joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42ffa2
Capabilities:
Check if file exists
Create directory

Disassembly:
push 0x54
mov eax, 0x509867
call fcn.004da767
xor ebx, ebx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x60], ebx
call fcn.0046b6d0
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov byte [ebp - 4], 1
mov edx, eax
lea ecx, [ebp - 0x44]
call fcn.0045b880
push eax
mov edx, 0x537b10
mov dword [ebp - 0x60], 1
lea ecx, [ebp - 0x5c]
call fcn.0041a298
pop ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2c]
push eax
call fcn.004301f4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x5c]
call fcn.004056f5
xor eax, eax
inc eax
mov dword [ebp - 0x60], eax
and eax, 0xfffffffe
mov dword [ebp - 0x60], eax
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x44]
call fcn.004056f5
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0046d200
mov byte [ebp - 4], 3
cmp dword [eax + 0x14], 8
jb 0x430030
mov eax, dword [eax]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, eax
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x44]
call fcn.004056f5
test esi, esi
jne 0x430079
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0046d200
mov byte [ebp - 4], 4
cmp dword [eax + 0x14], 8
jb 0x430060
mov eax, dword [eax]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x44]
call fcn.004056f5
test esi, esi
je 0x430089
lea eax, [ebp - 0x2c]
mov ecx, 0x57f3f8
push eax
call fcn.0046ed00
mov bl, 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.004056f5
mov al, bl
call fcn.004da711
ret

Function at 0x439547
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x20c
lea ebp, [esp - 4]
mov eax, dword [0x57c074]
xor eax, ebp
mov dword [ebp + 0x20c], eax
push 4
mov eax, 0x50b6ca
call fcn.004da733
mov edi, ecx
mov esi, 0x105
lea eax, [ebp]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x4395f4
cmp eax, esi
jae 0x4395f4
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x10]
call fcn.0040da2c
xor esi, esi
mov dword [ebp - 4], esi
mov ebx, 0x538998
push ebx
call fcn.004dfc45
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x10]
call fcn.0041107c
test edi, edi
jne 0x4395b4
mov eax, esi
jmp 0x4395bb
push edi
call fcn.004dfc45
pop ecx
push eax
push edi
lea ecx, [ebp - 0x10]
call fcn.0041107c
mov edi, dword [ebp - 0x10]
push 0x5c
push edi
call fcn.004ddaca
pop ecx
pop ecx
test eax, eax
je 0x4395e1
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040d743
mov eax, esi
jmp 0x4395f6
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x20c]
xor ecx, ebp
call fcn.004d9b30
lea esp, [ebp + 0x210]
pop ebp
ret
Function at 0x440d13
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov bl, 1
mov ecx, dword [edi + 0x54]
mov eax, ecx
and eax, 0xc
cmp al, 0xc
jne 0x440d5f
mov eax, dword [edi + 4]
mov esi, dword [sym.imp.USER32.dll_GetDlgCtrlID]
push eax
mov dword [ebp - 0xc], eax
call esi
push dword [edi + 4]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0xfffffffe
call esi
push dword [edi + 4]
mov esi, eax
call dword [sym.imp.USER32.dll_GetParent]
lea ecx, [ebp - 0xc]
push ecx
push esi
push 0x4e
push eax
jmp 0x440d8a
shr ecx, 2
test cl, 1
je 0x440d92
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
push dword [edi + 4]
mov esi, eax
call dword [sym.imp.USER32.dll_GetParent]
push dword [edi + 4]
mov ecx, eax
movzx eax, si
push eax
push 0x111
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x440dbf
push 1
xor esi, esi
push esi
push esi
push dword [edi + 0x28]
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
seta bl
jbe 0x440dbf
or byte [edi + 0x58], 2
push 1
push esi
push dword [edi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44174b
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x57c074]
xor eax, esp
mov dword [esp + 0x114], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x130]
xor ebp, ebp
