joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45d338
Capabilities:
Delete registry key

Disassembly:
mov eax, 0x4b3d80
call fcn.00483228
sub esp, 0x10
push ebx
push esi
push ecx
lea eax, [ebp + 0xc]
xor ebx, ebx
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
call fcn.0049d64d
lea eax, [ebp - 0x18]
push eax
call fcn.00447289
add esp, 4
lea eax, [ebp + 0xc]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
mov byte [ebp - 4], 1
call fcn.0049d64d
lea eax, [ebp - 0x14]
push eax
call fcn.00447c52
pop ecx
pop ecx
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x18]
push eax
push 0xf003f
push ebx
push ebx
mov byte [ebp - 4], 2
call fcn.0049dcbc
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call fcn.0049dd0b
push ebx
lea ecx, [ebp - 0x14]
call fcn.0049dcbc
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
push 0xffffffffffffffff
neg esi
sbb esi, esi
lea ecx, [ebp - 0x14]
inc esi
call fcn.0049dd0b
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.0049d8d8
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], bl
call fcn.0049d8d8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0049d8d8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x45dbaa
Capabilities:
Delete registry value

Disassembly:
mov eax, 0x4b3e64
call fcn.00483228
push ecx
push ecx
push ebx
push esi
lea eax, [ebp - 0x10]
xor esi, esi
push eax
push 0xf003f
push esi
push esi
push ecx
lea eax, [ebp + 0xc]
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
call fcn.0049d64d
lea eax, [ebp - 0x14]
push eax
call fcn.00447289
pop ecx
pop ecx
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.0049dcbc
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.0049d8d8
push esi
push ecx
lea eax, [ebp + 0xc]
mov ecx, esp
mov dword [ebp + 8], esp
push eax
call fcn.0049d64d
lea eax, [ebp + 8]
push eax
call fcn.00447c52
pop ecx
pop ecx
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.0049dcbc
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ebx, eax
lea ecx, [ebp + 8]
neg ebx
sbb bl, bl
and byte [ebp - 4], 0
inc bl
call fcn.0049d8d8
test bl, bl
je 0x45dc51
push 1
pop esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0049d8d8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x45dc76
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov eax, 0x4b3e98
call fcn.00483228
sub esp, 0x110
push ebx
push esi
lea eax, [ebp - 0x10]
xor esi, esi
push eax
push 0xf003f
push esi
push esi
push ecx
lea eax, [ebp + 0xc]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
call fcn.0049d64d
lea eax, [ebp - 0x14]
push eax
call fcn.00447289
pop ecx
pop ecx
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.0049dcbc
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.0049d8d8
push esi
push ecx
lea eax, [ebp + 0xc]
mov ecx, esp
mov dword [ebp + 8], esp
push eax
call fcn.0049d64d
lea eax, [ebp + 8]
push eax
call fcn.00447c52
pop ecx
pop ecx
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.0049dcbc
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ebx, eax
lea ecx, [ebp + 8]
neg ebx
sbb bl, bl
and byte [ebp - 4], 0
inc bl
call fcn.0049d8d8
test bl, bl
je 0x45dd23
push 1
pop esi
jmp 0x45dda2
mov eax, dword [0x4e43a4]
mov dword [ebp + 8], 0xff
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 8]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
push esi
push ecx
lea eax, [ebp + 0xc]
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
call fcn.0049d64d
lea eax, [ebp - 0x18]
push eax
call fcn.00447c52
pop ecx
pop ecx
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.0049dcbc
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
lea ecx, [ebp - 0x18]
neg ebx
sbb bl, bl
mov byte [ebp - 4], 3
inc bl
call fcn.0049d8d8
xor eax, eax
lea ecx, [ebp - 0x1c]
test bl, bl
sete al
and byte [ebp - 4], 0
mov esi, eax
call fcn.0049d8d8
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0049d8d8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x45de6d
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x45dec9
lea eax, [ebp - 0x10]
xor esi, esi
push eax
push str.SeShutdownPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push 1
mov edi, dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
pop ebx
lea eax, [ebp - 0x14]
push esi
push esi
push esi
push eax
push esi
mov dword [ebp - 0x14], ebx
push dword [ebp - 4]
mov dword [ebp - 8], 2
call edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x45decd
xor eax, eax
jmp 0x45def0
push ebx
push esi
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownA]
mov ebx, eax
cmp ebx, esi
jne 0x45deee
push esi
push esi
lea eax, [ebp - 0x14]
push esi
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 8], esi
call edi
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x45def5
Capabilities:
Shutdown system

