joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44c9d3
Capabilities:
Set current directory

Disassembly:
push 8
mov eax, 0x4a39ef
call fcn.0049cb58
xor esi, esi
cmp dword [ebx + 4], esi
je 0x44c9ef
xor eax, eax
inc eax
call fcn.0049cc30
ret
mov eax, dword [0x4dff94]
mov ecx, 0x4dff94
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 4], esi
call fcn.00420f84
pop ecx
lea edi, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00408098
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00401291
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], esi
jne 0x44ca99
push 0x104
push 0x10e
mov esi, edi
call fcn.004015fc
push eax
push 0x400000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x44ca60
push dword [ebp - 0x10]
call dword [sym.imp.MSVCR80.dll_wcslen]
pop ecx
lea edx, [ebp - 0x10]
call fcn.00401381
push 0x5c
lea esi, [ebp - 0x10]
call fcn.0042086d
mov ecx, eax
inc ecx
lea edx, [ebp - 0x14]
mov eax, esi
call fcn.00414d80
mov edi, esi
mov byte [ebp - 4], 2
call fcn.00408098
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00401291
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov edi, str.kvip.dll
lea eax, [ebp - 0x14]
push edi
push eax
lea ecx, [ebp - 0x10]
call fcn.00407fbe
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
pop ecx
pop ecx
push dword [eax]
call esi
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00401291
cmp dword [ebx + 4], 0
jne 0x44cade
push edi
call esi
test eax, eax
mov dword [ebx + 4], eax
je 0x44cb33
push str.KVipGetClassObject
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x44cb33
lea esi, [ebx + 8]
and dword [esi], 0
push esi
push 0x4b8d0c
call eax
test eax, eax
jl 0x44cb33
mov esi, dword [esi]
test esi, esi
je 0x44cb33
push dword [0x4e0364]
mov eax, dword [esi]
push dword [0x4e0360]
push esi
call dword [eax + 0xc]
test eax, eax
jl 0x44cb33
xor esi, esi
inc esi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401291
mov eax, esi
jmp 0x44c9e9
mov esi, ebx
call fcn.0044cb3e
xor esi, esi
jmp 0x44cb21
Function at 0x44fd42
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
xor edi, edi
inc edi
cmp dword [ebp + 0xc], 0x4e
jne 0x44fd7e
mov eax, dword [ebp + 0x14]
cmp dword [eax + 4], 0x3e8
jne 0x44fdd6
push ebx
lea ebx, [esi + 0x328]
push esi
mov dword [ebx], edi
call fcn.0044fccc
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
cmp dword [ebx], 0
pop ebx
je 0x44fdd6
mov eax, edi
jmp 0x44fe13
cmp dword [ebp + 0xc], 0x113
jne 0x44fdd6
cmp dword [ebp + 0x10], edi
mov dword [esi + 0x328], edi
jne 0x44fdc7
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push dword [ebp - 4]
lea eax, [esi + 0x32c]
push dword [ebp - 8]
push eax
call fcn.00414f7e
test eax, eax
jne 0x44fdc7
push edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp + 0x18]
and dword [eax], 0
cmp dword [esi + 0x328], 0
jmp 0x44fd75
push 0
push dword [ebp + 0x18]
mov ecx, esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0048c167
test eax, eax
jne 0x44fd77
cmp dword [ebp + 0xc], 0x110
jne 0x44fe18
mov ecx, dword [ebp + 0x18]
lea eax, [esi + 0x328]
mov dword [eax], edi
mov dword [ecx], edi
cmp dword [eax], 0
jne 0x44fd77
xor eax, eax
pop edi
leave
ret 0x14
cmp dword [ebp + 0xc], 0x401
jne 0x44fe11
mov ecx, esi
call fcn.0044f895
mov eax, dword [ebp + 0x18]
and dword [eax], 0
jmp 0x44fd77
Function at 0x450a5d
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
inc ebx
cmp eax, ebx
push esi
jne 0x450a8d
mov esi, edi
mov dword [edi + 0x24], ebx
call fcn.00450979
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
cmp dword [edi + 0x24], 0
je 0x450b1d
mov eax, ebx
jmp 0x450b56
cmp eax, 5
jne 0x450abc
mov ecx, dword [ebp + 0x10]
movsx eax, word [ebp + 0x10]
shr ecx, 0x10
push ebx
movsx ecx, cx
push ecx
push eax
xor esi, esi
push esi
push esi
push dword [edi + 0x2c]
mov dword [edi + 0x24], ebx
call dword [sym.imp.USER32.dll_MoveWindow]
mov eax, dword [ebp + 0x14]
mov dword [eax], esi
cmp dword [edi + 0x24], esi
jmp 0x450a80
cmp eax, 0x133
jne 0x450ae1
push ebx
push dword [ebp + 0xc]
mov dword [edi + 0x24], ebx
call dword [sym.imp.GDI32.dll_SetBkMode]
push dword [edi + 0x28]
push dword [ebp + 0xc]
call dword [sym.imp.GDI32.dll_SetTextColor]
mov eax, dword [edi + 0x34]
jmp 0x450a77
cmp eax, 0x138
je 0x450ac3
cmp eax, 0xc
jne 0x450b01
push dword [ebp + 0x10]
mov dword [edi + 0x24], ebx
push dword [edi + 0x2c]
call dword [sym.imp.USER32.dll_SetWindowTextW]
jmp 0x450a77
cmp eax, 0xd
jne 0x450b1d
push dword [ebp + 0xc]
mov dword [edi + 0x24], ebx
push dword [ebp + 0x10]
push dword [edi + 0x2c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x450a77
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
mov ebx, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
mov ecx, edi
call fcn.00414e29
test eax, eax
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
jne 0x450b4e
mov eax, dword [ebp + 8]
add eax, 0xfffffece
cmp eax, 6
ja 0x450b4e
and dword [ebp - 4], 0
xor eax, eax
cmp dword [ebp - 4], eax
setne al
pop esi
pop ebx
leave
ret 0x10

