joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e7e8c
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404d18
xor eax, eax
push ebp
push 0x4e7f25
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00404d28
push eax
call sub.shell32.dll_SHGetFileInfoA
mov eax, dword [ebx + 0x32c]
call fcn.0047a3c4
mov edx, dword [ebp - 0x164]
call fcn.0042fb44
mov esi, eax
mov eax, dword [ebx + 0x330]
call fcn.0047a3c4
mov edx, dword [ebp - 0x164]
call fcn.0042fb44
mov eax, dword [ebp - 0x164]
push eax
call sub.user32.dll_DestroyIcon
mov ebx, esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e7f2c
lea eax, [ebp - 4]
call fcn.00404868
ret
Function at 0x4e9958
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x160], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00404d18
lea eax, [ebp - 0x15c]
mov edx, dword [0x407fa4]
call fcn.00405228
xor eax, eax
push ebp
push 0x4e9aa0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404d28
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
lea ecx, [ebp - 0x15c]
mov edx, 0x10
mov eax, 0x4e9ab8
call fcn.004099b4
jmp 0x4e9a52
mov eax, dword [0x55c428]
mov eax, dword [eax]
call fcn.0048da60
mov eax, dword [ebp - 0x150]
mov edx, 0x4e9ac4
call fcn.00404c74
je 0x4e9a52
mov eax, dword [ebp - 0x150]
mov edx, 0x4e9ad0
call fcn.00404c74
je 0x4e9a52
mov eax, dword [esi + 0x22c]
call fcn.00452fdc
mov ebx, eax
mov edx, dword [ebp - 0x150]
mov eax, ebx
call fcn.00452a7c
push dword [ebp - 4]
push 0x4e9adc
push dword [ebp - 0x150]
lea eax, [ebp - 0x160]
mov edx, 3
call fcn.00404be8
mov edx, dword [ebp - 0x160]
mov eax, dword [ebx + 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x4e9ae8
mov eax, dword [ebx + 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x4e9af8
mov eax, dword [ebx + 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x15c]
call fcn.00409a04
test eax, eax
je 0x4e99c2
mov edx, esi
mov eax, edi
call fcn.004edcc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e9aa7
lea eax, [ebp - 0x160]
call fcn.00404868
lea eax, [ebp - 0x15c]
mov edx, dword [0x407fa4]
call fcn.004052f8
lea eax, [ebp - 4]
call fcn.00404868
ret
Function at 0x4eb8f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4eb8f8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4ebab5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xff
call fcn.004027dc
mov ebx, eax
push 0xff
push ebx
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.00404a60
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 8]
mov ecx, 0x4ebacc
call fcn.00404b74
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x43e024]
call fcn.0043e0d4
mov dword [ebp - 0xc], eax
mov dl, 1
mov eax, dword [0x4187ec]
call fcn.00403a04
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4eba8b
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 0x10]
mov edx, 0x4ebae0
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x40]
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4eba6d
inc eax
mov dword [ebp - 0x14], eax
xor esi, esi
mov edx, dword [0x4d01c4]
mov eax, 8
call fcn.0040576c
mov ebx, eax
mov eax, ebx
mov edx, 0x4ebae0
call fcn.004048bc
lea ecx, [ebp - 0x1c]
mov edx, esi
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 4]
call fcn.004048bc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x338]
mov edx, ebx
call fcn.0041aaf4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x304]
mov eax, dword [eax + 0x22c]
call fcn.00452fdc
mov ebx, eax
lea ecx, [ebp - 0x20]
mov edx, esi
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x20]
mov eax, ebx
call fcn.00452a7c
push 0
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x28]
mov edx, esi
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov ecx, dword [ebp - 0x28]
mov edx, 0x4ebae0
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebx + 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebx + 8]
mov edx, 0x4ebaf0
mov ecx, dword [eax]
call dword [ecx + 0x38]
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.00452c34
mov ecx, 2
mov edx, 2
mov eax, ebx
call fcn.00452c34
inc esi
dec dword [ebp - 0x14]
jne 0x4eb99a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4eba92
mov eax, dword [ebp - 0xc]
call fcn.00403a34
mov eax, dword [ebp - 0x10]
call fcn.00403a34
ret
Function at 0x4ebaf8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4ebb00
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4ebca1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xff
call fcn.004027dc
