joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a6df
Capabilities:
Check os version

Disassembly:
mov eax, 0x478a33
call fcn.0045c348
sub esp, 0x98
mov eax, dword [0x4a84c4]
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
lea ebx, [esi + 0x30]
mov dword [ebx], eax
push 1
xor eax, eax
pop edi
mov ecx, ebx
push str.Unknown_OS
mov dword [ebp - 4], eax
mov dword [esi], vtable.CIROSVersionInfo.0
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
call fcn.0046b386
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa4], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x40a829
mov ecx, dword [ebp - 0x94]
mov eax, dword [ebp - 0xa0]
mov edx, dword [ebp - 0x9c]
mov dword [esi + 0x20], ecx
dec ecx
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], edx
je 0x40a7ea
dec ecx
jne 0x40a82c
mov ecx, dword [ebp - 0x98]
cmp eax, 3
mov dword [esi + 0x2c], ecx
jne 0x40a79d
push str.Windows_NT_3
mov ecx, ebx
call fcn.0046b386
mov dword [esi + 0x10], edi
cmp dword [esi + 0x24], 4
jne 0x40a7b2
push str.Windows_NT_4
mov ecx, ebx
call fcn.0046b386
mov dword [esi + 0x14], edi
cmp dword [esi + 0x24], 5
jne 0x40a82c
cmp dword [esi + 0x28], 0
jne 0x40a7cd
push str.Windows_2000
mov ecx, ebx
call fcn.0046b386
mov dword [esi + 0x18], edi
cmp dword [esi + 0x24], 5
jne 0x40a82c
cmp dword [esi + 0x28], 0
jbe 0x40a82c
push str.Windows_XP
mov ecx, ebx
call fcn.0046b386
mov dword [esi + 0x1c], edi
jmp 0x40a82c
movzx ecx, word [ebp - 0x98]
cmp eax, 4
mov dword [esi + 0x2c], ecx
ja 0x40a809
jne 0x40a7ff
test edx, edx
ja 0x40a809
mov dword [esi + 4], edi
push str.Windows_95
jmp 0x40a816
cmp edx, 0xa
ja 0x40a81f
mov dword [esi + 8], edi
push str.Windows_98
mov ecx, ebx
call fcn.0046b386
jmp 0x40a82c
mov dword [esi + 0xc], edi
push str.Windows_ME
jmp 0x40a816
mov dword [esi + 4], edi
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x414cd4
Capabilities:
Get disk information

Disassembly:
mov eax, 0x47a1c8
call fcn.0045c348
sub esp, 0x18
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov eax, dword [esi + 0x19c]
cmp byte [eax + 0x1e8], bl
jne 0x414d0c
push ebx
push 0x594
call fcn.0046bd8e
mov ecx, eax
call fcn.0046bf7f
jmp 0x414e2b
mov eax, dword [0x4a84c4]
push edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], eax
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push ebx
push ebx
push 0x147
push dword [esi + 0x78]
mov byte [ebp - 4], 1
call edi
cmp eax, 0xffffffff
je 0x414e13
push ebx
push eax
push 0x150
push dword [esi + 0x78]
call edi
push eax
lea ecx, [ebp - 0x10]
call fcn.0046b386
push dword [ebp - 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
call edi
cmp eax, 3
je 0x414d82
push dword [ebp - 0x10]
call edi
cmp eax, 4
je 0x414d82
push ebx
push 0x594
mov ecx, esi
call fcn.0046bd8e
mov ecx, eax
call fcn.0046bf7f
jmp 0x414e13
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x10]
call fcn.0041fe51
push dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
push dword [ebp - 0x24]
push eax
call fcn.0041f351
add esp, 0x14
mov edi, eax
mov eax, dword [esi + 0x19c]
mov ecx, dword [esi + 0x1a8]
mov byte [ebp - 4], 2
push dword [eax + 0x1b8]
lea eax, [ebp - 0x18]
push eax
call fcn.0044edf9
push dword [edi]
mov byte [ebp - 4], 3
push dword [eax]
lea eax, [ebp - 0x14]
push 0x49f42c
push eax
call fcn.00468cd1
add esp, 0x10
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.0046b249
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.0046b249
mov edi, 0x594