push 0x30
pop esi
push esi
mov ebx, ecx
push ebp
push ebx
call fcn.004dd970
push 0x110
lea eax, [esp + 0x24]
mov dword [esp + 0x20], 0x114
push ebp
push eax
call fcn.004dd970
add esp, 0x18
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4417aa
cmp dword [esp + 0x14], 6
jae 0x4417ad
push 0x2c
pop esi
mov eax, dword [esp + 0x134]
mov dword [ebx], esi
mov dword [ebx + 4], ebp
test eax, eax
jne 0x4417ce
push edi
call dword [sym.imp.USER32.dll_GetParent]
or dword [ebx + 4], 1
mov ecx, eax
mov eax, edi
jmp 0x4417d0
mov ecx, edi
mov esi, dword [esp + 0x138]
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], eax
test esi, esi
je 0x4417e8
lea edi, [ebx + 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [0x57e2d8]
mov ecx, dword [esp + 0x124]
pop edi
pop esi
mov dword [ebx + 0x20], eax
mov eax, dword [esp + 0x134]
mov dword [ebx + 0x28], ebp
pop ebp
mov dword [ebx + 0x24], eax
pop ebx
xor ecx, esp
call fcn.004d9b30
add esp, 0x118
ret 0x18
Function at 0x443023
Capabilities:
Parse credit card information

Disassembly:
push 0x28
mov eax, 0x50d00b
call fcn.004da767
mov ebx, ecx
mov edi, ebx
lea eax, [ebx - 0x154]
neg edi
sbb edi, edi
and edi, eax
cmp dword [ebx + 0x14], 0
jne 0x44304c
xor al, al
jmp 0x44316c
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
push 0xb0
push dword [edi + 0x14c]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x2c]
je 0x44307c
mov al, 1
jmp 0x44316c
mov al, byte [ebp + 8]
cbw
push eax
mov dword [ebp - 0x30], eax
call fcn.004e2ce2
pop ecx
test eax, eax
je 0x443075
movsx ecx, byte [ebp + 8]
movzx eax, word [ebx]
mov dword [ebp - 0x34], ecx
cmp eax, ecx
je 0x443045
call fcn.0040d439
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040d250
mov dword [ebp - 4], 1
lea eax, [ebp - 0x2c]
push eax
lea ecx, [edi + 4]
call fcn.00410dfd
mov esi, dword [ebp - 0x2c]
lea ecx, [ebp - 0x28]
push esi
call fcn.00404362
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebx + 0x14]
jae 0x443144
add ebx, 4
mov eax, ebx
cmp dword [ebx + 0x14], 8
jb 0x4430e3
mov eax, dword [ebx]
movzx eax, word [eax + ecx*2]
cmp eax, 0x3d
ja 0x443112
je 0x443150
sub eax, 0x23
je 0x4430fe
dec eax
sub eax, 1
je 0x4430fe
sub eax, 1
jmp 0x443124
push dword [ebp - 0x30]
call fcn.004e2ccf
pop ecx
test eax, eax
jne 0x443150
push 0x1056
jmp 0x44313c
cmp eax, 0x3f
jb 0x443126
cmp eax, 0x40
jbe 0x443150
cmp eax, 0x5e
je 0x443150
cmp eax, 0x60
je 0x443150
cmp dword [ebx + 0x14], 8
jb 0x44312e
mov ebx, dword [ebx]
movzx eax, word [ebx + ecx*2]
cmp dword [ebp - 0x34], eax
je 0x443150
push 0x1057
push ecx
mov ecx, edi
call fcn.0041c658
push 0x10
call dword [sym.imp.USER32.dll_MessageBeep]
xor ebx, ebx
jmp 0x443152
mov bl, 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.004056f5
or dword [ebp - 4], 0xffffffff
lea ecx, [esi - 0x10]
call fcn.0040d743
mov al, bl
call fcn.004da711
ret 4
Function at 0x452e7e
Capabilities:
Get disk information

Disassembly:
push 0x20
mov eax, 0x50fb66
call fcn.004da767
mov eax, ecx
mov dword [ebp - 0x2c], eax
call fcn.0041fd22
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov esi, eax
lea ecx, [ebp - 0x28]
push ebx
push esi
call fcn.0045361f
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x452f01
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
mov esi, dword [ebp - 0x2c]
mov edx, eax
cmovae ecx, dword [ebp - 0x28]
push esi
call fcn.00470b50
mov eax, dword [esi + 4]
sub eax, dword [esi]
pop ecx
push 0x18
cdq
pop ecx
idiv ecx
test eax, eax
setne bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004056f5
mov al, bl
call fcn.004da711
ret
Function at 0x458d1c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
sub esp, 0x404
lea ebp, [esp - 4]
mov eax, dword [0x57c074]
xor eax, ebp
mov dword [ebp + 0x404], eax
push 0x24
mov eax, 0x510dd2
call fcn.004da79e
mov edi, dword [ebp + 0x410]