Function at 0x450cc3
Capabilities:
Create process on windows

Disassembly:
mov edx, dword [ecx + 8]
push ebx
xor ebx, ebx
inc ebx
cmp edx, ebx
jne 0x450cf1
mov ecx, dword [ecx + 0xc]
cmp ecx, 0x64
jne 0x450cdf
call fcn.0041fad5
mov eax, ebx
pop ebx
ret
cmp ecx, 0x6b
je 0x450cd6
cmp ecx, 0x67
jne 0x450d2e
push eax
call fcn.004637c8
jmp 0x450cdb
cmp edx, 5
jne 0x450d65
cmp dword [ecx + 0xc], 0x7d1
jne 0x450d65
push esi
mov esi, dword [ecx + 0x14]
push edi
lea edi, [eax + 0x50]
mov eax, dword [ecx + 0x10]
add eax, 0xca
push ebx
push eax
mov eax, edi
call fcn.00409584
push 0
add esi, 0xca
push esi
mov eax, edi
call fcn.00409584
pop edi
pop esi
mov eax, ebx
pop ebx
ret
cmp ecx, 0x75
jne 0x450d41
push dword [eax + 0x354]
call fcn.0044c740
pop ecx
jmp 0x450cdb
cmp ecx, 0x7d3
jne 0x450d65
push 5
xor eax, eax
push eax
push eax
push 0x4ba998
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x450cdb
and dword [eax + 0x334], 0
xor eax, eax
pop ebx
ret
Function at 0x45228e
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
cmp dword [ebp + 0x258], 1
jg 0x4522b9
cmp byte [ebp + 0x2bc], 0
jne 0x4522b2
mov eax, dword [esp + 8]
cmp byte [eax + 0x93e], 0
je 0x4522b9
xor eax, eax
jmp 0x452371
push ebx
push edi
mov edi, dword [sym.imp.USER32.dll_AppendMenuW]
push 0x4b9004
push 0x2328
xor ebx, ebx
push ebx
push dword [esi]
call edi
push 0x4b9010
push 0x2329
push ebx
push dword [esi]
call edi
push 0x4b901c
push 0x232a
push ebx
push dword [esi]
call edi
push 0x4b9024
push 0x232b
push ebx
push dword [esi]
call edi
push 0x4b902c
mov ebx, 0x232c
push ebx
push 0
push dword [esi]
call edi
push 0x4b9034
push 0x232d
push 0
push dword [esi]
call edi
cmp dword [ebp + 0x258], 1
mov edi, dword [sym.imp.USER32.dll_EnableMenuItem]
jle 0x45233d
lea eax, [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x45234f
push 1
push 0x2328
push dword [esi]
call edi
push 1
push ebx
push dword [esi]
call edi
cmp byte [ebp + 0x2bc], 0
jne 0x452365
mov eax, dword [esp + 0x10]
cmp byte [eax + 0x93e], 0
je 0x45236c
push 1
push ebx
push dword [esi]
call edi
xor eax, eax
pop edi
inc eax
pop ebx
pop ebp
ret 8
Function at 0x4539bd
Capabilities:
Check if file exists

