joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45525c
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov byte [ebp - 1], dl
mov esi, eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 2], 0
test edi, edi
je 0x4552a9
xor ebx, ebx
jmp 0x45529e
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov eax, edi
call fcn.00406aa4
test eax, eax
jne 0x45529d
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 2
jmp 0x455359
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x45527f
mov al, byte [ebp - 1]
sub al, 1
jb 0x4552b4
je 0x4552bd
jmp 0x4552c6
call fcn.0042e318
mov edi, eax
jmp 0x4552c8
call sub.kernel32.dll_GetUserDefaultLangID
mov edi, eax
jmp 0x4552c8
xor edi, edi
test di, di
je 0x455359
xor ebx, ebx
jmp 0x455304
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
movzx edx, di
cmp eax, edx
jne 0x455303
mov eax, dword [ebp - 8]
cmp dword [eax + 0x2c], 0
je 0x4552f8
call sub.kernel32.dll_GetACP
mov edx, dword [ebp - 8]
cmp eax, dword [edx + 0x2c]
jne 0x455303
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x455359
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x4552d5
xor ebx, ebx
jmp 0x45534e
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
and eax, 0x3ff
mov edx, edi
and dx, 0x3ff
movzx edx, dx
cmp eax, edx
jne 0x45534d
mov eax, dword [ebp - 8]
cmp dword [eax + 0x2c], 0
je 0x455342
call sub.kernel32.dll_GetACP
mov edx, dword [ebp - 8]
cmp eax, dword [edx + 0x2c]
jne 0x45534d
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x455359
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x455313
mov al, byte [ebp - 2]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x457de0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
add esp, 0xfffffff4
mov ebx, edx
mov esi, eax
cmp byte [esi + 4], 0
je 0x457eba
mov byte [esi + 5], 1
mov eax, dword [esi + 0x10]
mov dword [esp + 4], eax
mov byte [esp + 8], 0
lea edx, [esp + 4]
xor ecx, ecx
mov eax, 0x457ec8
call fcn.00456d64
mov eax, dword [esi + 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x457e38
mov eax, 0x457efc
call fcn.00456b58
push 1
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_TerminateProcess
push 0x2710
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x457e23
push esp
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
je 0x457e8b
cmp dword [esp], 0
jne 0x457e6d
mov eax, 0x457f2c
call fcn.00456b58
jmp 0x457e95
mov eax, dword [esp]
mov dword [esp + 4], eax
mov byte [esp + 8], 0
lea edx, [esp + 4]
xor ecx, ecx
mov eax, 0x457f4c
call fcn.00456d64
jmp 0x457e95
mov eax, 0x457f84
call fcn.00456b58
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [esi + 8], eax
xor eax, eax
mov dword [esi + 0x10], eax
mov byte [esi + 4], 0
test bl, bl
je 0x457eba
push 0xfa
call sub.kernel32.dll_Sleep
add esp, 0xc
pop esi
pop ebx
ret
Function at 0x457fb8
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4581fa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
inc dword [eax + 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
mov ebx, dword [ebp - 4]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x24], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x28], ecx
xor eax, eax
lea ebx, [eax + 0xc]
add ebx, ecx
xor edx, edx
push ebp
push 0x458197
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
push 1
push 0
call sub.kernel32.dll_CreateEventA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x45802d
mov eax, 0x458214
call fcn.004527fc
xor edx, edx
push ebp
push 0x45812c
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x14
call fcn.00402934
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 8]
push eax
push 0x14
mov eax, dword [ebp - 4]
add eax, 0x4034
push eax
push ebx
mov eax, dword [ebp - 4]
add eax, 0x20
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_TransactNamedPipe
test eax, eax
jne 0x458115
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x3e5
je 0x458095
mov eax, 0x458228
call fcn.004527fc
xor edx, edx
push ebp
push 0x4580fe
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [ebp + 8], 0
je 0x4580d3
mov eax, dword [ebp - 4]
cmp word [eax + 0x1a], 0
je 0x4580d3
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x1c]