mov eax, dword [ebp + 0x414]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x418]
mov dword [ebp - 0x14], eax
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], ebx
mov dword [ebp], ebx
mov byte [ebp - 4], 1
push 0x60
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
jne 0x458d9f
push 2
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
mov dword [ebp - 0x1c], eax
test esi, esi
jne 0x458d9f
call fcn.0040c31c
mov edi, eax
jmp 0x458e88
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x458dbc
call fcn.0040c31c
jmp 0x458e7b
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x458db2
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x18], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x458de9
mov edi, 0x8007000e
jmp 0x458e7d
push 2
pop ecx
mov byte [ebp - 4], cl
mul ecx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
cmp edx, ebx
ja 0x458ec6
jb 0x458e0a
cmp eax, 0xffffffff
ja 0x458ec6
cmp eax, 0x400
jbe 0x458e1c
push eax
lea ecx, [ebp]
call fcn.004514b8
jmp 0x458e22
lea eax, [ebp + 4]
mov dword [ebp], eax
mov dword [ebp - 4], 1
jmp 0x458e40
cmp dword [ebp], 0
je 0x458ddf
push edi
push dword [ebp]
push edi
push dword [ebp - 0x14]
push ebx
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x458db2
xor edx, edx
mov eax, dword [ebp]
mov word [eax + ecx*2], dx
push dword [ebp + 0x41c]
push dword [ebp]
lea ecx, [ebp - 0x24]
call fcn.00458bd0
mov edi, eax
test esi, esi
je 0x458e88
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [ebp - 4], bl
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x458e9b
lea ecx, [ebp]
call fcn.004514af
or dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x404]
xor ecx, ebp
call fcn.004d9b30
lea esp, [ebp + 0x408]
pop ebp
ret 0x10
push 0x80070216
call fcn.0040d968
int3
Function at 0x46e590
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x505bb0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x57c074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
cmp esi, edi
je 0x46e640
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.0046d200
mov dword [ebp - 4], 0
mov ecx, eax
call fcn.0046e710
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x46e620
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x46e616
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46e704
push edx
push ecx
call fcn.004d9b41
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
add esi, 0x18
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp esi, edi
jne 0x46e5c6
mov edi, dword [ebx + 4]
mov esi, dword [ebx]
push edi
push esi
call fcn.0046efc0
mov eax, dword [ebx]
mov dword [ebx + 4], eax
mov esi, dword [ebx + 0x10]
mov edi, dword [ebx + 0xc]
cmp esi, edi
je 0x46e6d0
lea eax, [ebp - 0x28]
lea ecx, [esi - 0x18]
push eax
call fcn.0046d200
mov dword [ebp - 4], 1
cmp dword [eax + 0x14], 8
jb 0x46e671
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x46e6b5
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x46e6ab
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46e704
push edx
push ecx
call fcn.004d9b41
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
add esi, 0xffffffe8
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp esi, edi
jne 0x46e656
push dword [ebx + 0x10]
push dword [ebx + 0xc]
call fcn.0046efc0
mov eax, dword [ebx + 0xc]
mov ecx, ebx
mov dword [ebx + 0x10], eax
call fcn.0046ea20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d9b30
mov esp, ebp
pop ebp
ret
call fcn.004dfbf5
int3
Function at 0x46e710
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x513841
mov eax, dword fs:[0]
push eax
sub esp, 0x474
mov eax, dword [0x57c074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esi + 0x14]
mov edx, esi
cmp edi, 8
jb 0x46e74c
mov edx, dword [esi]
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x46e763
mov eax, edx
cmp word [eax], 0x2a
je 0x46e78d
add eax, 2
sub ecx, 1
jne 0x46e755
cmp edi, 8