Disassembly:
push 0x23c
mov eax, 0x4a88ff
call fcn.0049cbc1
mov ebx, ecx
push 3
lea eax, [esi + 0x50]
mov dword [ebp - 0x244], ebx
call fcn.0041faf5
test eax, eax
jne 0x4539e8
push ebx
jmp 0x453af8
call fcn.0044c5ef
xor edi, edi
cmp eax, edi
mov dword [esi + 0x90c], eax
jne 0x453a00
call fcn.0044c3ce
jmp 0x4539e2
push 0x208
lea eax, [ebp - 0x21e]
push edi
push eax
mov word [ebp - 0x220], di
call sub.MSVCR80.dll_memset
add esp, 0xc
push edi
push edi
push 0xffffffffffffffff
push ebx
mov ebx, dword [sym.imp.SHELL32.dll_DragQueryFileW]
call ebx
cmp eax, edi
mov dword [ebp - 0x248], eax
mov dword [ebp - 0x240], edi
jbe 0x453ac8
push 0x104
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x240]
push dword [ebp - 0x244]
call ebx
lea edi, [ebp - 0x220]
call fcn.004538c1
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x453aae
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x453aae
mov eax, edi
push eax
lea ecx, [ebp - 0x23c]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
and dword [ebp - 4], 0
push 1
lea eax, [ebp - 0x23c]
push eax
push esi
call fcn.004530dd
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x23c]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
inc dword [ebp - 0x240]
mov eax, dword [ebp - 0x240]
cmp eax, dword [ebp - 0x248]
jb 0x453a3d
xor edi, edi
lea ebx, [esi + 0x368]
cmp dword [ebx], edi
jne 0x453ae7
push edi
xor edi, edi
push 0x3e8
inc edi
push edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [ebx], edi
lea ecx, [esi + 0x870]
call fcn.0046b29a
push dword [ebp - 0x244]
call dword [sym.imp.SHELL32.dll_DragFinish]
call fcn.0049cc44
ret

Function at 0x45457a
Capabilities:
Check if file exists

Disassembly:
push edi
lea edi, [ebx + 8]
push edi
lea ecx, [esi + 0x60]
call dword [0x4aa3c4]
mov eax, dword [edi + 0x238]
dec eax
push 0
pop edx
je 0x4545cd
dec eax
je 0x4545c9
push 6
pop ecx
sub eax, ecx
je 0x4545c5
sub eax, 8
je 0x4545bd
sub eax, 0x10
je 0x4545b5
sub eax, 0x20
jne 0x4545c9
mov dword [esi], 5
jmp 0x4545d3
mov dword [esi], 1
jmp 0x4545d3
mov dword [esi], 3
jmp 0x4545d3
mov dword [esi], ecx
jmp 0x4545d3
mov dword [esi], edx
jmp 0x4545d3
mov dword [esi], 4
mov eax, dword [edi + 0x250]
sub eax, edx
je 0x4545f2
dec eax
je 0x4545e9
mov dword [esi + 8], 0xa
jmp 0x4545f5
mov dword [esi + 8], 5
jmp 0x4545f5
mov dword [esi + 8], edx
movzx eax, byte [ebx + 0x2bc]
push edi
mov dword [esi + 0x7c], eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0xc], eax
pop edi
ret
Function at 0x4550a4
Capabilities:
Create process on windows

Disassembly:
push 0xc
mov eax, 0x4a85af
call fcn.0049cb58
lea eax, [ebp - 0x10]
push eax
call fcn.0044c6f2
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
mov dword [esp], 0x4b92d8
push eax
call fcn.0040917f
lea eax, [ebp - 0x14]
push str.__Setting_Other
push eax
lea ecx, [ebp - 0x10]
call fcn.00407fbe
pop ecx
pop ecx
mov byte [ebp - 4], 1
mov edi, dword [ebp - 0x14]
call fcn.00451aaa
test eax, eax
je 0x455109
push 1
push 0
push str._Setting_Other
push dword [ebp - 0x10]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00401291
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401291
call fcn.0049cc30
ret