Disassembly:
push esi
mov ecx, 0x4e83f8
call fcn.00462b45
cmp eax, 2
jne 0x45df0c
call fcn.0045de6d
pop esi
ret
mov esi, dword [sym.imp.USER32.dll_ExitWindowsEx]
push 0
push 2
call esi
test eax, eax
jne 0x45df27
cmp dword [esp + 8], eax
je 0x45df27
push eax
push 6
call esi
pop esi
ret
Function at 0x45dfe1
Capabilities:
Get system information on windows

Disassembly:
mov eax, 0x4b3f00
call fcn.00483228
sub esp, 0x30
push ebx
push esi
push edi
push 1
xor ebx, ebx
pop edi
mov esi, 0x4e0988
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], edi
call fcn.0049d946
push ecx
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
mov byte [ebp - 4], 1
call fcn.0049d64d
mov byte [ebp - 4], bl
call fcn.0044c9c8
add esp, 0xc
cmp eax, ebx
je 0x45e038
mov dword [ebp - 0x10], edi
jmp 0x45e162
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x4e0984
call fcn.0049d946
push ecx
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
mov byte [ebp - 4], 2
call fcn.0049d64d
mov byte [ebp - 4], bl
call fcn.0044c9c8
add esp, 0xc
cmp eax, ebx
je 0x45e077
mov dword [ebp - 0x10], 2
jmp 0x45e162
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x4e0980
call fcn.0049d946
push ecx
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
mov byte [ebp - 4], 3
call fcn.0049d64d
mov byte [ebp - 4], bl
call fcn.0044c9c8
add esp, 0xc
cmp eax, ebx
jne 0x45e15b
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.Pentium
call fcn.0049d946
push ecx
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
mov byte [ebp - 4], 4
call fcn.0049d64d
mov byte [ebp - 4], bl
call fcn.0044c9c8
add esp, 0xc
cmp eax, ebx
jne 0x45e15b
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.Alpha
call fcn.0049d946
push ecx
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
mov byte [ebp - 4], 5
call fcn.0049d64d
mov byte [ebp - 4], bl
call fcn.0044c9c8
add esp, 0xc
cmp eax, ebx
je 0x45e11d
mov dword [ebp - 0x10], 4
jmp 0x45e162
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.Risc
call fcn.0049d946
push ecx
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
mov byte [ebp - 4], 6
call fcn.0049d64d
mov byte [ebp - 4], bl
call fcn.0044c9c8
add esp, 0xc
neg eax
sbb eax, eax
and eax, 2
add eax, 3
mov dword [ebp - 0x10], eax
jmp 0x45e162
mov dword [ebp - 0x10], 3
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x24]
sub eax, 0x182
je 0x45e1c0
sub eax, 0x64
je 0x45e1b6
sub eax, 0x64
je 0x45e1ac
sub eax, 0xd56
je 0x45e1a2
sub eax, 0x42a8
je 0x45e198
push 6
pop edi
push str.UNKNOWN
jmp 0x45e1c1
push 5
pop edi
push str.Alpha
jmp 0x45e1c1
push 4
pop edi
push str.Risc
jmp 0x45e1c1
push 3
pop edi
push 0x4e0980
jmp 0x45e1c1
push 2
pop edi
push 0x4e0984
jmp 0x45e1c1
push esi
mov ecx, dword [ebp + 0xc]
call fcn.0049da15
cmp edi, dword [ebp - 0x10]
jge 0x45e1d1
mov dword [ebp - 0x14], ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0049d8d8
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x45e1ef
Capabilities:
Get memory capacity