push 1
push edi
mov ecx, esi
call fcn.0046bd8e
mov ecx, eax
call fcn.0046bf7f
push dword [ebp - 0x14]
mov ecx, esi
push edi
call fcn.0046bde6
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.0046b249
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0046b249
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x417cf2
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push ebx
lea eax, [ebp - 0xc]
push esi
push eax
xor ebx, ebx
push 1
push 8
mov byte [ebp - 8], bl
mov byte [ebp - 7], bl
mov byte [ebp - 6], bl
mov byte [ebp - 5], bl
mov byte [ebp - 4], bl
mov byte [ebp - 3], 5
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x417d4f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
jne 0x417d9a
lea eax, [ebp - 0xc]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x417d9a
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x414]
push 0x400
push eax
push 2
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push dword [ebp - 0xc]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, ebx
je 0x417d9a
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
lea eax, [ebp - 8]
push 2
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x417d9e
xor eax, eax
jmp 0x417ddb
xor esi, esi
cmp dword [ebp - 0x414], ebx
push edi
jbe 0x417dcf
lea edi, [ebp - 0x410]
push dword [edi]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x417dcc
inc esi
add edi, 8
cmp esi, dword [ebp - 0x414]
jb 0x417daf
jmp 0x417dcf
push 1
pop ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41bf5d
Capabilities:
Create directory
Set current directory

Disassembly:
mov eax, 0x47b02c
call fcn.0045c348
sub esp, 0x108
push ebx
push esi
push edi
lea eax, [ebp + 8]
xor ebx, ebx
push 0x5c
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], 1
call fcn.0041bded
pop ecx
pop ecx
push 0x49e93c
lea ecx, [ebp + 8]
call fcn.0046b5d9
mov eax, dword [ebp + 8]
push 0x104
push ebx
mov edi, dword [eax - 8]
lea eax, [ebp - 0x114]
push eax
call fcn.0045c460
add esp, 0xc
cmp edi, 2
jle 0x41c009
mov eax, dword [ebp + 8]
cmp byte [eax + 1], 0x3a
jne 0x41c009
xor esi, esi
cmp edi, ebx
jle 0x41c00c
cmp dword [ebp - 0x10], ebx
je 0x41c00c
mov eax, dword [ebp + 8]
mov al, byte [esi + eax]
cmp al, 0x5c
mov byte [ebp + esi - 0x114], al
jne 0x41c002
cmp esi, 2
je 0x41c002
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x41c002
lea eax, [ebp - 0x114]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 0x10], eax
inc esi
cmp esi, edi
jl 0x41bfc5
jmp 0x41c00c
mov dword [ebp - 0x10], ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0046b249
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x41c02a
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x47b050
call fcn.0045c348
mov eax, 0x9550
call fcn.0045c590
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [0x4a84c4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 2
cmp dword [eax - 8], ebx
jne 0x41c060
xor esi, esi
jmp 0x41c1a5
push 4
push eax
call fcn.0045da64
pop ecx
cmp eax, 0xffffffff
pop ecx
je 0x41c059
mov eax, dword [ebp + 0x10]
cmp dword [eax - 8], ebx
je 0x41c059
mov ecx, dword [ebp + 8]
cmp ecx, ebx
je 0x41c059
push edi
call fcn.0046992a
push dword [ebp + 0xc]
lea eax, [ebp - 0x955c]
push 0x7d00
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
mov edi, 0xc8
mov dword [ebp - 0x24], eax
push edi
lea eax, [ebp - 0xec]
push ebx
push eax
call fcn.0045c460
mov esi, 0x1770
lea eax, [ebp - 0x185c]
push esi
push ebx
push eax
call fcn.0045c460
