joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4537f8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x18]
call fcn.00403728
xor eax, eax
push ebp
push 0x4538d5
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp + 0x18], 0
jne 0x453831
lea edx, [ebp + 0x18]
mov eax, edi
call fcn.0042c79c
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x3c
call fcn.00402934
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x540
test ebx, ebx
je 0x45385c
mov eax, ebx
call fcn.00403738
mov dword [ebp - 0x34], eax
mov eax, edi
call fcn.00403738
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
call fcn.00403738
mov dword [ebp - 0x2c], eax
cmp dword [ebp + 0x18], 0
je 0x453882
mov eax, dword [ebp + 0x18]
call fcn.00403738
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
push eax
call sub.shell32.dll_ShellExecuteExA
mov ebx, eax
neg ebx
sbb ebx, ebx
neg ebx
test bl, bl
jne 0x4538a6
call sub.kernel32.dll_GetLastError_1
mov dword [esi], eax
jmp 0x4538bf
mov dword [esi], 0x103
mov eax, dword [ebp - 8]
test eax, eax
je 0x4538bf
push esi
mov ecx, dword [ebp + 0xc]
mov dl, byte [ebp + 0x14]
call fcn.004534e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4538dc
lea eax, [ebp + 0x18]
call fcn.00403400
ret

Function at 0x453a74
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffec
mov ebx, eax
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x453aa2
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x10
call fcn.0040355c
jmp 0x453aa9
mov eax, ebx
call fcn.00403400
add esp, 0x14
pop ebx
ret

Function at 0x453ab0
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
mov dword [esp], pe_nt_image_headers32
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x453ae1
mov eax, ebx
lea edx, [esp + 4]
mov ecx, pe_nt_image_headers32
call fcn.0040355c
jmp 0x453ae8
mov eax, ebx
call fcn.00403400
add esp, 0x104
pop ebx
ret

Function at 0x453af8
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffec
cmp dword [0x4910dc], 2
jne 0x453b5f
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x453b1a
xor eax, eax
jmp 0x453b6e
lea eax, [esp + 8]
push eax
push 0x453b74
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError_1
test eax, eax
je 0x453b5f
xor eax, eax
jmp 0x453b6e
push 0
push 2
call sub.user32.dll_ExitWindowsEx
neg eax
sbb eax, eax
neg eax
add esp, 0x14
ret
Function at 0x453b88
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x453be2
inc esi
xor edi, edi
cmp edi, 1
jne 0x453bae
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep
jmp 0x453bbc
cmp edi, 1
jle 0x453bbc
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00451084
test eax, eax
jne 0x453be2
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
je 0x453be2
call sub.kernel32.dll_GetLastError_1
cmp eax, 3
je 0x453be2
inc edi
dec esi
jne 0x453b9e
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x4542b0
Capabilities:
Delete registry value

Disassembly:
push ebx
push esi
push ecx
mov ebx, edx
mov esi, eax
push 0
push 2
lea eax, [esp + 8]
push eax
call fcn.0042da34
and eax, 0x7f
mov ecx, dword [eax*4 + 0x491a34]
mov edx, 0x80000002
xor eax, eax
call fcn.0042dc44
test eax, eax
jne 0x4542fa
mov eax, esi
call fcn.00403738
push eax
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey
mov eax, ebx
call fcn.00403738
push eax
call sub.gdi32.dll_RemoveFontResourceA
test eax, eax
je 0x45431b
push 0
push 0
push 0x1d
push 0xffff
call sub.user32.dll_SendNotifyMessageA
pop edx
pop esi
pop ebx
ret
Function at 0x454320
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov edi, ecx
mov esi, edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x454454
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x454468
push 0x45447c
call sub.kernel32.dll_GetModuleHandleA_1
push eax
call sub.kernel32.dll_GetProcAddress
mov ebx, eax
lea edx, [ebp - 0xc]
mov al, byte [ebp - 1]
call fcn.00450ea0
test al, al
jne 0x454375