call dword [edx + 0x18]
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xc]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x4580b3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x458105
push 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_GetOverlappedResult
mov ebx, eax
call sub.kernel32.dll_GetLastError_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x458133
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
Function at 0x45bae4
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffe14
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x11e8], ebx
mov dword [ebp - 0x11ec], ebx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x11cc], edx
mov dword [ebp - 0x11d0], eax
lea esi, [ebp - 0x11e0]
lea edi, [ebp - 0x11d0]
xor eax, eax
push ebp
push 0x45bccd
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x11d4], eax
xor eax, eax
mov dword [ebp - 0x11c8], eax
mov eax, dword [edi]
add eax, 0x10
push eax
lea ecx, [ebp - 0x11c4]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x11cc]
call fcn.00458f44
cmp dword [ebp - 0x1084], 0x30
jle 0x45bb88
lea ecx, [ebp - 0x11e8]
mov edx, dword [ebp - 4]
mov al, 0xb7
call fcn.004507b8
mov ecx, dword [ebp - 0x11e8]
mov dl, 1
mov eax, 0x4063e0
call fcn.00408bec
call fcn.0040311c
lea eax, [ebp - 0x11ec]
lea edx, [ebp - 0x1184]
mov ecx, 0x80
call fcn.0040355c
mov edx, dword [ebp - 0x11ec]
lea ecx, [ebp - 0x11e8]
mov eax, dword [edi]
mov eax, dword [eax]
call fcn.0045b4f0
mov edx, dword [ebp - 0x11e8]
mov eax, dword [edi]
add eax, 0x14
call fcn.00403450
lea eax, [ebp - 0x11ec]
lea edx, [ebp - 0x1104]
mov ecx, 0x80
call fcn.0040355c
mov edx, dword [ebp - 0x11ec]
lea ecx, [ebp - 0x11e8]
mov eax, dword [edi]
mov eax, dword [eax]
call fcn.0045b4f0
mov edx, dword [ebp - 0x11e8]
mov eax, dword [edi]
add eax, 0x18
call fcn.00403450
lea eax, [ebp - 0x1078]
mov al, byte [eax]
mov edx, dword [edi]
mov byte [edx + 0x1d], al
mov ebx, dword [ebp - 0x1080]
test ebx, ebx
jle 0x45bcaf
push ebp
mov eax, esi
mov edx, 0xa
call fcn.0045ba6c
pop ecx
mov eax, dword [esi + 6]
push eax
mov eax, dword [edi]
mov eax, dword [eax]
mov ecx, dword [esi + 2]
mov dx, word [esi]
call fcn.00459544
mov dword [ebp - 0x11e4], eax
cmp dword [ebp - 0x11e4], 0
jne 0x45bc50
push ebp
call fcn.0045b8c0
pop ecx
xor eax, eax
push ebp
push 0x45bc81
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
mov eax, dword [ebp - 0x11e4]
add eax, 0x12
mov edx, dword [ebp - 0x11e4]
mov edx, dword [edx + 0xc]
call fcn.0045ba6c
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45bc9b
mov edx, dword [ebp - 0x11e4]
mov eax, dword [edi]
call fcn.00459580
dec ebx
jne 0x45bc19
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45bcd4
lea eax, [ebp - 0x11ec]
mov edx, 2
call fcn.00403420
ret
Function at 0x461af4
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x14c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x461bc8
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea eax, [ebp - 0x148]
push eax
lea edx, [ebp - 0x14c]
mov eax, ebx
call fcn.0042c3e4
lea eax, [ebp - 0x14c]
mov edx, 0x461be4
call fcn.0040357c
mov eax, dword [ebp - 0x14c]
call fcn.00403738
push eax
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x461baf
xor eax, eax
push ebp
push 0x461ba8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x148]
call fcn.00461aa8
test al, al
je 0x461b7d
mov byte [ebp - 1], 1
jmp 0x461b91
lea eax, [ebp - 0x148]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x461b68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461baf
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindClose
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461bcf
lea eax, [ebp - 0x14c]
call fcn.00403400
ret

Function at 0x461be8
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffea0
mov ebx, edx
mov esi, eax
push 0x200
push 0x160
lea eax, [esp + 8]
push eax
push 0
mov eax, esi
call fcn.00403738
push eax
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x461c28
mov eax, ebx
lea edx, [esp + 0xc]
mov ecx, 0x104
call fcn.0040355c
jmp 0x461c2f
mov eax, ebx
call fcn.00403400
add esp, 0x160
pop esi