add esp, 0x18
xor ecx, ecx
cmp dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x20], ecx
jle 0x41c1a1
mov al, byte [ebp + ecx - 0x955c]
cmp al, bl
jne 0x41c16a
cmp ecx, ebx
jle 0x41c194
cmp byte [ebp + ecx - 0x955d], bl
je 0x41c194
lea eax, [ebp - 0xec]
lea ecx, [ebp - 0x10]
push eax
call fcn.0046b386
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.00469a51
lea eax, [ebp - 0x185c]
lea ecx, [ebp - 0x10]
push eax
call fcn.0046b386
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.00469a51
push edi
lea eax, [ebp - 0xec]
push ebx
push eax
call fcn.0045c460
push esi
lea eax, [ebp - 0x185c]
push ebx
push eax
call fcn.0045c460
mov ecx, dword [ebp - 0x20]
add esp, 0x18
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
jmp 0x41c194
cmp al, 0x3d
jne 0x41c173
mov dword [ebp - 0x1c], ebx
jmp 0x41c194
cmp dword [ebp - 0x1c], ebx
je 0x41c187
mov edx, dword [ebp - 0x14]
inc dword [ebp - 0x14]
mov byte [ebp + edx - 0xec], al
jmp 0x41c194
mov edx, dword [ebp - 0x18]
inc dword [ebp - 0x18]
mov byte [ebp + edx - 0x185c], al
inc ecx
cmp ecx, dword [ebp - 0x24]
mov dword [ebp - 0x20], ecx
jl 0x41c0e3
push 1
pop esi
pop edi
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.0046b249
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], bl
call fcn.0046b249
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.0046b249
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x41c1d8
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x47b06c
call fcn.0045c348
mov eax, 0x7dd0
call fcn.0045c590
push ebx
push esi
mov eax, dword [0x4a84c4]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 1
cmp dword [eax - 8], ebx
jne 0x41c20e
xor esi, esi
jmp 0x41c2bb
push 4
push eax
call fcn.0045da64
pop ecx
cmp eax, 0xffffffff
pop ecx
je 0x41c207
mov ecx, dword [ebp + 8]
cmp ecx, ebx
je 0x41c207
push edi
call fcn.0046992a
push dword [ebp + 0xc]
lea eax, [ebp - 0x7ddc]
push 0x7d00
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
mov esi, 0xc8
mov dword [ebp - 0x14], eax
push esi
lea eax, [ebp - 0xdc]
push ebx
push eax
call fcn.0045c460
add esp, 0xc
xor ecx, ecx
xor edi, edi
cmp dword [ebp - 0x14], ebx
jle 0x41c2b7
mov al, byte [ebp + edi - 0x7ddc]
cmp al, bl
jne 0x41c2a9
cmp edi, ebx
jle 0x41c2b1
cmp byte [ebp + edi - 0x7ddd], bl
je 0x41c2b1
lea eax, [ebp - 0xdc]
lea ecx, [ebp - 0x10]
push eax
call fcn.0046b386
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.00469a51
push esi
lea eax, [ebp - 0xdc]
push ebx
push eax
call fcn.0045c460
add esp, 0xc
xor ecx, ecx
jmp 0x41c2b1
mov byte [ebp + ecx - 0xdc], al
inc ecx
inc edi
cmp edi, dword [ebp - 0x14]
jl 0x41c261
push 1
pop esi
pop edi
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.0046b249
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0046b249
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x41c46b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x4a84c4]
push ebx
push esi
push edi
push 0x44
mov dword [ebp - 4], eax
pop edi
xor esi, esi
push edi
lea eax, [ebp - 0x74]
push esi
push eax
call fcn.0045c460
push 0x10
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.0045c460
mov eax, dword [ebp + 0x18]
add esp, 0x18
mov dword [ebp - 0x74], edi
sub eax, esi
push 1
mov dword [ebp - 0x70], esi
pop edi
mov dword [ebp - 0x40], esi
mov word [ebp - 0x42], si
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x48], edi
je 0x41c4d1
dec eax
je 0x41c4c9
dec eax
jne 0x41c4d5
mov word [ebp - 0x44], 3
jmp 0x41c4d5