mov byte [ebp - 2], 0
jmp 0x454439
xor eax, eax
push ebp
push 0x454432
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x4543ae
push 0
mov eax, dword [ebp + 8]
push eax
push edi
lea edx, [ebp - 0x20]
mov eax, esi
call fcn.0042c3a4
mov eax, dword [ebp - 0x20]
call fcn.00403738
push eax
call ebx
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 2], al
jmp 0x45441c
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x20]
mov eax, esi
call fcn.0042c6fc
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x24]
call fcn.0042c7c4
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.0042c3a4
mov eax, dword [ebp - 0x20]
call fcn.00403738
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 2], al
cmp byte [ebp - 2], 0
je 0x45441c
mov ecx, edi
mov eax, dword [ebp - 0x14]
imul dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
call fcn.004303ec
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x14]
imul dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.004303ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x454439
lea eax, [ebp - 0xc]
call fcn.00450edc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45445b
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00403420
ret
Function at 0x4547a4
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x45499a
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
je 0x4547e7
lea eax, [ebp - 8]
push eax
push 0x491774
push 1
push 0
push 0x491a3c
call sub.ole32.dll_CoCreateInstance
jmp 0x4547ec
mov eax, 0x80004005
test eax, eax
je 0x454819
xor ebx, ebx
lea eax, [ebp - 8]
push eax
push 0x491774
push 1
push 0
push 0x491764
call sub.ole32.dll_CoCreateInstance
test eax, eax
je 0x454819
mov edx, eax
mov eax, 0x4549b4
call fcn.00451c2c
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x45497d
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.00403738
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x50]
mov eax, dword [ebp + 0x24]
call fcn.00403738
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x2c]
cmp dword [ebp + 0x20], 0
je 0x45486d
mov eax, dword [ebp + 0x20]
call fcn.00403738
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
cmp dword [ebp + 0x1c], 0
je 0x454889
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x1c]
call fcn.00403738
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x44]
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x3c]
test edi, edi
je 0x4548ab
mov eax, edi
call fcn.00403738
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x1c]
cmp word [ebp + 0x10], 0
je 0x4548c0
mov ax, word [ebp + 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x34]
lea eax, [ebp - 0xc]
push eax
push 0x491744
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax]
test eax, eax
je 0x4548e1
mov edx, eax
mov eax, 0x4549d0
call fcn.00451c2c
test bl, bl
je 0x454907
call fcn.004546ac
test al, al
je 0x454907
lea ecx, [ebp - 0x14]
xor edx, edx
mov eax, esi
call fcn.0042c448
mov eax, dword [ebp - 0x14]
call fcn.00403ca4
mov dword [ebp - 0x10], eax
jmp 0x454911
mov eax, esi
call fcn.00403ca4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x45491c
call fcn.00408ba0
push 1
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
test eax, eax
je 0x45493b
mov edx, eax
mov eax, 0x4549f4
call fcn.00451c2c
mov ecx, dword [ebp + 8]
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.004546bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x454984
cmp dword [ebp - 0x10], 0
je 0x454964
mov eax, dword [ebp - 0x10]
push eax
call sub.oleaut32.dll_SysFreeString
cmp dword [ebp - 0xc], 0
je 0x454973
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 8]
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 8]
ret
Function at 0x456b34
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
add esp, 0xfffffff4
mov ebx, edx
mov esi, eax
cmp byte [esi + 4], 0
je 0x456c0e
mov byte [esi + 5], 1
mov eax, dword [esi + 0x10]
