joyce8/EMBER2024-capa huggingface dataset:
Function at 0x449d1c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x449e4f
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x16], 0
lea eax, [ebp - 0x16]
push eax
call sub.user32.dll_GetKeyboardLayoutNameA
mov dl, 1
mov eax, dword [0x425f8c]
call fcn.0042608c
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x449e25
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.00426168
lea eax, [ebp - 0x20]
lea edx, [ebp - 0x16]
mov ecx, 0xa
call fcn.004053d0
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 0x449e64
call fcn.00405478
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.004262f4
lea ecx, [ebp - 4]
mov edx, 0x449ea0
mov eax, dword [ebp - 0xc]
call fcn.0042677c
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.004109a4
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x449e08
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x449eac
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov ebx, eax
call ebx
movzx eax, word [eax + 0x28]
and ax, 1
cmp ax, 1
sete byte [0x4945f8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x449e0f
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret

Function at 0x449efc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x449f43
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x449f26
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x449f37
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x449f43
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x44ebe8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x49ac7c], 0
je 0x44ed31
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x4955dc]
mov edx, dword [edx]
xor al, byte [edx + 0xbc]
je 0x44ed31
mov eax, dword [0x49ac80]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x49ac7c]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x44ed00
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x49ac7c]
call fcn.0041ba14
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x44ecf8
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1da], 0
je 0x44ecf8
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x44ecf8
mov eax, dword [ebp - 0x14]
call fcn.004594cc
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x44ecf8
push ebp
call fcn.0044eba4
pop ecx
test al, al
jne 0x44ecf8
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call fcn.0040444c
test al, al
je 0x44ecf8
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbc
call fcn.0040444c
cmp byte [ebp - 1], 0
je 0x44ecf8
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x44ecf8
mov edx, dword [ebp - 0x14]
mov eax, dword [0x49ac80]
call fcn.0044e314
inc edi
dec ebx
jne 0x44ec4d
mov eax, dword [0x49ac80]
cmp dword [eax + 8], 0
jle 0x44ed18
mov eax, dword [0x49ac80]
call fcn.0044e3cc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x44ed31
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0044ea08
pop ecx
test al, al
jne 0x44ed31
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4563a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.0040760c
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.00450f70
test ebx, ebx
jne 0x4563f3
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.004562dc
mov ebx, eax
test ebx, ebx
je 0x4564de
cmp esi, ebx
je 0x45641c
mov eax, dword [esp]
sub eax, dword [ebx + 0x40]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x44]
mov dword [esp + 0x118], eax
jmp 0x456431
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x456469
add eax, 0xffffff5f
sub eax, 2
jb 0x456481
dec eax
sub eax, 2
jb 0x456495
dec eax
sub eax, 2
jb 0x45648b
jmp 0x45649f
add eax, 0xfffffdff
sub eax, 2
jb 0x456481
dec eax
sub eax, 2
jb 0x456495
dec eax
sub eax, 2
jb 0x45648b
jmp 0x45649f
mov byte [esp + 0x120], 0
jmp 0x4564a7
mov byte [esp + 0x120], 2
jmp 0x4564a7
mov byte [esp + 0x120], 1
jmp 0x4564a7
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.004370bc
mov byte [esp + 0x121], al
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.0045270c
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x4564e0
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret
Function at 0x45e800
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x49584c]
cmp byte [eax + 0xc], 0
je 0x45e96d
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45e966
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x49ac8c], 0
jne 0x45e854
push 0x45e974
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x45e97c
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49ac8c], eax
cmp dword [0x494740], 0
jne 0x45e94f
push 0x45e98c
call sub.kernel32.dll_LoadLibraryA
mov dword [0x494740], eax
cmp dword [0x494740], 0
je 0x45e94f
push 0x45e998
mov eax, dword [0x494740]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49ac90], eax
