joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f51b8
Capabilities:
Enumerate files on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0x158], edx
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4f5324
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [edi + 0x310]
mov eax, dword [eax + 0x22c]
call fcn.00452094
lea edx, [ebp - 0x14c]
mov eax, dword [0x533210]
mov eax, dword [eax]
call fcn.0048ee1c
mov eax, dword [ebp - 0x14c]
lea edx, [ebp - 0x148]
call fcn.00409954
mov edx, dword [ebp - 0x148]
lea eax, [ebp - 4]
mov ecx, 0x4f533c
call fcn.00404ad8
mov eax, dword [ebp - 4]
call fcn.00404c8c
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [ebp - 0x144]
push eax
push 0x4f5348
call sub.kernel32.dll_FindFirstFileA_1
mov esi, eax
cmp esi, 0xffffffff
je 0x4f52f8
mov eax, dword [edi + 0x310]
mov eax, dword [eax + 0x22c]
call fcn.00451f38
mov ebx, eax
lea eax, [ebp - 0x140]
call fcn.004d174c
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x150]
call fcn.0040bd18
mov edx, dword [ebp - 0x150]
mov eax, ebx
call fcn.004519d8
lea eax, [ebp - 0x158]
lea edx, [ebp - 0x118]
mov ecx, 0x104
call fcn.00404a3c
mov ecx, dword [ebp - 0x158]
lea eax, [ebp - 0x154]
mov edx, dword [ebp - 4]
call fcn.00404ad8
mov edx, dword [ebp - 0x154]
mov eax, dword [ebx + 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x144]
push eax
push esi
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4f5268
push esi
call sub.kernel32.dll_FindClose_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f532b
lea eax, [ebp - 0x158]
mov edx, 5
call fcn.004047f0
lea eax, [ebp - 4]
call fcn.004047cc
ret

Function at 0x4f5b90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4f5c11
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 4]
lea eax, [ebp - 0x109]
call fcn.00409dec
lea eax, [ebp - 4]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404cec
lea eax, [ebp - 4]
mov edx, 0x4f5c28
call fcn.00404a94
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00404820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f5c18
lea eax, [ebp - 4]
call fcn.004047cc
ret
Function at 0x4fc104
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xffffff00
mov ebx, eax
push esp
push 0xff
call sub.kernel32.dll_GetTempPathA
mov edx, ebx
mov eax, esp
call fcn.00409dec
add esp, 0x100
pop ebx
ret

Function at 0x4fc424
Capabilities:
Enumerate internet cache

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00404c7c
xor eax, eax
push ebp
push 0x4fc5ec
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
call sub.wininet.dll_FindFirstUrlCacheEntryA
mov eax, dword [ebp - 0x14]
call fcn.004027bc
mov esi, eax
lea eax, [ebp - 0x14]
push eax
push esi
push 0
call sub.wininet.dll_FindFirstUrlCacheEntryA
mov edi, eax
test edi, edi
je 0x4fc4f3
mov eax, dword [esi + 0xc]
and eax, 1
cmp eax, 1
jne 0x4fc4f3
lea eax, [ebp - 0x10]
mov edx, dword [esi + 4]
call fcn.004049c4
mov edx, dword [ebp - 0x10]
mov eax, 0x4fc604
call fcn.00404dd0
test eax, eax
jne 0x4fc4f3
mov edx, dword [0x4fbdf4]
mov eax, 0x10
call fcn.004056d0
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], 1
mov eax, dword [ebp - 0xc]
add eax, 4
mov edx, dword [esi + 4]
call fcn.004049c4
mov eax, dword [ebp - 0xc]
add eax, 8
mov edx, dword [ebp - 8]
call fcn.00404820
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xc], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x33c]
mov edx, dword [ebp - 0xc]
call fcn.0041a594
mov eax, esi
call fcn.004027dc
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
push edi
call sub.wininet.dll_FindNextUrlCacheEntryA
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x7a
jne 0x4fc5b7
mov eax, dword [ebp - 0x14]
call fcn.004027bc
mov esi, eax
lea eax, [ebp - 0x14]