mov ebx, eax
push 0xff
push ebx
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.00404a60
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 8]
mov ecx, 0x4ebcb8
call fcn.00404b74
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x43e024]
call fcn.0043e0d4
mov dword [ebp - 0xc], eax
mov dl, 1
mov eax, dword [0x4187ec]
call fcn.00403a04
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4ebc77
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 0x10]
mov edx, 0x4ebccc
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x40]
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4ebc59
inc eax
mov dword [ebp - 0x14], eax
xor ebx, ebx
mov edx, dword [0x4d01c4]
mov eax, 8
call fcn.0040576c
mov esi, eax
mov eax, esi
mov edx, 0x4ebccc
call fcn.004048bc
lea ecx, [ebp - 0x1c]
mov edx, ebx
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x1c]
lea eax, [esi + 4]
call fcn.004048bc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x338]
mov edx, esi
call fcn.0041aaf4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x304]
mov eax, dword [eax + 0x22c]
call fcn.00452fdc
mov esi, eax
lea ecx, [ebp - 0x20]
mov edx, ebx
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x20]
mov eax, esi
call fcn.00452a7c
push 0
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x28]
mov edx, ebx
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov ecx, dword [ebp - 0x28]
mov edx, 0x4ebccc
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi]
mov edx, dword [ebp - 0x24]
mov eax, dword [esi + 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [esi + 8]
mov edx, 0x4ebcd8
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc ebx
dec dword [ebp - 0x14]
jne 0x4ebba2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ebc7e
mov eax, dword [ebp - 0xc]
call fcn.00403a34
mov eax, dword [ebp - 0x10]
call fcn.00403a34
ret
Function at 0x4f0a78
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
push ebx
xor edx, edx
mov dword [ebp - 0x168], edx
mov dword [ebp - 0x16c], edx
mov dword [ebp - 0x164], edx
mov dword [ebp - 0x160], edx
mov dword [ebp - 0x15c], edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0x158], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4f0d48
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x43efdc]
call fcn.0043f0dc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4f0c7b
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.0043f17c
xor ecx, ecx
mov edx, 0x4f0d5c
mov eax, dword [ebp - 8]
call fcn.0043f1e4
test al, al
je 0x4f0b6a
lea edx, [ebp - 0x158]
mov eax, dword [0x55c428]
mov eax, dword [eax]
call fcn.0048e21c
mov eax, dword [ebp - 0x158]
lea edx, [ebp - 0x154]
call fcn.00409ba4
mov edx, dword [ebp - 0x154]
lea ecx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0043f760
lea edx, [ebp - 0x15c]
mov eax, dword [0x55c428]
mov eax, dword [eax]
call fcn.0048e21c
mov edx, dword [ebp - 0x15c]
mov eax, dword [ebp - 0xc]
call fcn.00404c74
sete dl
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x31c]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
mov eax, dword [ebp - 8]
call fcn.0043f14c
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.0043f17c
xor ecx, ecx
mov edx, 0x4f0d94
mov eax, dword [ebp - 8]
call fcn.0043f1e4
test al, al
je 0x4f0c5d
lea ecx, [ebp - 0xc]
mov edx, 0x4f0db8
mov eax, dword [ebp - 8]
call fcn.0043f760
mov eax, dword [ebp - 0xc]
mov edx, 0x4f0dd0
call fcn.00404c74
sete dl
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x328]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
lea ecx, [ebp - 0xc]
mov edx, 0x4f0ddc
mov eax, dword [ebp - 8]
call fcn.0043f760
mov eax, dword [ebp - 0xc]
mov edx, 0x4f0dd0
call fcn.00404c74
sete dl
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x32c]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
lea ecx, [ebp - 0xc]
mov edx, 0x4f0df0
mov eax, dword [ebp - 8]
call fcn.0043f760
mov eax, dword [ebp - 0xc]
mov edx, 0x4f0dd0
call fcn.00404c74
sete dl
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x340]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
lea ecx, [ebp - 0x10]
mov edx, 0x4f0e04
mov eax, dword [ebp - 8]
call fcn.0043f760
lea edx, [ebp - 0x160]
mov eax, dword [ebp - 0x10]
call fcn.00408ee0
cmp dword [ebp - 0x160], 0
jne 0x4f0c5d
lea eax, [ebp - 0x10]
mov edx, 0x4f0e14
call fcn.00404900
mov eax, dword [ebp - 8]
call fcn.0043f14c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f0c82
mov eax, dword [ebp - 8]
call fcn.00403a34