push 0x45e9a8
mov eax, dword [0x494740]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49ac94], eax
push 0x45e9bc
mov eax, dword [0x494740]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49ac98], eax
push 0x45e9d4
mov eax, dword [0x494740]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49ac9c], eax
push 0x45e9ec
mov eax, dword [0x494740]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49aca0], eax
push 0x45ea00
mov eax, dword [0x494740]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49aca4], eax
push 0x45ea18
mov eax, dword [0x494740]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49aca8], eax
push 0x45ea30
mov eax, dword [0x494740]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49acac], eax
push 0x45ea4c
mov eax, dword [0x494740]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49acb0], eax
push 0x45ea58
mov eax, dword [0x494740]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49acb4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45e96d
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret
Function at 0x465270
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.004055e0
xor eax, eax
push ebp
push 0x4653a5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x465378
xor edx, edx
push ebp
push 0x465371
push dword fs:[edx]
mov dword fs:[edx], esp
mov ebx, dword [ebp - 4]
mov eax, ebx
test eax, eax
je 0x4652bd
sub eax, 4
mov eax, dword [eax]
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x465346
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov esi, eax
xor eax, eax
push ebp
push 0x465335
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x4652fc
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [ebp - 4]
call fcn.004055f0
lea ecx, [ebx + 1]
mov edx, esi
call fcn.004030f4
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46533c
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x4951e8]
mov dl, 1
mov eax, dword [0x408878]
call fcn.0040ead8
call fcn.00404ac4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4653ac
lea eax, [ebp - 4]
call fcn.00405150
ret
Function at 0x4653b4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46556f
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.004058e4
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
mov ecx, 0x465588
call fcn.00405478
mov eax, ebx
call fcn.00423414
mov edi, eax
dec edi
test edi, edi
jl 0x46546c
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.004233e8
mov edx, dword [0x4632c8]
call fcn.004043dc
test al, al
je 0x465468
push dword [ebp - 8]
mov edx, esi
mov eax, ebx
call fcn.004233e8
lea edx, [ebp - 0x14]
call fcn.00451428
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.004058e4
push dword [ebp - 0x18]
lea eax, [ebp - 8]
mov edx, 3
call fcn.004054f4
inc esi
dec edi
jne 0x46541a
movzx eax, byte [0x46558c]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x465598
mov eax, dword [ebp - 8]
call fcn.0040fe80
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 8]
call fcn.004051e8
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.00451428
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x465588
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x360]
call fcn.00451428
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x465588
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x465588
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x4655a4
call fcn.0040b600
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x465576
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.00405174
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00405174
lea eax, [ebp - 0x14]
call fcn.00405150
lea eax, [ebp - 0x10]
call fcn.00405150
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405174
ret
Function at 0x4670bc
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004055e0
xor eax, eax
push ebp
push 0x46713a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004055f0
mov dword [ebp - 8], eax
cmp dword [ebx + 8], 0
jne 0x467105
mov eax, dword [ebx + 4]
call fcn.004055f0
push eax
push 0
call sub.advapi32.dll_RegisterEventSourceA
mov dword [ebx + 8], eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push 1
push 0
mov eax, dword [ebp + 8]
push eax
movzx eax, word [ebp + 0xc]
push eax
push esi
mov eax, dword [ebx + 8]
push eax
call sub.advapi32.dll_ReportEventA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467141
lea eax, [ebp - 4]
call fcn.00405150
ret

Function at 0x4681dc
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x468381
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
xor eax, eax
call fcn.00403350
cmp word [ebx + 0xa2], 0
je 0x468225
mov edx, ebx
mov eax, dword [ebx + 0xa4]
call dword [ebx + 0xa0]
mov eax, dword [ebx + 0x90]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x468239