mov dword [esp + 4], eax
mov byte [esp + 8], 0
lea edx, [esp + 4]
xor ecx, ecx
mov eax, 0x456c1c
call fcn.00455b70
mov eax, dword [esi + 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x456b8c
mov eax, 0x456c50
call fcn.00455970
push 1
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_TerminateProcess
push 0x2710
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x456b77
push esp
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
je 0x456bdf
cmp dword [esp], 0
jne 0x456bc1
mov eax, 0x456c80
call fcn.00455970
jmp 0x456be9
mov eax, dword [esp]
mov dword [esp + 4], eax
mov byte [esp + 8], 0
lea edx, [esp + 4]
xor ecx, ecx
mov eax, 0x456ca0
call fcn.00455b70
jmp 0x456be9
mov eax, 0x456cd8
call fcn.00455970
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [esi + 8], eax
xor eax, eax
mov dword [esi + 0x10], eax
mov byte [esi + 4], 0
test bl, bl
je 0x456c0e
push 0xfa
call sub.kernel32.dll_Sleep
add esp, 0xc
pop esi
pop ebx
ret
Function at 0x456d0c
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x456f4e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
inc dword [eax + 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
mov ebx, dword [ebp - 4]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x24], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x28], ecx
xor eax, eax
lea ebx, [eax + 0xc]
add ebx, ecx
xor edx, edx
push ebp
push 0x456eeb
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
push 1
push 0
call sub.kernel32.dll_CreateEventA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x456d81
mov eax, 0x456f68
call fcn.00451c18
xor edx, edx
push ebp
push 0x456e80
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x14
call fcn.00402934
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 8]
push eax
push 0x14
mov eax, dword [ebp - 4]
add eax, 0x2034
push eax
push ebx
mov eax, dword [ebp - 4]
add eax, 0x20
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_TransactNamedPipe
test eax, eax
jne 0x456e69
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x3e5
je 0x456de9
mov eax, 0x456f7c
call fcn.00451c18
xor edx, edx
push ebp
push 0x456e52
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [ebp + 8], 0
je 0x456e27
mov eax, dword [ebp - 4]
cmp word [eax + 0x1a], 0
je 0x456e27
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x1c]
call dword [edx + 0x18]
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xc]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x456e07
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x456e59
push 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_GetOverlappedResult
mov ebx, eax
call sub.kernel32.dll_GetLastError_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x456e87
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
Function at 0x459de0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffe18
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x11e8], ebx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x11cc], edx
mov dword [ebp - 0x11d0], eax
lea esi, [ebp - 0x11e0]
lea edi, [ebp - 0x11d0]
xor eax, eax
push ebp
push 0x459f72
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x11d4], eax
xor eax, eax
mov dword [ebp - 0x11c8], eax
mov eax, dword [edi]
add eax, 0x10
push eax
lea ecx, [ebp - 0x11c4]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x11cc]
call fcn.004574f8
cmp dword [ebp - 0x1084], 0x30
jle 0x459e7e
lea ecx, [ebp - 0x11e8]
mov edx, dword [ebp - 4]
mov al, 0xb7
call fcn.004506dc
mov ecx, dword [ebp - 0x11e8]
mov dl, 1
mov eax, 0x406368
call fcn.00408bac
call fcn.0040311c
mov eax, dword [edi]
add eax, 0x14
lea edx, [ebp - 0x1184]
mov ecx, 0x80
call fcn.0040355c
mov eax, dword [edi]
add eax, 0x18
lea edx, [ebp - 0x1104]
mov ecx, 0x80
call fcn.0040355c
lea eax, [ebp - 0x1078]
mov al, byte [eax]
mov edx, dword [edi]
mov byte [edx + 0x1d], al
mov ebx, dword [ebp - 0x1080]
test ebx, ebx