Disassembly:
mov eax, 0x4b3f14
call fcn.00483228
sub esp, 0x28
push esi
push edi
push 1
lea eax, [ebp - 0x34]
pop edi
mov dword [ebp - 0x34], 0x20
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x2c]
and dword [ebp - 0x10], 0
mov dword [ebp - 0x14], eax
push ecx
fild qword [ebp - 0x14]
push ecx
lea eax, [ebp - 0x10]
fstp qword [esp]
push eax
call fcn.00447039
add esp, 0xc
mov esi, dword [ebp + 0xc]
and dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.0049d9c5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0049d8d8
push dword [esi]
call fcn.00483b98
cmp eax, dword [ebp + 8]
pop ecx
jge 0x45e25a
xor edi, edi
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x45e54c
Capabilities:
Persist via run registry key

Disassembly:
mov eax, 0x4b3fb0
call fcn.00483228
sub esp, 0xc
lea eax, [ebp + 8]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 0x10]
push str.Softwaremicrosoftwindowscurrentversion_runonce_
push eax
call fcn.0049db95
push ecx
lea eax, [ebp + 0xc]
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
mov byte [ebp - 4], 2
call fcn.0049d64d
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
mov byte [ebp - 4], 3
call fcn.0049d64d
push 0x80000002
mov byte [ebp - 4], 2
call fcn.0045cf2b
add esp, 0xc
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.0049d8d8
and byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.0049d8d8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0049d8d8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret

Function at 0x45e5d9
Capabilities:
Persist via run registry key

Disassembly:
mov eax, 0x4b3fdc
call fcn.00483228
sub esp, 0xc
lea eax, [ebp + 8]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 0x10]
push str.Softwaremicrosoftwindowscurrentversion_run_
push eax
call fcn.0049db95
push ecx
lea eax, [ebp + 0xc]
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
mov byte [ebp - 4], 2
call fcn.0049d64d
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
mov byte [ebp - 4], 3
call fcn.0049d64d
push 0x80000002
mov byte [ebp - 4], 2
call fcn.0045cf2b
add esp, 0xc
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.0049d8d8
and byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.0049d8d8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0049d8d8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x45ee81
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x4b430b
call fcn.00483228
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.WSetupUser.0
lea ecx, [esi + 0x58]
mov dword [ebp - 4], 0x14
call fcn.0049d8d8
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 0x13
call fcn.0049d8d8
lea ecx, [esi + 0x50]
mov byte [ebp - 4], 0x12
call fcn.0049d8d8
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 0x11
call fcn.0049d8d8
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 0x10
call fcn.0049d8d8
lea ecx, [esi + 0x44]
mov byte [ebp - 4], 0xf
call fcn.0049d8d8
lea ecx, [esi + 0x40]
mov byte [ebp - 4], 0xe
call fcn.0049d8d8
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 0xd
call fcn.0049d8d8
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 0xc
call fcn.0049d8d8
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 0xb
call fcn.0049d8d8
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 0xa
call fcn.0049d8d8
lea ecx, [esi + 0x2c]
mov byte [ebp - 4], 9
call fcn.0049d8d8
lea ecx, [esi + 0x28]
mov byte [ebp - 4], 8
call fcn.0049d8d8
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 7
call fcn.0049d8d8
lea ecx, [esi + 0x20]
mov byte [ebp - 4], 6
call fcn.0049d8d8
lea ecx, [esi + 0x1c]
mov byte [ebp - 4], 5
call fcn.0049d8d8
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 4
call fcn.0049d8d8
lea ecx, [esi + 0x14]
mov byte [ebp - 4], 3
call fcn.0049d8d8
mov byte [ebp - 4], 2
lea ecx, [esi + 0x10]
call fcn.0049d8d8
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 1
call fcn.0049d8d8
and byte [ebp - 4], 0
lea ecx, [esi + 8]
call fcn.0049d8d8
or dword [ebp - 4], 0xffffffff
lea ecx, [esi + 4]
call fcn.0049d8d8
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x460ade
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4b48ee
call fcn.00483228
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
xor edi, edi
lea ecx, [esi + 4]
mov dword [ebp - 4], edi
call fcn.0049835d
mov dword [esi + 0x2c], edi
mov eax, dword [0x4e43a4]
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], 2
mov eax, dword [0x4e43a4]
mov dword [esi + 0x48], eax
mov eax, dword [0x4e43a4]
mov dword [esi + 0x50], eax
mov ebx, 0x4e7e70
lea ecx, [esi + 0x54]
push ebx
mov byte [ebp - 4], 4
call fcn.0049d946
mov eax, dword [0x4e43a4]
mov dword [esi + 0x60], eax
mov eax, dword [0x4e43a4]
mov dword [esi + 0x70], eax
mov eax, dword [0x4e43a4]
mov dword [esi + 0x74], eax
mov eax, dword [0x4e43a4]
mov dword [esi + 0x78], eax
mov eax, dword [0x4e43a4]
mov dword [esi + 0x7c], eax
push ebx
lea ecx, [esi + 0x80]
mov byte [ebp - 4], 0xa
call fcn.0049d946
push ebx
lea ecx, [esi + 0x84]
mov byte [ebp - 4], 0xb
call fcn.0049d946
mov eax, dword [0x4e43a4]
mov dword [esi + 0x8c], eax
mov dword [esi + 0x94], edi
mov dword [esi + 0x98], edi
mov eax, dword [0x4e43a4]
mov dword [esi + 0x9c], eax
mov dword [esi + 0xa0], edi
mov eax, dword [0x4e43a4]
mov dword [esi + 0xa4], eax
mov eax, dword [0x4e43a4]
mov dword [esi + 0xac], eax
mov eax, dword [0x4e43a4]
mov dword [esi + 0xb0], eax
push fcn.0040ff57
push 0x45734b
push 0x11
lea eax, [esi + 0xcc]
push 0x14
push eax
mov byte [ebp - 4], 0x11
mov dword [esi + 0xc0], edi
mov dword [esi + 0xc4], edi
call fcn.00484931
lea eax, [esi + 0x220]
mov ecx, vtable.CArray_class_WSetupComponent___class_WSetupComponent__.0
mov dword [eax], ecx
mov dword [eax + 4], edi
mov dword [eax + 0x10], edi
mov dword [eax + 0xc], edi
mov dword [eax + 8], edi
lea eax, [esi + 0x234]
mov dword [eax], ecx
mov dword [eax + 4], edi
mov dword [eax + 0x10], edi
mov dword [eax + 0xc], edi
mov dword [eax + 8], edi
lea ebx, [esi + 0x248]
mov dword [ebx], ecx
mov dword [ebx + 4], edi
mov dword [ebx + 0x10], edi
mov dword [ebx + 0xc], edi
mov dword [ebx + 8], edi
push 0xffffffffffffffff
push edi
lea ecx, [esi + 4]
mov byte [ebp - 4], 0x15
mov dword [esi], vtable.WSetupComponent.0
call fcn.004983f0
push 0xffffffffffffffff
push edi
mov ecx, ebx
call fcn.004035ee
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4631ed
Capabilities:
Set file attributes