ret
Function at 0x4f1888
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor edx, edx
mov dword [ebp - 0x104], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4f18f8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x100]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathA
push ebx
lea edx, [ebp - 0x104]
lea eax, [ebp - 0x100]
call fcn.00409fe0
mov eax, dword [ebp - 0x104]
mov ecx, 3
xor edx, edx
call fcn.00404d88
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f18ff
lea eax, [ebp - 0x104]
call fcn.00404868
ret

Function at 0x4f1904
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4f1a88
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4187ec]
call fcn.00403a04
mov dword [ebp - 0x10], eax
mov dl, 1
mov eax, dword [0x43efdc]
call fcn.0043f0dc
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4f1a59
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 4]
call fcn.0043f17c
xor ecx, ecx
mov edx, 0x4f1aa0
mov eax, dword [ebp - 4]
call fcn.0043f1e4
test al, al
je 0x4f1985
lea ecx, [ebp - 8]
mov edx, 0x4f1ad4
mov eax, dword [ebp - 4]
call fcn.0043f760
mov eax, dword [ebp - 4]
call fcn.0043f14c
xor ecx, ecx
mov edx, 0x4f1ae8
mov eax, dword [ebp - 4]
call fcn.0043f1e4
test al, al
je 0x4f1a3b
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0043f970
test al, al
je 0x4f19bb
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0043f480
jmp 0x4f1a3b
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0043f5d0
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x4f1a3b
inc esi
xor ebx, ebx
lea ecx, [ebp - 0x14]
mov edx, ebx
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.0043f710
dec eax
sub al, 2
jae 0x4f1a37
lea ecx, [ebp - 0x18]
mov edx, ebx
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x18]
lea ecx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0043f760
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00404e6c
test eax, eax
jle 0x4f1a37
lea ecx, [ebp - 0x1c]
mov edx, ebx
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.0043f480
inc ebx
dec esi
jne 0x4f19d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f1a60
mov eax, dword [ebp - 4]
call fcn.00403a34
mov eax, dword [ebp - 0x10]
call fcn.00403a34
ret
Function at 0x4f1b18
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4f1b20
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4f1c94
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x43efdc]
call fcn.0043f0dc
mov dword [ebp - 4], eax
mov dl, 1
mov eax, dword [0x4187ec]
call fcn.00403a04
mov esi, eax
xor eax, eax
push ebp
push 0x4f1c6a
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 4]
call fcn.0043f17c
mov cl, 1
mov edx, 0x4f1cac
mov eax, dword [ebp - 4]
call fcn.0043f1e4
test al, al
je 0x4f1c54
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.0043f5d0
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4f1c54
inc eax
mov dword [ebp - 0xc], eax
xor ebx, ebx
lea ecx, [ebp - 0x10]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0043f710
dec eax
sub al, 2
jae 0x4f1c4a
lea ecx, [ebp - 0x14]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0043f760
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 8]
call fcn.00408dd0
mov eax, dword [ebp - 0x18]
push eax
lea edx, [ebp - 0x1c]
mov eax, 0x4f1ce4
call fcn.00408dd0
mov eax, dword [ebp - 0x1c]
pop edx
call fcn.00404e6c
test eax, eax
jg 0x4f1c33
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 8]
call fcn.00408dd0
mov eax, dword [ebp - 0x20]
push eax
lea edx, [ebp - 0x24]
mov eax, 0x4f1cf8
call fcn.00408dd0
mov eax, dword [ebp - 0x24]
pop edx
call fcn.00404e6c
test eax, eax
jle 0x4f1c4a
lea ecx, [ebp - 0x28]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.0043f480
inc ebx
dec dword [ebp - 0xc]
jne 0x4f1ba7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f1c71
mov eax, dword [ebp - 4]
call fcn.00403a34
ret
Function at 0x4f6480
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4f6488
push ebx
mov ebx, edx
xor eax, eax
push ebp
push 0x4f6565
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0040b568
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 4]
mov eax, 0x4f657c
call fcn.0040c26c
lea edx, [ebp - 0x14]
mov eax, dword [0x55c428]
mov eax, dword [eax]
call fcn.0048e21c
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00409adc
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x4f6594
call fcn.00404b74
mov eax, dword [ebp - 8]
call fcn.0040992c
test al, al
jne 0x4f64f7
mov eax, dword [ebp - 8]