push eax
push esi
push edi
call sub.wininet.dll_FindNextUrlCacheEntryA
test eax, eax
je 0x4fc5b0
mov eax, dword [esi + 0xc]
and eax, 1
cmp eax, 1
jne 0x4fc5b0
lea eax, [ebp - 0x10]
mov edx, dword [esi + 4]
call fcn.004049c4
mov edx, dword [ebp - 0x10]
mov eax, 0x4fc604
call fcn.00404dd0
test eax, eax
jne 0x4fc5b0
mov edx, dword [0x4fbdf4]
mov eax, 0x10
call fcn.004056d0
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], 1
mov eax, dword [ebp - 0xc]
add eax, 4
mov edx, dword [esi + 4]
call fcn.004049c4
mov eax, dword [ebp - 0xc]
add eax, 8
mov edx, dword [ebp - 8]
call fcn.00404820
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xc], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x33c]
mov edx, dword [ebp - 0xc]
call fcn.0041a594
mov eax, esi
call fcn.004027dc
cmp ebx, 0x103
je 0x4fc5c8
cmp ebx, 0x57
jne 0x4fc4fa
push edi
call sub.wininet.dll_FindCloseUrlCache
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fc5f3
lea eax, [ebp - 0x10]
call fcn.004047cc
lea eax, [ebp - 8]
call fcn.004047cc
ret
Function at 0x4fc7a0
Capabilities:
Enumerate files on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00404c7c
xor eax, eax
push ebp
push 0x4fc8f1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404c8c
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [ebp - 0x14c]
push eax
push 0x4fc900
call sub.kernel32.dll_FindFirstFileA_1
mov esi, eax
cmp esi, 0xffffffff
je 0x4fc8cd
mov ebx, dword [ebp - 0x14c]
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x120]
mov ecx, 0x104
call fcn.00404a3c
mov eax, dword [ebp - 0xc]
mov edx, 0x4fc90c
call fcn.00404bd8
je 0x4fc8b2
mov eax, dword [ebp - 0xc]
mov edx, 0x4fc918
call fcn.00404bd8
je 0x4fc8b2
cmp ebx, 0x10
je 0x4fc86c
cmp ebx, 2
je 0x4fc86c
cmp ebx, 4
je 0x4fc86c
cmp ebx, 0x80
je 0x4fc86c
cmp ebx, 0x100
je 0x4fc86c
cmp ebx, 0x20
je 0x4fc86c
cmp ebx, 0x11
je 0x4fc86c
cmp ebx, 0x12
je 0x4fc86c
cmp ebx, 0x13
je 0x4fc86c
cmp ebx, 0x14
jne 0x4fc8b2
mov edx, dword [0x4fbdf4]
mov eax, 0x10
call fcn.004056d0
mov ebx, eax
mov eax, dword [ebp - 8]
mov dword [ebx], eax
lea eax, [ebx + 4]
lea edx, [ebp - 0x120]
mov ecx, 0x104
call fcn.00404a3c
lea eax, [ebx + 8]
mov edx, dword [ebp - 4]
call fcn.00404820
mov byte [ebx + 0xc], 1
mov eax, dword [edi + 0x33c]
mov edx, ebx
call fcn.0041a594
lea eax, [ebp - 0x14c]
push eax
push esi
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4fc7f9
push esi
call sub.kernel32.dll_FindClose_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fc8f8
lea eax, [ebp - 0xc]
call fcn.004047cc
lea eax, [ebp - 4]
call fcn.004047cc
ret
Function at 0x4fcca0
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
lea edi, [ebp - 8]
xor eax, eax
push ebp
push 0x4fcd73
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [edi], eax
push edi
push 0
push 0
call sub.wininet.dll_FindFirstUrlCacheEntryA
mov eax, dword [edi]
call fcn.004027bc
mov ebx, eax
cmp dword [edi], 0
jbe 0x4fccdf
mov eax, dword [edi]
mov dword [ebx], eax
push edi
push ebx
push 0
call sub.wininet.dll_FindFirstUrlCacheEntryA
mov esi, eax
test esi, esi
je 0x4fcd50
mov eax, dword [ebx + 0xc]
and eax, 1
cmp eax, 1
jne 0x4fcd1e
lea eax, [ebp - 4]
mov edx, dword [ebx + 4]
call fcn.004049c4
mov edx, dword [ebp - 4]
mov eax, 0x4fcd8c
call fcn.00404dd0
test eax, eax
jne 0x4fcd1e
mov eax, dword [ebx + 4]
push eax
call sub.wininet.dll_DeleteUrlCacheEntry
mov eax, ebx
call fcn.004027dc
xor eax, eax
mov dword [edi], eax
push edi
push 0
push esi
call sub.wininet.dll_FindNextUrlCacheEntryA
mov eax, dword [edi]
call fcn.004027bc
mov ebx, eax
cmp dword [edi], 0
jbe 0x4fcd44
mov eax, dword [edi]
mov dword [ebx], eax
push edi
push ebx
push esi
call sub.wininet.dll_FindNextUrlCacheEntryA
test eax, eax
jne 0x4fccee