jle 0x459f59
push ebp
mov eax, esi
mov edx, 0xa
call fcn.00459d68
pop ecx
mov eax, dword [esi + 6]
push eax
mov eax, dword [edi]
mov eax, dword [eax]
mov ecx, dword [esi + 2]
mov dx, word [esi]
call fcn.00457af8
mov dword [ebp - 0x11e4], eax
cmp dword [ebp - 0x11e4], 0
jne 0x459efa
push ebp
call fcn.00459bbc
pop ecx
xor eax, eax
push ebp
push 0x459f2b
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
mov eax, dword [ebp - 0x11e4]
add eax, 0x12
mov edx, dword [ebp - 0x11e4]
mov edx, dword [edx + 0xc]
call fcn.00459d68
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x459f45
mov edx, dword [ebp - 0x11e4]
mov eax, dword [edi]
call fcn.00457b34
dec ebx
jne 0x459ec3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459f79
lea eax, [ebp - 0x11e8]
call fcn.00403400
ret
Function at 0x45a0e8
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [0x4910dc], 2
jne 0x45a111
call sub.kernel32.dll_GetVersion
and ax, 0xff
cmp ax, 5
jae 0x45a11d
mov dword [ebp - 0xc], 1
jmp 0x45a325
push 0x45a334
call sub.kernel32.dll_GetModuleHandleA_1
mov esi, eax
push 0x45a344
push esi
call sub.kernel32.dll_GetProcAddress
mov edi, eax
push 0x45a35c
push esi
call sub.kernel32.dll_GetProcAddress
mov dword [ebp - 0x10], eax
push 0x45a374
push esi
call sub.kernel32.dll_GetProcAddress
mov dword [ebp - 0x14], eax
test edi, edi
je 0x45a162
cmp dword [ebp - 0x10], 0
je 0x45a162
cmp dword [ebp - 0x14], 0
jne 0x45a16e
mov dword [ebp - 0xc], 0x7f
jmp 0x45a325
xor eax, eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 4
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
call fcn.00403738
push eax
call edi
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x45a325
xor edx, edx
push ebp
push 0x45a31e
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp + 0xc]
shl eax, 5
call fcn.00406944
mov dword [ebp - 0x24], eax
mov esi, ebx
mov edi, dword [ebp + 0xc]
dec edi
test edi, edi
jl 0x45a25b
inc edi
xor ebx, ebx
lea eax, [ebp - 0x28]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi + 8]
push eax
mov al, byte [esi + 6]
push eax
push esi
call sub.advapi32.dll_AllocateAndInitializeSid
test eax, eax
jne 0x45a211
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x45a207
mov dword [ebp - 0xc], 0x57
call fcn.004031bc
jmp 0x45a325
mov eax, ebx
shl eax, 2
mov edx, dword [ebp - 0x24]
mov ecx, dword [esi + 0x10]
mov dword [edx + eax*8], ecx
mov edx, dword [ebp - 0x24]
mov dword [edx + eax*8 + 4], 1
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp + 8]
mov dword [edx + eax*8 + 8], ecx
mov edx, dword [ebp - 0x24]
xor ecx, ecx
mov dword [edx + eax*8 + 0x14], ecx
mov edx, dword [ebp - 0x24]
xor ecx, ecx
mov dword [edx + eax*8 + 0x18], ecx
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov dword [edx + eax*8 + 0x1c], ecx
add esi, 0x14
inc ebx
dec edi
jne 0x45a1cc
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [ebp + 0xc]
push eax
call dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x45a281
call fcn.004031bc
jmp 0x45a325
xor eax, eax
push ebp
push 0x45a2c5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0x20]
push eax
push 0
push 0
push 4
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
call fcn.00403738
push eax
call dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a2cc
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_LocalFree_1
ret
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x45de20
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x14c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45def4
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea eax, [ebp - 0x148]
push eax
lea edx, [ebp - 0x14c]
mov eax, ebx
call fcn.0042c3a4
lea eax, [ebp - 0x14c]
mov edx, 0x45df10
call fcn.0040357c
mov eax, dword [ebp - 0x14c]
call fcn.00403738
push eax
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x45dedb
xor eax, eax
push ebp
push 0x45ded4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x148]