mov word [ebp - 0x44], 6
jmp 0x41c4d5
mov word [ebp - 0x44], di
push dword [ebp + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
call ebx
test eax, eax
jne 0x41c4f6
push dword [ebp + 8]
lea eax, [ebp - 0x268]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x41c511
push dword [ebp + 0xc]
lea eax, [ebp - 0x268]
push dword [ebp + 8]
push str.__s___s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push dword [ebp + 0x10]
call ebx
test eax, eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x74]
push eax
jne 0x41c525
push esi
jmp 0x41c528
push dword [ebp + 0x10]
push esi
push 0x20
push esi
push esi
lea eax, [ebp - 0x268]
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, esi
mov dword [ebp + 0xc], eax
je 0x41c5a7
cmp dword [ebp + 0x14], esi
je 0x41c59e
mov ebx, 0xff
lea eax, [ebp - 0x14]
push ebx
push 0xffffffffffffffff
push esi
push eax
push edi
mov edi, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
call edi
cmp eax, 1
jne 0x41c59e
push 1
push esi
push esi
lea eax, [ebp - 0x30]
push esi
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jle 0x41c592
cmp dword [ebp - 0x2c], 0xf
jne 0x41c563
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x41c563
push ebx
push 0xffffffffffffffff
lea eax, [ebp - 0x14]
push esi
push eax
push 1
jmp 0x41c55c
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 4]
call fcn.0046b249
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41d637
Capabilities:
Get disk information
Get file system object information

Disassembly:
sub esp, 0x160
xor eax, eax
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x4c], eax
je 0x41d651
or eax, 0xffffffff
jmp 0x41d72b
mov ebx, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
push eax
push eax
call ebx
mov edi, eax
lea eax, [edi + 1]
push eax
call fcn.0046a42d
pop ecx
mov dword [esi + 0x4c], eax
push eax
push edi
call ebx
dec edi
cmp eax, edi
je 0x41d67b
push 0xfffffffffffffffe
pop eax
jmp 0x41d72b
mov edi, dword [esi + 0x4c]
push ebp
push edi
call fcn.0045cbd0
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
mov ebp, eax
test ebp, ebp
pop ecx
jbe 0x41d71c
push 0x200
lea eax, [esp + 0x14]
push 0x160
push eax
push 0
push edi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
jne 0x41d6c0
push eax
push eax
push str.SHGetFileInfo_failed__no_more_details_available_n
call fcn.00472619
jmp 0x41d707
push edi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
dec eax
dec eax
je 0x41d6e3
dec eax
je 0x41d6de
dec eax
je 0x41d6d9
dec eax
jne 0x41d6ea
mov eax, dword [esi + 0x48]
jmp 0x41d6e6
mov eax, dword [esi + 0x40]
jmp 0x41d6e6
mov eax, dword [esi + 0x3c]
jmp 0x41d6e6
mov eax, dword [esi + 0x44]
test eax, eax
je 0x41d707
lea eax, [esp + 0x1c]
push eax
push 0xffffffffffffffff
push 0x14a
push dword [esi + 0x1c]
call ebx
push edi
push eax
push 0x151
push dword [esi + 0x1c]
call ebx
lea edi, [edi + ebp + 1]
push edi
call fcn.0045cbd0
mov ebp, eax
pop ecx
test ebp, ebp
ja 0x41d696
push 0
push 0
push 0x146
push dword [esi + 0x1c]
call ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x160
ret 4
Function at 0x41ec4c
Capabilities:
Get common file path
Set current directory

Disassembly:
mov eax, 0x47b883
call fcn.0045c348
sub esp, 0x238
mov eax, dword [0x4a84c4]
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp + 0x14], ebx
push 1
pop esi
mov dword [ebp - 4], esi
je 0x41ed6e
push ebx
push dword [ebp + 0x14]
call fcn.0045da64
pop ecx
test eax, eax
pop ecx
jne 0x41ed6e