pop ebx
ret

Function at 0x461c38
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffea0
mov ebx, edx
mov esi, eax
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x498b30]
or eax, 0x4001
push eax
push 0x160
lea eax, [esp + 8]
push eax
push 0
mov eax, esi
call fcn.00403738
push eax
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x461c78
mov eax, dword [esp + 4]
jmp 0x461c7a
xor eax, eax
add esp, 0x160
pop esi
pop ebx
ret

Function at 0x461c84
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffea0
mov ebx, eax
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x498b38]
or eax, 0x4011
push eax
push 0x160
lea eax, [esp + 8]
push eax
push 0x10
push 0x461cc8
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x461cbe
mov eax, dword [esp + 4]
jmp 0x461cc0
xor eax, eax
add esp, 0x160
pop ebx
ret

Function at 0x461ca8
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffea0
mov ebx, eax
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x498b38]
or eax, 0x4011
push eax
push 0x160
lea eax, [esp + 8]
push eax
push 0x10
push 0x461cc8
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x461cbe
mov eax, dword [esp + 4]
jmp 0x461cc0
xor eax, eax
add esp, 0x160
pop ebx
ret
Function at 0x46207c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
test dl, dl
je 0x462090
add esp, 0xfffffff0
call fcn.00402d30
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.00415934
mov ax, word [0x462130]
not eax
and ax, word [esi + 0x34]
mov word [esi + 0x34], ax
mov edx, 0x79
mov eax, esi
call fcn.00414604
mov edx, 0x61
mov eax, esi
call fcn.00414624
xor edx, edx
mov eax, esi
call fcn.00414c38
mov dl, 1
mov eax, esi
call fcn.00418300
call sub.kernel32.dll_GetVersion
and ax, 0xff
cmp ax, 6
jae 0x4620f1
mov dx, 0xfffe
mov eax, esi
call fcn.00414c58
push 0
lea eax, [ebp - 0x3c]
push eax
push 0x3c
push 0x1f
call sub.user32.dll_SystemParametersInfoA
test eax, eax
je 0x462117
lea eax, [ebp - 0x3c]
push eax
call sub.gdi32.dll_CreateFontIndirectA
mov edx, eax
mov eax, dword [esi + 0x44]
call fcn.0041a2c0
test bl, bl
je 0x462125
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x462f98
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x463062
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetLogicalDrives
mov esi, eax
mov bl, 0x41
test esi, 1
jne 0x462fd3
mov eax, ebx
call fcn.00461cd8
test al, al
je 0x46303b
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403510
lea eax, [ebp - 8]
mov edx, 0x463078
call fcn.0040357c
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00461be8
mov eax, dword [ebp - 4]
push eax
push 0
lea eax, [ebp - 0xc]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x10]
call fcn.00402878
mov edx, 0x46307c
lea eax, [ebp - 0x10]
mov cl, 2
call fcn.00402848
lea edx, [ebp - 0x10]
lea eax, [ebp - 8]
call fcn.00403520
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
xor edx, edx
call fcn.00462b00
shr esi, 1
inc ebx
cmp bl, 0x5b
jne 0x462fc0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463069
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403420
ret
Function at 0x463080
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x154], ecx
mov dword [ebp - 0x158], ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x46323d
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x463210
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00403574
cmp eax, 3
jne 0x46310c
mov eax, ebx
call fcn.00461ed8
test al, al
jne 0x4630ec
mov byte [ebp - 1], 0
call fcn.004031bc
jmp 0x463217
lea edx, [ebp - 0x154]
mov eax, ebx
call fcn.00461be8
mov ecx, dword [ebp - 0x154]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, esi
call fcn.00463478
mov byte [ebp - 1], 1
lea eax, [ebp - 0x150]
push eax
lea edx, [ebp - 0x154]
mov eax, ebx
call fcn.0042c3e4
lea eax, [ebp - 0x154]
mov edx, 0x463258
call fcn.0040357c
mov eax, dword [ebp - 0x154]
call fcn.00403738
push eax
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x4631f9
xor eax, eax
push ebp
push 0x4631f2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x150]
call fcn.00461aa8
test al, al
je 0x4631c7
lea eax, [ebp - 0x10]