lea esi, [ebp - 0xc]
jmp 0x46823b
xor esi, esi
cmp dword [ebx + 0x80], 0
jne 0x468248
xor edi, edi
jmp 0x468255
mov eax, dword [ebx + 0x80]
call fcn.004055f0
mov edi, eax
mov eax, dword [ebx + 0x7c]
call fcn.004055f0
push eax
push edi
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.0046788c
mov eax, dword [ebp - 0x14]
call fcn.004055f0
push eax
push esi
mov eax, dword [ebx + 0x74]
call fcn.004055f0
push eax
mov eax, dword [ebp - 4]
call fcn.004055f0
push eax
mov eax, ebx
call fcn.004679cc
push eax
mov eax, ebx
call fcn.004679a0
push eax
mov eax, ebx
call fcn.00467958
push eax
push 0xf01ff
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.00467758
mov eax, dword [ebp - 0x18]
call fcn.004055f0
push eax
mov eax, dword [ebx + 8]
call fcn.004055f0
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CreateServiceA
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x90], eax
cmp dword [ebp - 0x10], 0
jne 0x4682de
call fcn.00410348
xor edx, edx
push ebp
push 0x468357
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x46831c
push dword fs:[edx]
mov dword fs:[edx], esp
cmp word [ebx + 0xaa], 0
je 0x468312
mov edx, ebx
mov eax, dword [ebx + 0xac]
call dword [ebx + 0xa8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x468340
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46835e
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
Function at 0x468390
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp word [eax + 0xb2], 0
je 0x4683bc
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0xb4]
call dword [esi + 0xb0]
push 0xf01ff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.004055f0
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4683e1
call fcn.00410348
xor eax, eax
push ebp
push 0x468418
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_DeleteService
test eax, eax
jne 0x468401
call fcn.00410348
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46841f
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret

Function at 0x46bcb0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x46bd0a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x49521c]
cmp byte [eax], 0
je 0x46bcda
push ebx
call sub.kernel32.dll_GetFileAttributesW
mov ebx, eax
jmp 0x46bcf4
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00405388
mov eax, dword [ebp - 4]
call fcn.004055f0
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46bd11
lea eax, [ebp - 4]
call fcn.00405150
ret

Function at 0x46c798
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov esi, edx
lea edi, [esp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x46c7f4
push esp
push 0x40
push 6
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x46c7c3
call fcn.00410348
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
mov ecx, 6
call fcn.004030f4
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
push 6
mov eax, dword [esp + 0x14]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x46c7f4
call fcn.00410348
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x46e7b4
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00405ddc
xor eax, eax
push ebp
push 0x46e8b7
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.00405c78
jne 0x46e807
mov ecx, 0x46e8d0
mov dl, 1
mov eax, dword [0x4089ec]
call fcn.0040ea1c
mov edx, eax
mov dword [edx + 0xc], 3
mov eax, edx
call fcn.00404ac4
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0046b14c
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.004059cc
mov eax, dword [ebp - 4]
call fcn.00405b44
call fcn.0043250c
cmp eax, 3
jb 0x46e89c
mov eax, dword [ebp - 4]
call fcn.0046b3e4
test al, al
jne 0x46e89c
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0046b27c
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00405c78
je 0x46e89c
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0046b1f4
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.00405c78
je 0x46e89c
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.0046b1f4
mov eax, dword [ebp - 0x14]
call fcn.0046e7b4
test al, al
je 0x46e896
push 0
mov eax, dword [ebp - 4]
call fcn.00405b44
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x46e89a
xor ebx, ebx
jmp 0x46e89c
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46e8be
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00405980
ret
Function at 0x46ed18
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd68
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x298], edx
mov dword [ebp - 0x294], edx
mov dword [ebp - 0x290], edx
mov dword [ebp - 0x28c], edx
mov dword [ebp - 0x288], edx
mov dword [ebp - 0x284], edx
mov dword [ebp - 0x280], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00405ddc
lea eax, [ebp - 0x278]
mov edx, dword [0x46b128]
call fcn.00405dfc
xor eax, eax
push ebp