Disassembly:
mov eax, dword [esp + 8]
mov edx, 0x80
mov eax, dword [eax]
cmp dword [eax - 8], 5
jle 0x46322c
mov cl, 0x31
cmp byte [eax], cl
je 0x46322c
cmp byte [eax + 1], cl
jne 0x46320c
add edx, 0x20
cmp byte [eax + 2], cl
jne 0x463214
or edx, 2
cmp byte [eax + 3], cl
jne 0x46321c
or edx, 1
cmp byte [eax + 4], cl
jne 0x463224
or edx, 4
cmp byte [eax + 5], cl
jne 0x46322c
or dh, 1
mov eax, dword [esp + 4]
push edx
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret
Function at 0x4635a4
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov eax, dword [eax]
mov bl, 0x31
or edi, 0xffffffff
xor esi, esi
mov cl, byte [eax]
cmp cl, bl
jne 0x4635ee
cmp dword [ebp + 0x10], esi
jne 0x4635e1
mov dl, 0x30
cmp byte [eax + 1], dl
jne 0x4635e1
cmp byte [eax + 2], dl
jne 0x4635e1
cmp byte [eax + 3], dl
jne 0x4635e1
cmp byte [eax + 4], dl
jne 0x4635e1
cmp byte [eax + 5], dl
jne 0x4635e1
mov esi, 0x80
cmp cl, bl
jne 0x4635ee
cmp dword [ebp + 0x10], 0
je 0x4635ee
or esi, 0x10
cmp byte [eax + 1], bl
jne 0x4635f6
or esi, 0x20
cmp byte [eax + 2], bl
jne 0x4635fe
or esi, 2
cmp byte [eax + 3], bl
jne 0x463606
or esi, 1
cmp byte [eax + 4], bl
jne 0x46360e
or esi, 4
cmp byte [eax + 5], bl
jne 0x463619
or esi, 0x100
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, esi
jne 0x46362c
push 1
jmp 0x46363b
cmp dword [ebp + 0x10], 0
jne 0x46363c
or esi, 0x10
cmp eax, esi
jne 0x46363c
push 0xfffffffffffffffe
pop edi
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x464fd5
Capabilities:
Identify system language via api

Disassembly:
mov eax, 0x4b52c1
call fcn.00483228
push ecx
mov eax, dword [0x4e43a4]
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
lea ebx, [esi + 8]
mov dword [ebx], eax
mov eax, dword [0x4e43a4]
and dword [ebp - 4], 0
mov dword [esi + 0xc], eax
mov eax, dword [0x4e43a4]
mov dword [esi + 0x10], eax
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov ecx, eax
mov edi, 0x4e7e70
and cx, 0x3ff
push edi
mov word [esi + 4], cx
mov ecx, ebx
shr ax, 0xa
mov word [esi + 6], ax
call fcn.0049da15
push edi
lea ecx, [esi + 0x10]
call fcn.0049da15
push edi
lea ecx, [esi + 0xc]
call fcn.0049da15
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4671e4
Capabilities:
Get disk information

Disassembly:
mov eax, 0x4b5595
call fcn.00483228
sub esp, 0x118
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x24], esi
and dword [ebp - 4], 0
mov eax, dword [0x4e43a4]
lea edi, [esi + 4]
mov dword [edi], eax
mov eax, dword [0x4e43a4]
mov dword [esi + 8], eax
mov eax, dword [0x4e43a4]
mov dword [esi + 0x10], eax
and dword [esi + 0x14], 0
push ecx
mov ebx, esp
mov dword [ebp - 0x18], esp
push ecx
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
mov byte [ebp - 4], 4
mov dword [esi], vtable.CSelectibleDrive.0
call fcn.0049d64d
push ebx
call fcn.0044cdd9
pop ecx
lea eax, [ebp - 0x10]
pop ecx
push eax
call fcn.00447404
pop ecx
pop ecx
push eax
mov ecx, edi
mov byte [ebp - 4], 5
call fcn.0049d9c5
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.0049d8d8
push ecx
lea eax, [ebp + 8]
mov edi, esp
mov dword [ebp - 0x14], esp
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call fcn.0049d64d
push edi
call fcn.00447404
pop ecx
pop ecx
call fcn.00447325
push ecx
lea eax, [ebp - 0x10]
fstp qword [esp]
push eax
call fcn.00446f15
add esp, 0xc
push eax
lea ecx, [esi + 0x10]
mov byte [ebp - 4], 6
call fcn.0049d9c5
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.0049d8d8
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [esi + 0xc], eax
mov eax, dword [0x4e43a4]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x5c]
push 0x32
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x124]
push 0xc8
push eax
push dword [ebp + 8]
mov byte [ebp - 4], 7
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x46734a
lea eax, [ebp - 0x124]
lea ecx, [ebp - 0x10]
push eax
call fcn.0049d946
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
mov byte [ebp - 4], 8
call fcn.0049d64d
lea eax, [ebp - 0x14]
push eax
call fcn.0044cdd9
pop ecx
pop ecx
push eax
lea ecx, [esi + 8]
mov byte [ebp - 4], 9
call fcn.0049d9c5
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 8
call fcn.0049d8d8
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 7
call fcn.0049d8d8
jmp 0x467357
push 0x4e7e70
lea ecx, [esi + 8]
call fcn.0049da15
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 4
call fcn.0049d8d8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0049d8d8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
Function at 0x4673e9
Capabilities:
Get file version info