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.0040355c
lea edx, [ebp - 0x158]
mov eax, ebx
call fcn.0042c3e4
lea eax, [ebp - 0x158]
mov edx, dword [ebp - 0x10]
call fcn.0040357c
mov eax, dword [ebp - 0x158]
lea edx, [ebp - 0x154]
call fcn.00461be8
mov eax, dword [ebp - 0x154]
push eax
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 0x10]
mov edx, esi
call fcn.00462b00
lea eax, [ebp - 0x150]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x463160
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4631f9
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FindClose
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463217
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetErrorMode
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463244
lea eax, [ebp - 0x158]
mov edx, 2
call fcn.00403420
lea eax, [ebp - 0x10]
call fcn.00403400
ret
Function at 0x4634fc
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x154], ebx
mov dword [ebp - 0x158], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4636e3
push dword fs:[eax]
mov dword fs:[eax], esp
test edi, edi
je 0x46356f
lea edx, [ebp - 0x154]
mov eax, edi
call fcn.0042c8f8
mov eax, dword [ebp - 0x154]
push eax
lea edx, [ebp - 0x158]
mov eax, ebx
call fcn.0042c3e4
mov eax, dword [ebp - 0x158]
pop edx
call fcn.0042c5ac
test eax, eax
jne 0x46356f
lea edx, [ebp - 4]
mov eax, edi
call fcn.0042c8d0
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4636ae
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x150]
push eax
lea edx, [ebp - 0x154]
mov eax, ebx
call fcn.0042c3e4
lea eax, [ebp - 0x154]
mov edx, 0x4636fc
call fcn.0040357c
mov eax, dword [ebp - 0x154]
call fcn.00403738
push eax
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x463697
xor eax, eax
push ebp
push 0x463690
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x150]
call fcn.00461aa8
test al, al
je 0x463661
lea eax, [ebp - 0x10]
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.0040355c
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.0042c5ac
test eax, eax
je 0x463661
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 0x10]
mov edx, esi
call fcn.00462be8
test eax, eax
jne 0x463661
lea edx, [ebp - 0x158]
mov eax, ebx
call fcn.0042c3e4
lea eax, [ebp - 0x158]
mov edx, dword [ebp - 0x10]
call fcn.0040357c
mov eax, dword [ebp - 0x158]
lea edx, [ebp - 0x154]
call fcn.00461be8
mov eax, dword [ebp - 0x154]
push eax
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 0x10]
mov edx, esi
call fcn.00462b00
lea eax, [ebp - 0x150]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x4635d7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463697
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FindClose
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4636b5
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x466504
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x168], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4666f6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x2e0]
mov edx, 0x20
call fcn.00414604
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x2e0]
mov edx, 0x20
call fcn.00414624
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x2e4]
mov edx, 0x20
call fcn.00414604
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x2e4]
mov edx, 0x20
call fcn.00414624
xor eax, eax
push ebp
push 0x4666cb
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x1010
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0x10
push 0x466704
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x4665e3
cmp byte [ebp - 0x158], 0
je 0x4665e3
mov eax, dword [ebp - 0x160]
push eax
lea eax, [ebp - 0x158]
push eax
mov eax, dword [0x49a014]
push eax
call sub.shell32.dll_ExtractIconA
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x2e0]
call fcn.00466444
xor edx, edx
mov al, 6
call fcn.00477524
test al, al
je 0x46663f
push 0x27
lea edx, [ebp - 0x168]
mov eax, dword [0x49b128]
call fcn.0042c3e4
lea eax, [ebp - 0x168]
mov edx, 0x46671c
call fcn.0040357c
mov eax, dword [ebp - 0x168]
call fcn.00403738
push eax
mov eax, dword [0x49a014]
push eax
call sub.shell32.dll_ExtractIconA