push 0x46ef97
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
lea edx, [ebp - 0x280]
mov eax, dword [ebp - 4]
call fcn.0046b14c
mov edx, dword [ebp - 0x280]
lea eax, [ebp - 4]
call fcn.004059cc
mov dl, 1
mov eax, dword [0x46ccbc]
call fcn.0046d2e4
mov dword [ebp - 0x27c], eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x27c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x46ef42
lea ecx, [ebp - 0x284]
mov edx, esi
mov eax, dword [ebp - 0x27c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x284]
lea eax, [ebp - 4]
mov ecx, 0x46efa8
call fcn.00405bc0
lea eax, [ebp - 0x288]
mov ecx, 0x46efb0
mov edx, dword [ebp - 4]
call fcn.00405bc0
mov eax, dword [ebp - 0x288]
lea ecx, [ebp - 0x278]
mov edx, 0x3f
call fcn.0046b4a8
test eax, eax
jne 0x46ef36
mov eax, dword [ebp - 0x268]
and eax, 0x10
cmp eax, 0x10
je 0x46eea5
mov edx, 0x46efbc
mov eax, dword [ebp - 0x264]
call fcn.00409b3c
test eax, eax
jne 0x46ee3d
mov bl, 1
jmp 0x46ee52
mov edx, 0x46efd4
mov eax, dword [ebp - 0x264]
call fcn.00409b3c
test eax, eax
sete bl
test bl, bl
jne 0x46ef23
push 0x80
lea eax, [ebp - 0x28c]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 4]
call fcn.00405bc0
mov eax, dword [ebp - 0x28c]
call fcn.00405b44
push eax
call sub.kernel32.dll_SetFileAttributesW
lea eax, [ebp - 0x290]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 4]
call fcn.00405bc0
mov eax, dword [ebp - 0x290]
call fcn.0046b40c
jmp 0x46ef23
mov eax, dword [ebp - 0x264]
cmp word [eax], 0x2e
je 0x46ef23
mov edx, dword [ebp - 0x264]
mov eax, 0x46eff0
call fcn.0046e768
test al, al
jne 0x46eefe
mov edx, dword [ebp - 0x264]
mov eax, 0x46f004
call fcn.0046e768
test al, al
jne 0x46eefe
lea eax, [ebp - 0x294]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 4]
call fcn.00405bc0
mov eax, dword [ebp - 0x294]
mov cl, 1
mov dl, 1
call fcn.0046e984
jmp 0x46ef23
lea eax, [ebp - 0x298]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 4]
call fcn.00405bc0
mov edx, dword [ebp - 0x298]
mov eax, dword [ebp - 0x27c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x278]
call fcn.0046b4f4
test eax, eax
je 0x46ee13
inc esi
lea eax, [ebp - 0x278]
call fcn.0046b518
mov eax, dword [ebp - 0x27c]
mov edx, dword [eax]
call dword [edx + 0x14]
cmp esi, eax
jl 0x46edbc
mov eax, dword [ebp - 0x27c]
call fcn.00404250
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46ef9e
lea eax, [ebp - 0x298]
mov edx, 7
call fcn.00405980
lea eax, [ebp - 0x278]
mov edx, dword [0x46b128]
call fcn.00405ecc
lea eax, [ebp - 4]
call fcn.00405968
ret
Function at 0x47ba00
Capabilities:
Link many functions at runtime

Disassembly:
mov byte [0x494ccc], 0
mov eax, dword [0x495838]
cmp dword [eax], 2
jne 0x47bbd9
mov eax, dword [0x495378]
cmp dword [eax], 5
jl 0x47bbd9
call fcn.00473658
test al, al
jne 0x47ba31
call fcn.00473664
call fcn.00473650
mov dword [0x494cd4], eax
push 0x47bbdc
mov eax, dword [0x494cd4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x494c98], eax
cmp dword [0x494c98], 0
jne 0x47ba8c
mov edx, 0x8000
mov eax, 0x47bbf0
call fcn.004109a4
mov dword [0x494cd0], eax
mov eax, dword [0x494cd0]
mov dword [0x494cd4], eax
push 0x47bbdc
mov eax, dword [0x494cd4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x494c98], eax
cmp dword [0x494c98], 0
je 0x47bbd4
push 0x47bbfc
mov eax, dword [0x494cd4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x494c9c], eax
cmp dword [0x494c9c], 0
je 0x47bbd4
push 0x47bc08
mov eax, dword [0x494cd4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x494ca0], eax
cmp dword [0x494ca0], 0
je 0x47bbd4
mov byte [0x494ccc], 1
push 0x47bc18
mov eax, dword [0x494cd4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x494ca4], eax
push 0x47bc24
mov eax, dword [0x494cd4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x494ca8], eax
push 0x47bc30
mov eax, dword [0x494cd4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x494cac], eax
push 0x47bc40
mov eax, dword [0x494cd4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x494cb0], eax
push 0x47bc50
mov eax, dword [0x494cd4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x494cb4], eax
mov edx, 0x8000
mov eax, 0x47bc68
call fcn.004109a4
mov dword [0x494cd8], eax
cmp dword [0x494cd8], 0
je 0x47bbd9
push 0x47bc78
mov eax, dword [0x494cd8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x494cb8], eax
push 0x47bc94
mov eax, dword [0x494cd8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x494cbc], eax
push 0x47bcb4
mov eax, dword [0x494cd8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x494cc0], eax
push 0x47bcd0
mov eax, dword [0x494cd8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x494cc4], eax
push 0x47bce8
mov eax, dword [0x494cd8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x494cc8], eax
ret
call fcn.0047b980
ret