jb 0x46e76a
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d9b30
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x46e763
sub eax, edx
sar eax, 1
cmp eax, 0xffffffff
je 0x46e763
lea ecx, [ebp - 0x478]
call fcn.0046e8b0
mov dword [ebp - 4], 0
cmp dword [esi + 0x14], 8
jb 0x46e7b4
mov esi, dword [esi]
push esi
lea ecx, [ebp - 0x478]
call fcn.00482c40
test eax, eax
je 0x46e889
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp dword [ebp - 0x18], 0
je 0x46e812
mov eax, dword [ebp - 0x478]
shr eax, 4
and eax, 1
je 0x46e80e
cmp word [ebp - 0x44c], 0x2e
jne 0x46e80e
mov cx, word [ebp - 0x44a]
test cx, cx
je 0x46e867
cmp cx, 0x2e
jne 0x46e80e
cmp word [ebp - 0x448], 0
je 0x46e867
test eax, eax
jne 0x46e867
lea eax, [ebp - 0x47c]
push eax
lea ecx, [ebp - 0x478]
call fcn.00483090
mov byte [ebp - 4], 1
push dword [ebp - 0x47c]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 0
or eax, 0xffffffff
mov ecx, dword [ebp - 0x47c]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x46e867
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, 0x533850
jne 0x46e8a0
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call edi
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x46e889
cmp dword [ebp - 0x18], 0
je 0x46e889
lea ecx, [ebp - 0x478]
push ecx
push eax
call ebx
mov dword [ebp - 0x18], eax
test eax, eax
jne 0x46e7d4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x478]
call fcn.0046e960
jmp 0x46e771
mov ecx, edx
call esi
jmp 0x46e867

Function at 0x46f960
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi], 0
jne 0x46f98f
cmp dword [edi + 0x20], 8
lea ecx, [edi + 0xc]
jb 0x46f975
mov ecx, dword [ecx]
mov eax, dword [edi + 0x40]
sub esp, 8
or eax, 0xf003f
push eax
sub esp, 8
push ecx
push dword [edi + 0x3c]
mov ecx, edi
call fcn.00457cdf
mov esi, dword [esp + 0x14]
cmp dword [esi + 0x14], 8
jb 0x46f99b
mov esi, dword [esi]
mov ebx, dword [esp + 0x10]
cmp dword [ebx + 0x14], 8
jb 0x46f9a7
mov ebx, dword [ebx]
test esi, esi
jne 0x46f9bb
mov eax, 0xd
pop edi
test eax, eax
pop esi
sete al
pop ebx
ret 0xc
push esi
call fcn.004dfc45
add esp, 4
lea eax, [eax*2 + 2]
push eax
push esi
push 2
push 0
push ebx
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
test eax, eax
pop esi
sete al
pop ebx
ret 0xc
Function at 0x46fcb0
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, ecx
mov edx, dword [esi]
test edx, edx
jne 0x46fce0
cmp dword [esi + 0x20], 8
lea ecx, [esi + 0xc]
jb 0x46fcc4
mov ecx, dword [ecx]
mov eax, dword [esi + 0x40]
sub esp, 8
or eax, 0xf003f
push eax
sub esp, 8
push ecx
push dword [esi + 0x3c]
mov ecx, esi
call fcn.00457cdf
mov edx, dword [esi]
mov ecx, dword [esp + 8]
pop esi
cmp dword [ecx + 0x14], 8
jb 0x46fced
mov ecx, dword [ecx]
mov eax, dword [esp + 8]
push 4
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push 4
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete al
ret 8
Function at 0x475910
Capabilities:
Enumerate gui resources

Disassembly:
sub esp, 8
lea eax, [esp]
mov dword [esp], ecx
push eax
push 0x475940
mov dword [esp + 0xc], 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp + 4]
add esp, 8
ret

Function at 0x476c30
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
lea ebp, [esp - 0x2b8]
sub esp, 0x2b8
push 0xffffffffffffffff
push 0x51466f
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x57c074]
xor eax, ebp
mov dword [ebp + 0x2b4], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x57f558]
test eax, eax
jne 0x476d6e
push 0x10
call fcn.004d9b4f
mov esi, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 0
lea eax, [ebp]
push 0x2b4
push 0
push eax
call fcn.004dd970
mov edi, dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea eax, [ebp]
add esp, 0x10
push 0x4011
push 0x2b4
push eax
push 0x10
push 0x53f7a4
call edi
push 0x4011
push 0x2b4
mov dword [esi], eax
lea eax, [ebp]