call fcn.0045ddd4
test al, al
je 0x45dea9
mov byte [ebp - 1], 1
jmp 0x45debd
lea eax, [ebp - 0x148]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x45de94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45dedb
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindClose
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45defb
lea eax, [ebp - 0x14c]
call fcn.00403400
ret

Function at 0x45df14
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffea0
mov ebx, edx
mov esi, eax
push 0x200
push 0x160
lea eax, [esp + 8]
push eax
push 0
mov eax, esi
call fcn.00403738
push eax
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x45df54
mov eax, ebx
lea edx, [esp + 0xc]
mov ecx, 0x104
call fcn.0040355c
jmp 0x45df5b
mov eax, ebx
call fcn.00403400
add esp, 0x160
pop esi
pop ebx
ret

Function at 0x45df64
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffea0
mov ebx, edx
mov esi, eax
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x491aa8]
or eax, 0x4001
push eax
push 0x160
lea eax, [esp + 8]
push eax
push 0
mov eax, esi
call fcn.00403738
push eax
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x45dfa4
mov eax, dword [esp + 4]
jmp 0x45dfa6
xor eax, eax
add esp, 0x160
pop esi
pop ebx
ret

Function at 0x45dfb0
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffea0
mov ebx, eax
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x491ab0]
or eax, 0x4011
push eax
push 0x160
lea eax, [esp + 8]
push eax
push 0x10
push 0x45dff4
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x45dfea
mov eax, dword [esp + 4]
jmp 0x45dfec
xor eax, eax
add esp, 0x160
pop ebx
ret

Function at 0x45dfd4
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffea0
mov ebx, eax
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x491ab0]
or eax, 0x4011
push eax
push 0x160
lea eax, [esp + 8]
push eax
push 0x10
push 0x45dff4
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x45dfea
mov eax, dword [esp + 4]
jmp 0x45dfec
xor eax, eax
add esp, 0x160
pop ebx
ret
Function at 0x45e3a8
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
test dl, dl
je 0x45e3bc
add esp, 0xfffffff0
call fcn.00402d30
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.004158f4
mov ax, word [0x45e45c]
not eax
and ax, word [esi + 0x34]
mov word [esi + 0x34], ax
mov edx, 0x79
mov eax, esi
call fcn.004145c4
mov edx, 0x61
mov eax, esi
call fcn.004145e4
xor edx, edx
mov eax, esi
call fcn.00414bf8
mov dl, 1
mov eax, esi
call fcn.004182c0
call sub.kernel32.dll_GetVersion
and ax, 0xff
cmp ax, 6
jae 0x45e41d
mov dx, 0xfffe
mov eax, esi
call fcn.00414c18
push 0
lea eax, [ebp - 0x3c]
push eax
push 0x3c
push 0x1f
call sub.user32.dll_SystemParametersInfoA
test eax, eax
je 0x45e443
lea eax, [ebp - 0x3c]
push eax
call sub.gdi32.dll_CreateFontIndirectA
mov edx, eax
mov eax, dword [esi + 0x44]
call fcn.0041a280
test bl, bl
je 0x45e451
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45f2bc
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x45f386
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetLogicalDrives
mov esi, eax
mov bl, 0x41
test esi, 1
jne 0x45f2f7
mov eax, ebx
call fcn.0045e004
test al, al
je 0x45f35f
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403510
lea eax, [ebp - 8]
mov edx, 0x45f39c
call fcn.0040357c
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.0045df14
mov eax, dword [ebp - 4]
push eax
push 0
lea eax, [ebp - 0xc]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x10]
call fcn.00402878
mov edx, 0x45f3a0
lea eax, [ebp - 0x10]
mov cl, 2
call fcn.00402848
lea edx, [ebp - 0x10]
lea eax, [ebp - 8]
call fcn.00403520
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
xor edx, edx
call fcn.0045ee2c
shr esi, 1
inc ebx
cmp bl, 0x5b
jne 0x45f2e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f38d
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403420
ret