mov eax, ebx
call fcn.004027dc
push esi
call sub.wininet.dll_FindCloseUrlCache
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fcd7a
lea eax, [ebp - 4]
call fcn.004047cc
ret

Function at 0x4fcea4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4fcfab
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x33c]
mov eax, dword [eax + 8]
mov dword [ebp - 0xc], eax
mov esi, eax
dec esi
test esi, esi
jl 0x4fcf95
inc esi
mov dword [ebp - 8], 0
mov eax, dword [0x532ec0]
cmp byte [eax], 3
je 0x4fcf95
cmp edi, dword [ebp - 0xc]
je 0x4fcf95
mov eax, dword [0x533210]
mov eax, dword [eax]
call fcn.0048e660
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x33c]
mov edx, dword [ebp - 8]
call fcn.0041a6f0
mov ebx, eax
cmp byte [ebx + 0xc], 0
je 0x4fcf8a
mov eax, dword [ebx]
add eax, 0xfffffffd
sub eax, 3
jae 0x4fcf8a
mov eax, dword [0x53347c]
mov eax, dword [eax]
mov eax, dword [eax + 0x2f8]
mov edx, dword [ebx + 4]
call fcn.0046dddc
xor eax, eax
mov dword [ebp - 0x2a], eax
mov dword [ebp - 0x26], 3
push dword [ebx + 8]
push 0x4fcfc4
push dword [ebx + 4]
push 0x4fcfd0
lea eax, [ebp - 0x30]
mov edx, 4
call fcn.00404b4c
mov eax, dword [ebp - 0x30]
call fcn.00404c8c
mov dword [ebp - 0x22], eax
xor eax, eax
mov dword [ebp - 0x1e], eax
mov word [ebp - 0x1a], 0x410
lea eax, [ebp - 0x2a]
push eax
call sub.shell32.dll_SHFileOperationA
inc edi
inc dword [ebp - 8]
dec esi
jne 0x4fcee7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fcfb2
lea eax, [ebp - 0x30]
call fcn.004047cc
ret
Function at 0x50285c
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov ebx, eax
mov byte [ebp - 1], 0
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x50290a
push 0xf01ff
mov eax, ebx
call fcn.00404c8c
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x50290a
xor eax, eax
push ebp
push 0x5028e7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_StartServiceA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x50290a
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x502914
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov ebx, eax
mov byte [ebp - 1], 0
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x5029c2
push 0xf01ff
mov eax, ebx
call fcn.00404c8c
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x5029c2
xor eax, eax
push ebp
push 0x50299f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
push eax
push 1
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_ControlService
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5029c2
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x50f6f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404c7c
xor eax, eax
push ebp
push 0x50f7dd
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00408c7c
mov eax, dword [ebp - 0xc]
push eax
lea edx, [ebp - 0x10]
mov eax, 0x50f7f4
call fcn.00408c7c
mov eax, dword [ebp - 0x10]
pop edx
call fcn.00404dd0
test eax, eax
jg 0x50f76b
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00408c7c
mov eax, dword [ebp - 0x14]
push eax
lea edx, [ebp - 0x18]
mov eax, 0x50f804
call fcn.00408c7c
mov eax, dword [ebp - 0x18]
pop edx
call fcn.00404dd0
test eax, eax
jle 0x50f7c2
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0xb
lea edx, [ebp - 0x20]
xor ecx, ecx
mov eax, 0x50f814
call fcn.0040a2dc
push 0
mov eax, dword [ebp - 8]
call fcn.00404c8c
push eax
call sub.kernel32.dll_WinExec
mov eax, dword [ebx + 0x304]
mov eax, dword [eax + 0x22c]
call fcn.00451f38
mov ebx, eax
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004519d8
mov edx, 0x50f830
mov eax, dword [ebx + 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50f7e4
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004047f0
ret

Function at 0x50f84c