Disassembly:
mov eax, 0x4b55d0
call fcn.00483228
sub esp, 0x10
push ebx
push esi
push edi
xor esi, esi
lea ecx, [ebp + 8]
fldz
push esi
push esi
fstp qword [ebp - 0x1c]
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
call fcn.0049dcbc
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
cmp edi, esi
jbe 0x4674b0
lea eax, [edi + 1]
push eax
call fcn.0049de4d
mov ebx, eax
pop ecx
cmp ebx, esi
je 0x4674b0
push ebx
push edi
push esi
push esi
lea ecx, [ebp + 8]
call fcn.0049dcbc
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4674a9
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x4dd1e4
push ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4674a9
cmp dword [ebp - 0x10], esi
je 0x4674a9
mov edi, dword [ebp - 0x14]
cmp edi, esi
je 0x4674a9
fld qword [0x4be380]
push ecx
push ecx
fstp qword [esp]
fld qword [0x4be378]
push ecx
push ecx
fstp qword [esp]
call fcn.00485b49
mov eax, dword [edi + 8]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], eax
mov eax, dword [edi + 0xc]
fild qword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], esi
add esp, 0x10
fmulp st(1)
fild qword [ebp - 0x1c]
faddp st(1)
fstp qword [ebp - 0x1c]
push ebx
call fcn.0049de76
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0049d8d8
mov ecx, dword [ebp - 0xc]
pop edi
fld qword [ebp - 0x1c]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4674ce
Capabilities:
Get file version info

Disassembly:
mov eax, 0x4b5603
call fcn.00483228
sub esp, 0x114
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0x1c], ebx
push 0x4e7e70
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 1
mov dword [ebp - 0x14], ebx
call fcn.0049d946
push ebx
push ebx
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 2
mov dword [ebp - 0x10], ebx
call fcn.0049dcbc
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebx
jbe 0x4675b4
lea eax, [esi + 1]
push eax
call fcn.0049de4d
mov edi, eax
pop ecx
cmp edi, ebx
je 0x4675b4
push edi
push esi
push ebx
push ebx
lea ecx, [ebp + 0xc]
call fcn.0049dcbc
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4675ad
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4675ad
cmp dword [ebp - 0x10], ebx
je 0x4675ad
mov eax, dword [ebp - 0x14]
movzx ecx, word [eax + 2]
movzx eax, word [eax]
push ecx
push eax
lea eax, [ebp - 0x120]
push str.StringFileInfo_04x_04xFileVersion
push eax
call fcn.00485d4d
add esp, 0x10
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x120]
push eax
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4675ad
cmp dword [ebp - 0x10], ebx
je 0x4675ad
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
call fcn.0049da15
push edi
call fcn.0049de76
pop ecx
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
call fcn.0049d64d
mov dword [ebp - 0x1c], 1
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.0049d8d8
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], bl
call fcn.0049d8d8
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret