mov eax, ebx
call fcn.00403738
mov dword [ebp - 0x34], eax
mov eax, edi
call fcn.00403738
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
call fcn.00403738
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x18]
call fcn.00403738
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
push eax
call sub.shell32.dll_ShellExecuteExA
mov ebx, eax
neg ebx
sbb ebx, ebx
neg ebx
test bl, bl
jne 0x455aae
call sub.kernel32.dll_GetLastError_1
mov dword [esi], eax
jmp 0x455ac7
mov dword [esi], 0x103
mov eax, dword [ebp - 8]
test eax, eax
je 0x455ac7
push esi
mov ecx, dword [ebp + 0xc]
mov dl, byte [ebp + 0x14]
call fcn.004556e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x455ae4
lea eax, [ebp + 0x18]
call fcn.00403400
ret

Function at 0x455cfc
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffec
mov ebx, eax
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x455d2a
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x10
call fcn.0040355c
jmp 0x455d31
mov eax, ebx
call fcn.00403400
add esp, 0x14
pop ebx
ret

Function at 0x455d38
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
mov dword [esp], 0x101
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x455d69
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x101
call fcn.0040355c
jmp 0x455d70
mov eax, ebx
call fcn.00403400
add esp, 0x108
pop ebx
ret

Function at 0x455d80
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffec
cmp dword [0x49b0dc], 2
jne 0x455de7
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x455da2
xor eax, eax
jmp 0x455df6
lea eax, [esp + 8]
push eax
push 0x455dfc
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError_1
test eax, eax
je 0x455de7
xor eax, eax
jmp 0x455df6
push 0
push 2
call sub.user32.dll_ExitWindowsEx
neg eax
sbb eax, eax
neg eax
add esp, 0x14
ret