call fcn.00409dd8
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0xb
lea edx, [ebp - 0x28]
mov ecx, 1
mov eax, 0x4f65a8
call fcn.0040a4d0
mov edx, dword [ebp - 0x18]
mov eax, ebx
call fcn.004048bc
mov ecx, dword [ebx]
lea eax, [ebp - 0xc]
mov edx, 0x4f65c4
call fcn.00404b74
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404d28
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f656c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.0040488c
ret
Function at 0x4f82b4
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
call fcn.00404d18
xor eax, eax
push ebp
push 0x4f84a1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
mov eax, dword [ebp + 0x10]
call fcn.00404d28
push eax
mov eax, dword [ebp + 0x14]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4f846f
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x130]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
mov dword [ebp - 0x10], 0x3e8
cmp dword [ebp - 0x18], 0
jne 0x4f8367
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 4]
call fcn.004f7d98
mov ebx, dword [ebp - 0x18]
dec ebx
test ebx, ebx
jl 0x4f846f
inc ebx
xor esi, esi
mov eax, dword [0x55c098]
cmp byte [eax], 1
je 0x4f846f
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x230]
push eax
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegEnumKeyExA
cmp dword [ebp + 0x10], 0
jne 0x4f83d2
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x230]
mov dword [ebp - 0x238], eax
mov byte [ebp - 0x234], 6
lea edx, [ebp - 0x238]
xor ecx, ecx
mov eax, 0x4f84bc
call fcn.0040a4d0
jmp 0x4f8419
push dword [ebp + 0x10]
push 0x4f84c8
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x230]
mov dword [ebp - 0x238], eax
mov byte [ebp - 0x234], 6
lea edx, [ebp - 0x238]
xor ecx, ecx
mov eax, 0x4f84bc
call fcn.0040a4d0
push dword [ebp - 0x23c]
lea eax, [ebp - 0x30]
mov edx, 3
call fcn.00404be8
mov edx, dword [ebp - 0x30]
mov eax, edi
call fcn.0046d0e8
call fcn.004d27bc
mov eax, dword [ebp - 0x30]
mov edx, 0x4f84d4
call fcn.00404c74
je 0x4f8454
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.004f82b4
mov dword [ebp - 0x10], 0x3e8
mov eax, dword [0x55c428]
mov eax, dword [eax]
call fcn.0048da60
inc esi
dec ebx
jne 0x4f8376
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f84a8
lea eax, [ebp - 0x23c]
call fcn.00404868
lea eax, [ebp - 0x30]
call fcn.00404868
lea eax, [ebp + 0x10]
call fcn.00404868
ret
Function at 0x4fa878
Capabilities:
Enumerate files on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0x158], edx
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4fa9e4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [edi + 0x310]
mov eax, dword [eax + 0x22c]
call fcn.00453138
lea edx, [ebp - 0x14c]
mov eax, dword [0x55c428]
mov eax, dword [eax]
call fcn.0048e21c
mov eax, dword [ebp - 0x14c]
lea edx, [ebp - 0x148]
call fcn.00409adc
mov edx, dword [ebp - 0x148]
lea eax, [ebp - 4]
mov ecx, 0x4fa9fc
call fcn.00404b74
mov eax, dword [ebp - 4]
call fcn.00404d28
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [ebp - 0x144]
push eax
push 0x4faa08
call sub.kernel32.dll_FindFirstFileA_1
mov esi, eax
cmp esi, 0xffffffff
je 0x4fa9b8
mov eax, dword [edi + 0x310]
mov eax, dword [eax + 0x22c]
call fcn.00452fdc
mov ebx, eax
lea eax, [ebp - 0x140]
call fcn.004d0b68
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x150]
call fcn.0040c258
mov edx, dword [ebp - 0x150]
mov eax, ebx
call fcn.00452a7c
lea eax, [ebp - 0x158]
lea edx, [ebp - 0x118]
mov ecx, 0x104
call fcn.00404ad8
mov ecx, dword [ebp - 0x158]
lea eax, [ebp - 0x154]
mov edx, dword [ebp - 4]
call fcn.00404b74
mov edx, dword [ebp - 0x154]
mov eax, dword [ebx + 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x144]
push eax
push esi
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4fa928
push esi
call sub.kernel32.dll_FindClose_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fa9eb
lea eax, [ebp - 0x158]
mov edx, 5
call fcn.0040488c
lea eax, [ebp - 4]
call fcn.00404868
ret

Function at 0x4fb228
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4fb2a9
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 4]
lea eax, [ebp - 0x109]
call fcn.00409fe0
lea eax, [ebp - 4]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404d88
lea eax, [ebp - 4]
mov edx, 0x4fb2c0
call fcn.00404b30
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.004048bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fb2b0
lea eax, [ebp - 4]
call fcn.00404868
ret