Function at 0x455125
Capabilities:
Check if file exists

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push 1
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push ebx
push ebx
push 0x4b9338
push dword [ebp + 4]
call fcn.00409091
add esp, 0x24
test al, 1
je 0x455209
push 2
lea eax, [ebp + 0x50]
call fcn.0041faf5
test eax, eax
je 0x4551b5
lea eax, [ebp + 0x924]
call fcn.0044797e
mov esi, eax
dec esi
js 0x4551b1
lea edi, [ebp + 0x91c]
mov eax, esi
mov ecx, edi
call fcn.00467733
mov ecx, dword [eax + 0x258]
add eax, 8
cmp ecx, ebx
je 0x45519a
cmp ecx, 1
je 0x45519a
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4551ae
push esi
lea eax, [ebp + 0x3bc]
push eax
call fcn.0046514d
push esi
push edi
call fcn.00467792
dec esi
jns 0x455174
push 1
jmp 0x455202
lea ebx, [ebp + 0x870]
mov eax, ebx
call fcn.0044797e
mov esi, eax
jmp 0x4551fd
mov edi, ebx
call fcn.0046b110
mov edi, eax
add eax, 0xffffff60
neg edi
sbb edi, edi
and edi, eax
lea edx, [edi + 0xa0]
mov eax, edx
call fcn.00469f0d
test eax, eax
je 0x4551fd
call fcn.0046989d
cmp eax, 7
je 0x4551fd
push edi
mov edi, ebp
call fcn.00453bba
dec esi
jns 0x4551c6
push 2
mov esi, ebp
call fcn.00455382
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x4558be
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov edi, eax
mov eax, dword [0x4e05ac]
xor esi, esi
cmp eax, esi
mov dword [esp + 0x1c], esi
je 0x4558db
mov ebp, dword [eax + 4]
jmp 0x4558dd
xor ebp, ebp
cmp ebp, esi
jne 0x4558ed
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov ebp, eax
cmp ebp, esi
je 0x455912
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp ebp, eax
je 0x455912
push ebp
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x455912
push esi
push ebp
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [esp + 0x1c], 1
push ebp
mov ebx, edi
mov dword [edi + 0x320], esi
call fcn.00456a3f
cmp eax, esi
mov dword [esp + 0x14], eax
jne 0x455938
push 1
push ebp
call dword [sym.imp.USER32.dll_EnableWindow]
xor eax, eax
jmp 0x455a1d
mov edx, eax
call fcn.00407b88
mov dword [esp + 0x20], eax
lea ebx, [edi + 4]
push ebx
mov eax, ebp
call fcn.00407a3b
cmp dword [edi + 0x314], esi
je 0x4559c8
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push esi
push esi
push esi
push 0x2001
mov dword [esp + 0x20], eax
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0x43
push esi
push esi
push esi
push esi
push esi
push dword [esp + 0x2c]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [esp + 0x18]
cmp eax, dword [esp + 0x10]
je 0x4559a8
push 1
push eax
push dword [esp + 0x18]
call dword [sym.imp.USER32.dll_AttachThreadInput]
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [esp + 0x18]
cmp eax, dword [esp + 0x10]
je 0x4559c8
push esi
push eax
push dword [esp + 0x18]
call dword [sym.imp.USER32.dll_AttachThreadInput]
call fcn.00404288
push 0x97
push esi
push esi
push esi
push esi
push esi
push dword [ebx]
mov dword [edi + 0x320], esi
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp dword [esp + 0x1c], esi
je 0x455a09
push 1
push ebp
call dword [sym.imp.USER32.dll_EnableWindow]
cmp ebp, esi
je 0x455a09
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [ebx]
jne 0x455a09
push ebp
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov edx, dword [esp + 0x20]
call fcn.00407b88
push dword [ebx]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [edi + 0x28]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x4567a9
Capabilities:
Set current directory

Disassembly:
push 8
mov eax, 0x4a39ef
call fcn.0049cb58
xor esi, esi
cmp dword [ebx + 4], esi
je 0x4567c5
xor eax, eax
inc eax
call fcn.0049cc30
ret
mov eax, dword [0x4dff94]
mov ecx, 0x4dff94
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 4], esi
call fcn.00420f84
pop ecx
lea edi, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00408098
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00401291
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], esi
jne 0x45686f
push 0x104
push 0x10e
mov esi, edi
call fcn.004015fc
push eax
push 0x400000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x456836
push dword [ebp - 0x10]
call dword [sym.imp.MSVCR80.dll_wcslen]
pop ecx
lea edx, [ebp - 0x10]
call fcn.00401381
push 0x5c
lea esi, [ebp - 0x10]
call fcn.0042086d
mov ecx, eax
inc ecx
lea edx, [ebp - 0x14]
mov eax, esi
call fcn.00414d80
mov edi, esi
mov byte [ebp - 4], 2
call fcn.00408098
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00401291
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov edi, str.kvipcore.dll
lea eax, [ebp - 0x14]
push edi
push eax
lea ecx, [ebp - 0x10]
call fcn.00407fbe
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
pop ecx
pop ecx
push dword [eax]
call esi
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00401291
cmp dword [ebx + 4], 0
jne 0x4568b4
push edi
call esi
test eax, eax
mov dword [ebx + 4], eax
je 0x456909
push str.KVipGetClassObject
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x456909
lea esi, [ebx + 8]
and dword [esi], 0
push esi
push 0x4b9984
call eax
test eax, eax
jl 0x456909
mov esi, dword [esi]
test esi, esi
je 0x456909
push dword [0x4e0364]
mov eax, dword [esi]
push dword [0x4e0360]
push esi
call dword [eax + 0xc]
test eax, eax
jl 0x456909
xor esi, esi
inc esi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401291
mov eax, esi
jmp 0x4567bf
mov esi, ebx
call fcn.0044cb3e
xor esi, esi
jmp 0x4568f7