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x150], ecx
mov dword [ebp - 0x14c], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404c7c
lea edi, [ebp - 0x148]
xor eax, eax
push ebp
push 0x50f948
push dword fs:[eax]
mov dword fs:[eax], esp
push edi
lea eax, [ebp - 0x14c]
mov ecx, 0x50f960
mov edx, dword [ebp - 4]
call fcn.00404ad8
mov eax, dword [ebp - 0x14c]
call fcn.00404c8c
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov esi, eax
cmp esi, 0xffffffff
setne al
jmp 0x50f913
cmp byte [ebx + 0x31c], 0
je 0x50f917
mov eax, dword [0x533210]
mov eax, dword [eax]
call fcn.0048e660
lea eax, [ebp - 8]
lea edx, [edi + 0x2c]
mov ecx, 0x104
call fcn.00404a3c
push dword [ebp - 4]
push 0x50f970
push dword [ebp - 8]
lea eax, [ebp - 0x150]
mov edx, 3
call fcn.00404b4c
mov edx, dword [ebp - 0x150]
mov eax, ebx
call fcn.0050f6f0
push edi
push esi
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x50f8b9
push esi
call sub.kernel32.dll_FindClose_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50f94f
lea eax, [ebp - 0x150]
mov edx, 2
call fcn.004047f0
lea eax, [ebp - 8]
mov edx, 2
call fcn.004047f0
ret
Function at 0x510024
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x51002c
xor eax, eax
push ebp
push 0x5100fd
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0040b028
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 4]
mov eax, 0x510110
call fcn.0040bd2c
lea edx, [ebp - 0x18]
mov eax, dword [0x533210]
mov eax, dword [eax]
call fcn.0048ee1c
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00409954
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 8]
mov ecx, 0x510128
call fcn.00404ad8
mov eax, dword [ebp - 8]
call fcn.004097a4
test al, al
jne 0x510098
mov eax, dword [ebp - 8]
call fcn.00409be4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0xb
lea edx, [ebp - 0x28]
mov ecx, 1
mov eax, 0x51013c
call fcn.0040a2dc
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov edx, 0x510158
call fcn.00404ad8
push 0
mov eax, dword [ebp - 0x10]
call fcn.00404c8c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x510104
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004047f0
ret
Function at 0x51f628
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov edi, eax
xor eax, eax
push ebp
push 0x51f797
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
mov edx, 0x51f7b0
call fcn.00404864
mov eax, dword [edi + 0x300]
call fcn.0047b71c
mov eax, dword [edi + 0x330]
mov eax, dword [eax + 0x26c]
call fcn.0044d490
mov ebx, 1
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov dl, byte [edx + ebx - 1]
call fcn.004049b4
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x51f7d4
call fcn.00404ad8
mov eax, dword [ebp - 8]
call fcn.00404c8c
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x51f758
mov edx, dword [0x51e848]
mov eax, 8
call fcn.004056d0
mov esi, eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0xc]
mov dl, byte [edx + ebx - 1]
call fcn.004049b4
lea eax, [ebp - 0x18]
mov edx, 0x51f7d4
call fcn.00404a94
mov edx, dword [ebp - 0x18]
lea ecx, [ebp - 4]
mov eax, edi
call fcn.0051fe78
mov edx, dword [ebp - 0x14]
mov eax, esi
call fcn.00404820
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0xc]
mov dl, byte [edx + ebx - 1]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x20]
call fcn.00403058
mov edx, 0x51f7d8
lea eax, [ebp - 0x20]
mov cl, 2
call fcn.00403028
lea edx, [ebp - 0x20]
lea eax, [esi + 4]
call fcn.00404a30
push esi
mov eax, dword [edi + 0x330]
mov eax, dword [eax + 0x26c]
mov ecx, dword [esi]
xor edx, edx
call fcn.0044d534
mov esi, eax
mov edx, 1
mov eax, esi
call fcn.0044c554
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0044c454
inc ebx
cmp ebx, 0x1b
jne 0x51f676
mov eax, dword [edi + 0x330]