lea eax, [ebp - 0x244]
mov dword [ebp - 0x14], esi
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 0x20
lea eax, [ebp - 0x3c]
push ebx
push eax
call fcn.0045c460
mov eax, dword [ebp + 0xc]
add esp, 0xc
cmp dword [ebp - 0x14], ebx
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x140]
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], esi
je 0x41ece1
mov dword [ebp - 0x28], 0x41ec0a
lea eax, [ebp - 0x3c]
push edi
push eax
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderA]
mov edi, eax
cmp edi, ebx
je 0x41ed30
lea eax, [ebp - 0x140]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x41ed13
lea eax, [ebp - 0x140]
lea ecx, [ebp - 0x10]
push eax
call fcn.0046b386
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov eax, dword [ebp - 0x18]
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0x14], ebx
pop edi
je 0x41ed43
lea eax, [ebp - 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.0046afbe
mov dword [ebp - 0x1c], esi
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.0046b249
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
mov dword [ebp - 0x14], ebx
jmp 0x41ecab
Function at 0x41ee5c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
sub eax, ebx
mov dword [ebp - 4], ebx
je 0x41ee96
dec eax
je 0x41ee8f
dec eax
je 0x41ee88
dec eax
je 0x41ee81
dec eax
jne 0x41ee96
mov ecx, 0x80000003
jmp 0x41ee9b
mov ecx, 0x80000002
jmp 0x41ee9b
mov ecx, 0x80000001
jmp 0x41ee9b
mov ecx, 0x80000005
jmp 0x41ee9b
mov ecx, 0x80000000
mov eax, dword [ebp + 0x10]
sub eax, ebx
je 0x41eeb0
dec eax
je 0x41eeac
dec eax
jne 0x41eeac
push 2
jmp 0x41eeb2
push 1
jmp 0x41eeb2
push 4
pop esi
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x41ef21
push dword [ebp + 0x18]
cmp esi, 4
jne 0x41eeed
call fcn.0045d88c
pop ecx
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push 4
push eax
push 4
jmp 0x41eef9
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [ebp + 0x18]
push esi
push ebx
push dword [ebp + 0x14]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x41ef11
mov dword [ebp - 4], 1
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x41ef21
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret

Function at 0x41ef9c
Capabilities:
Delete registry key

Disassembly:
mov eax, dword [esp + 4]
push esi
xor esi, esi
sub eax, esi
je 0x41efcf
dec eax
je 0x41efc8
dec eax
je 0x41efc1
dec eax
je 0x41efba
dec eax
jne 0x41efcf
mov eax, 0x80000003
jmp 0x41efd4
mov eax, 0x80000002
jmp 0x41efd4
mov eax, 0x80000001
jmp 0x41efd4
mov eax, 0x80000005
jmp 0x41efd4
mov eax, 0x80000000
push dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x41efe6
push 1
pop esi
mov eax, esi
pop esi
ret
Function at 0x41efea
Capabilities:
Create directory

Disassembly:
mov eax, 0x47b8c0
call fcn.0045c348
sub esp, 0x1c
push edi
xor edi, edi
push edi
mov dword [ebp - 4], edi
push dword [ebp + 8]
call fcn.0045da64
pop ecx
test eax, eax
pop ecx
jne 0x41f014
push 1
pop edi
jmp 0x41f166
mov eax, dword [0x4a84c4]
push ebx
push esi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
push 0xc
lea eax, [ebp - 0x28]
pop esi
mov byte [ebp - 4], 2
push esi
push edi
push eax
call fcn.0045c460
mov eax, dword [ebp + 8]
add esp, 0xc
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], edi
push 0x5c
mov dword [ebp - 0x20], edi
mov cl, byte [eax]
pop ebx
cmp cl, bl
mov dword [ebp - 0x18], 1
jne 0x41f092
cmp byte [eax + 1], bl
jne 0x41f092
push 2
push ebx
lea ecx, [ebp + 8]
call fcn.0046b6d2