push eax
push 0x10
push str.C:FAKE_DIR_
call edi
mov eax, dword [ebp + 4]
push 0x4013
push 0x2b4
mov dword [esi + 4], eax
lea eax, [ebp]
push eax
push 0x10
push str.C:FAKE_DIR_
call edi
mov eax, dword [ebp + 4]
mov dword [esi + 8], eax
lea eax, [ebp - 0x10]
push eax
push 0x11
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x476d3d
push 0x4009
push 0x2b4
lea eax, [ebp]
push eax
push 0
push dword [ebp - 0x10]
call edi
mov eax, dword [ebp + 4]
mov dword [esi + 0xc], eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jne 0x476d44
mov eax, dword [ebp - 0x14]
push dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
jmp 0x476d44
mov dword [esi + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x57f558]
mov dword [0x57f558], esi
test eax, eax
je 0x476d6c
push 0x10
push eax
call fcn.004d9b41
mov eax, dword [0x57f558]
add esp, 8
jmp 0x476d6e
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp + 0x2b4]
xor ecx, ebp
call fcn.004d9b30
lea esp, [ebp + 0x2b8]
pop ebp
ret
Function at 0x476d90
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5146b0
mov eax, dword fs:[0]
push eax
sub esp, 0x2b8
mov eax, dword [0x57c074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov edx, 1
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 8]
sub edx, dword [eax - 4]
sub ecx, 0x104
or ecx, edx
jge 0x476dec
push 0x104
lea ecx, [ebp + 8]
call fcn.0040d80a
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov eax, dword [ebp + 8]
push dword [eax - 8]
push eax
call fcn.004e2917
mov edx, eax
add esp, 8
test edx, edx
js 0x476eb5
mov ecx, dword [ebp + 8]
cmp edx, dword [ecx - 8]
jg 0x476eb5
mov dword [ecx - 0xc], edx
xor ecx, ecx
mov eax, dword [ebp + 8]
push 0x2b4
push ecx
mov word [eax + edx*2], cx
lea eax, [ebp - 0x2c4]
push eax
call fcn.004dd970
add esp, 0xc
lea eax, [ebp - 0x2c4]
push 0x4013
push 0x2b4
push eax
push 0x10
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov edi, dword [ebp - 0x2c0]
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x476e92
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov esi, dword [eax + 4]
cmp eax, 0x533850
jne 0x476eb1
mov eax, dword [ecx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d9b30
mov esp, ebp
pop ebp
ret 4
call esi
jmp 0x476e92
push 0x80070057
call fcn.0040d968
int3
Function at 0x479510
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x514bc8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x57c074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov esi, ecx
call fcn.0040d439
mov ecx, eax
test ecx, ecx
je 0x47965c
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, 0x533850
jne 0x479666
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 1
lea edx, [ebp - 0x10]
mov ecx, esi
call fcn.00479680
mov esi, dword [ebp - 0x10]
or ecx, 0xffffffff
test al, al
jne 0x479587
xor bl, bl
jmp 0x479603
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [ebx]
lea ecx, [esi - 0x10]
sub edi, 0x10
cmp ecx, edi
je 0x4795fe
cmp dword [edi + 0xc], 0
jl 0x4795f3
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x4795f3
call fcn.00407162
mov dword [ebp - 0x14], eax
lea edx, [edi + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4795e9
mov edx, dword [edi]
push edi
mov ecx, dword [edx]
mov eax, dword [ecx + 4]
cmp ecx, 0x533850
jne 0x47966d
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0x14]
add eax, 0x10
mov dword [ebx], eax
jmp 0x4795fe
mov eax, dword [ebp - 0x14]
add eax, 0x10
mov dword [ebx], eax
jmp 0x4795fe
push dword [esi - 0xc]
mov ecx, ebx
push esi
call fcn.0040d9ac
mov bl, 1
or ecx, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x479648
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, 0x533850
jne 0x479676
mov eax, dword [ecx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.0040d968
call edx
jmp 0x479562
mov ecx, edx
call eax
jmp 0x4795e9
call edx
jmp 0x479648