Function at 0x45e274
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x4db020]
xor eax, ebp
mov dword [ebp + 0x94], eax
push 0x110
lea eax, [ebp - 0x7c]
push 0
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x45e2cd
cmp dword [ebp - 0x7c], 5
jae 0x45e2c9
cmp dword [ebp - 0x7c], 4
jne 0x45e2cd
cmp dword [ebp - 0x78], 0x5a
jb 0x45e2cd
xor eax, eax
jmp 0x45e2d0
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x94]
xor ecx, ebp
call fcn.00495616
add ebp, 0x98
leave
ret
Function at 0x45f66f
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
lea eax, [ebp - 4]
push eax
push 0x28
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x45f6dc
lea eax, [ebp - 0xc]
push eax
push 0x4b9e0c
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x45f6d3
mov eax, dword [ebp - 0xc]
push esi
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
push esi
push esi
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x45f6d3
inc esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
leave
ret
Function at 0x45f710
Capabilities:
Delete file
Move file
Set file attributes

Disassembly:
push 0x64
mov eax, 0x4a0152
call fcn.0049cbc1
push 0x80
mov edi, ecx
push esi
mov dword [ebp - 0x70], edi
mov ebx, edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
call fcn.0045f66f
push ebx
push esi
mov eax, edi
call fcn.0045f82f
push esi
mov ecx, edi
call fcn.0045f877
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 4
push 0
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call ebx
test eax, eax
je 0x45f767
mov al, 1
call fcn.0049cc44
ret
and word [ebp - 0x50], 0
push 0x3e
lea eax, [ebp - 0x4e]
push 0
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x4b9e30
lea eax, [ebp - 0x50]
push 0x20
push eax
call dword [sym.imp.MSVCR80.dll_swprintf_s]
add esp, 0x10
push esi
lea ecx, [ebp - 0x6c]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
and dword [ebp - 4], 0
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x6c]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
push str..tmp
lea ecx, [ebp - 0x6c]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
cmp dword [ebp - 0x54], 8
mov eax, dword [ebp - 0x68]
jae 0x45f7cc
lea eax, [ebp - 0x68]
push eax
push esi
call dword [sym.imp.MSVCR80.dll__wrename]
test eax, eax
pop ecx
pop ecx
jne 0x45f82b
cmp dword [ebp - 0x54], 8
mov eax, dword [ebp - 0x68]
jae 0x45f7e6
lea eax, [ebp - 0x68]
mov ecx, dword [ebp - 0x70]
push eax
call fcn.0045f877
cmp dword [ebp - 0x54], 8
mov eax, dword [ebp - 0x68]
jae 0x45f7fb
lea eax, [ebp - 0x68]
push 4
push 0
push eax
call edi
cmp dword [ebp - 0x54], 8
mov eax, dword [ebp - 0x68]
jae 0x45f80e
lea eax, [ebp - 0x68]
push eax
call ebx
test eax, eax
je 0x45f82b
mov bl, 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov al, bl
jmp 0x45f761
xor bl, bl
jmp 0x45f817

Function at 0x4637c8
Capabilities:
Create process on windows

Disassembly:
push 4
mov eax, 0x4a274f
call fcn.0049cb58
mov eax, dword [0x4dff94]
mov ecx, 0x4dff94
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
and dword [ebp - 4], 0
push dword [eax + 0x354]
lea eax, [ebp - 0x10]
push str._select_
push str._s__s
push eax
call fcn.00408085
mov esi, dword [ebp - 0x10]
add esp, 0x10
push 5
push 0
push esi
push str.explorer.exe
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [esi - 0x10]
call fcn.00401291
call fcn.0049cc30
ret 4