mov esi, eax
cmp esi, 0xffffffff
je 0x41f0cf
lea eax, [ebp - 0x1c]
push esi
push eax
lea ecx, [ebp + 8]
call fcn.004688b1
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.0046b336
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.0046b249
inc esi
jmp 0x41f0cf
cmp byte [eax + 1], 0x3a
jne 0x41f14c
cmp byte [eax + 2], bl
jne 0x41f14c
lea eax, [ebp - 0x1c]
push 2
push eax
lea ecx, [ebp + 8]
call fcn.004688b1
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 4
call fcn.0046b336
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.0046b249
push 3
pop esi
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 8]
cmp byte [ecx + eax - 1], bl
je 0x41f0e8
push 0x49e93c
lea ecx, [ebp + 8]
call fcn.0046b5d9
push esi
push ebx
lea ecx, [ebp + 8]
call fcn.0046b6d2
mov esi, eax
cmp esi, 0xffffffff
jle 0x41f149
lea eax, [ebp - 0x1c]
push esi
push eax
lea ecx, [ebp + 8]
call fcn.004688b1
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 5
call fcn.0046b336
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.0046b249
push edi
push dword [ebp - 0x10]
call fcn.0045da64
pop ecx
cmp eax, 0xffffffff
pop ecx
jne 0x41f140
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x41f146
lea eax, [esi + 1]
push eax
jmp 0x41f0e9
mov dword [ebp - 0x18], edi
mov edi, dword [ebp - 0x18]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.0046b249
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0046b249
pop esi
pop ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0046b249
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
mov dword fs:[0], ecx
leave
ret
Function at 0x41fa68
Capabilities:
Copy file
Delete file
Set file attributes

Disassembly:
mov eax, 0x47ba9c
call fcn.0045c348
push ecx
mov eax, dword [0x4a84c4]
push esi
push edi
mov dword [ebp - 0x10], eax
mov edi, dword [ebp + 0xc]
xor esi, esi
push 0x80
push edi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x41fb2f
push esi
lea eax, [ebp + 0xc]
push esi
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push str.Error_copying_file:_n
lea ecx, [ebp - 0x10]
call fcn.0046b386
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
call fcn.0046b5d9
push str._nFrom:_t
lea ecx, [ebp - 0x10]
call fcn.0046b5d9
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.0046b5d9
push str._nTo:_t
lea ecx, [ebp - 0x10]
call fcn.0046b5d9
push edi
lea ecx, [ebp - 0x10]
call fcn.0046b5d9
push 0x10
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call fcn.0041ff61
mov ecx, eax
call fcn.0046e56b
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 1
pop esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0046b249
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x41fe51
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push str.GetDiskFreeSpaceExA
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor esi, esi
cmp eax, esi
je 0x41fe9a
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x28]
push ecx
push dword [ebp + 8]
call eax
test eax, eax
je 0x41fed4
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x14]
mov dword [eax + 4], ecx
jmp 0x41fed0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x41fed4
mov eax, dword [ebp - 4]
push esi
mul dword [ebp - 8]
push dword [ebp - 0xc]
push edx
push eax
call fcn.0045c610
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov dword [ecx + 4], edx
xor eax, eax
jmp 0x41fedf
mov eax, dword [ebp + 0xc]
push 1
mov dword [eax], esi
mov dword [eax + 4], esi
pop eax
pop esi
leave
ret