mov eax, dword [eax + 0x26c]
xor edx, edx
call fcn.0044d824
xor edx, edx
call fcn.0044c760
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51f79e
lea eax, [ebp - 0x18]
mov edx, 5
call fcn.004047f0
ret
Function at 0x51fe78
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404c7c
xor eax, eax
push ebp
push 0x51ff14
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x300
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00404c8c
push eax
call sub.shell32.dll_SHGetFileInfoA
mov eax, dword [ebx + 0x300]
call fcn.0047b0b8
mov edx, dword [ebp - 0x164]
call fcn.0042f56c
mov eax, dword [ebp - 0x160]
mov dword [esi], eax
mov eax, dword [ebp - 0x164]
push eax
call sub.user32.dll_DestroyIcon
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x158]
mov ecx, 0x104
call fcn.00404a3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51ff1b
lea eax, [ebp - 4]
call fcn.004047cc
ret
Function at 0x522738
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
xor eax, eax
push ebp
push 0x5227f2
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x43e9dc]
call fcn.0043eadc
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5227d0
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 4]
call fcn.0043eb7c
mov cl, 1
mov edx, 0x522808
mov eax, dword [ebp - 4]
call fcn.0043ebe4
test al, al
je 0x5227ba
lea edx, [ebp - 0xc]
mov eax, dword [0x533210]
mov eax, dword [eax]
call fcn.0048ee1c
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.00409a1c
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0043ee80
mov eax, dword [0x532db0]
mov byte [eax + 0xc], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5227d7
mov eax, dword [ebp - 4]
call fcn.00403998
ret
Function at 0x40136d
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x405130
call fcn.004016f8
mov edi, 0x94
mov eax, edi
call fcn.004024c0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x406330], ecx
mov eax, dword [esi + 4]
mov dword [0x40633c], eax
mov edx, dword [esi + 8]
mov dword [0x406340], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x406334], esi
cmp ecx, 2
je 0x4013cd
or esi, 0x8000
mov dword [0x406334], esi
shl eax, 8
add eax, edx
mov dword [0x406338], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x401408
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401408
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x401420
cmp eax, 0x20b
je 0x40140d
mov dword [ebp - 0x1c], esi
jmp 0x401434
cmp dword [ecx + 0x84], 0xe
jbe 0x401408
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x40142e
cmp dword [ecx + 0x74], 0xe
jbe 0x401408
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push esi
call fcn.0040246e
pop ecx
test eax, eax
jne 0x401460
cmp dword [0x40631c], 1
jne 0x40144d
call fcn.00401b5f
push 0x1c
call fcn.004019e8
push 0xff
call fcn.0040184d
pop ecx
pop ecx
call fcn.004023cc
mov dword [ebp - 4], esi
call fcn.00402221
test eax, eax
jge 0x401479
push 0x1b
call fcn.00401348
pop ecx
call fcn.00402182
mov dword [0x406750], eax
call fcn.00402018
mov dword [0x406318], eax
call fcn.00401f82
test eax, eax
jge 0x40149e
push 8
call fcn.00401348
pop ecx
call fcn.00401d4f
test eax, eax
jge 0x4014af
push 9
call fcn.00401348
pop ecx
push 1
call fcn.0040187d
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x4014c5
push eax
call fcn.00401348
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
call fcn.00401d09
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x4014e6
movzx eax, word [ebp - 0x40]
jmp 0x4014e9
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.00401250
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x401507
push edi
call fcn.004019a8
call fcn.004019ca
jmp 0x401539
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.00401733
ret