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x2e4]
call fcn.00466444
jmp 0x4666c1
lea eax, [ebp - 4]
push eax
xor ecx, ecx
mov dl, 2
xor eax, eax
call fcn.0047b964
cmp dword [ebp - 4], 0
jne 0x466663
lea eax, [ebp - 4]
push eax
xor ecx, ecx
mov dl, 2
mov al, 1
call fcn.0047b964
cmp dword [ebp - 4], 0
je 0x4666c1
push 0x1000
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00403738
push eax
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x4666c1
cmp byte [ebp - 0x158], 0
je 0x4666c1
mov eax, dword [ebp - 0x160]
push eax
lea eax, [ebp - 0x158]
push eax
mov eax, dword [0x49a014]
push eax
call sub.shell32.dll_ExtractIconA
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x2e4]
call fcn.00466444
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4666d5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4666fd
lea eax, [ebp - 0x168]
call fcn.00403400
lea eax, [ebp - 4]
call fcn.00403400
ret
Function at 0x46ee58
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x46ef55
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 2
lea eax, [ebp - 4]
push eax
xor eax, eax
mov al, byte [0x49b36f]
mov ecx, dword [eax*4 + 0x498ba0]
mov edx, 0x80000002
xor eax, eax
call fcn.0042dd1c
test eax, eax
jne 0x46eedd
mov eax, esi
call fcn.00403574
inc eax
push eax
mov eax, esi
call fcn.00403738
push eax
push 1
push 0
mov eax, edi
call fcn.00403738
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x46eed2
mov eax, 0x46ef6c
call fcn.00456b58
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
jmp 0x46eee7
mov eax, 0x46efa0
call fcn.00456b58
test bl, bl
je 0x46ef3a
mov eax, esi
call fcn.00403738
push eax
call sub.gdi32.dll_AddFontResourceA
test eax, eax
je 0x46ef0e
push 0
push 0
push 0x1d
push 0xffff
call sub.user32.dll_SendNotifyMessageA
jmp 0x46ef3a
lea ecx, [ebp - 0xc]
mov edx, 0x46efcc
mov al, 0x33
call fcn.004507b8
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.0042e5ac
mov eax, dword [ebp - 8]
mov edx, dword [0x49acd8]
call fcn.0046d1c0
test al, al
je 0x46eeeb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46ef5c
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403420
ret

Function at 0x471610
Capabilities:
Check if file exists
Delete directory
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x4716d1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403738
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4716b6
test bl, 0x10
je 0x4716b6
lea ecx, [ebp - 4]
mov edx, 0x4716e8
mov eax, esi
call fcn.0042c520
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
xor ecx, ecx
mov edx, 0x4716fc
mov eax, 0x47170c
call fcn.0042cd38
mov edx, 0x471724
mov eax, dword [ebp - 8]
call fcn.00406aa4
test eax, eax
jne 0x4716b6
mov eax, dword [ebp - 4]
call fcn.00406f30
lea ecx, [ebp - 0xc]
mov edx, 0x471754
mov eax, esi
call fcn.0042c520
mov eax, dword [ebp - 0xc]
call fcn.00406f30
and ebx, 0xfffffffe
push ebx
mov eax, esi
call fcn.00403738
mov edi, eax
push edi
call sub.kernel32.dll_SetFileAttributesA
push edi
call sub.kernel32.dll_RemoveDirectoryA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4716d8
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403420
ret
Function at 0x4721d4
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov edi, ecx
mov esi, edx
mov byte [ebp - 1], al
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4722a8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
je 0x472292
lea edx, [ebp - 0x18]
mov eax, esi
call fcn.00452910
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x4722c0
call fcn.00456d64
mov edx, ebx
mov eax, dword [0x49b2ec]
call fcn.0040b424
mov ebx, eax
mov eax, dword [ebx]
push eax
mov eax, dword [ebx]
call fcn.00403574
mov ecx, 0x14
cdq
idiv ecx
push eax
mov ecx, edi
mov edx, esi
mov al, byte [ebp - 1]
call fcn.0045c3e8
test al, al
jne 0x472292
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
jne 0x472277
mov eax, 0x4722f4
call fcn.00456b58
jmp 0x472292
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
lea edx, [ebp - 0x20]
xor ecx, ecx
mov eax, 0x472350
call fcn.00456d64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4722af
lea eax, [ebp - 0x18]
call fcn.00403400
ret