joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4758e4
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4758ec
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4759d9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.0044d4c8
mov edx, dword [ebp - 8]
mov ecx, 0x4759f0
xor eax, eax
call fcn.00475670
push 0
mov eax, dword [ebp - 4]
call fcn.00403efc
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x4759a7
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 0xb7
je 0x475906
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 4]
mov al, 0x2f
call fcn.004731d0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.00409ca8
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x24]
mov eax, ebx
call fcn.0044e218
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x18]
mov ecx, 2
mov al, 0x60
call fcn.004731a0
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x408a18]
call fcn.0040c3f4
call fcn.00403588
jmp 0x475906
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00403b0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4759e0
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00403adc
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403adc
ret
Function at 0x477018
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x18]
call fcn.00403eec
xor eax, eax
push ebp
push 0x4770fb
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp + 0x18], 0
jne 0x47705f
lea edx, [ebp + 0x18]
mov eax, edi
call fcn.0044c320
cmp dword [ebp + 0x18], 0
jne 0x47705f
lea eax, [ebp + 0x18]
call fcn.0044d418
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x3c
call fcn.00402acc
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x540
test ebx, ebx
je 0x47708a
mov eax, ebx
call fcn.00403efc
mov dword [ebp - 0x34], eax
mov eax, edi
call fcn.00403efc
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
call fcn.00403efc
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x18]
call fcn.00403efc
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
push eax
call sub.shell32.dll_ShellExecuteExA
neg eax
sbb ebx, ebx
neg ebx
test bl, bl
jne 0x4770cc
call sub.kernel32.dll_GetLastError_1
mov dword [esi], eax
jmp 0x4770e5
mov dword [esi], 0x103
mov eax, dword [ebp - 8]
test eax, eax
je 0x4770e5
push esi
mov ecx, dword [ebp + 0xc]
mov dl, byte [ebp + 0x14]
call fcn.00476cf8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x477102
lea eax, [ebp + 0x18]
call fcn.00403ab8
ret

Function at 0x4772e8
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffec
mov ebx, eax
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x477316
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x10
call fcn.00403ce8
jmp 0x47731d
mov eax, ebx
call fcn.00403ab8
add esp, 0x14
pop ebx
ret

Function at 0x477324
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
mov dword [esp], 0x101
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x477355
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x101
call fcn.00403ce8
jmp 0x47735c
mov eax, ebx
call fcn.00403ab8
add esp, 0x108
pop ebx
ret

Function at 0x47736c
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffec
mov eax, dword [0x4bec00]
cmp dword [eax], 2
jne 0x4773d4
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x47738f
xor eax, eax
jmp 0x4773e3
lea eax, [esp + 8]
push eax
push 0x4773e8
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError_1
test eax, eax
je 0x4773d4
xor eax, eax
jmp 0x4773e3
push 0
push 2
call sub.user32.dll_ExitWindowsEx
neg eax
sbb eax, eax
neg eax
add esp, 0x14
ret
Function at 0x4773fc
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x477456
inc esi
xor edi, edi
cmp edi, 1
jne 0x477422
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep
jmp 0x477430
cmp edi, 1
jle 0x477430
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00474774
test eax, eax
jne 0x477456
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
je 0x477456
call sub.kernel32.dll_GetLastError_1
cmp eax, 3
je 0x477456
inc edi
dec esi
jne 0x477412
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x477b24
Capabilities:
Delete registry value

Disassembly:
push ebx
push esi
push ecx
mov ebx, edx
mov esi, eax
push 0
push 2
lea eax, [esp + 8]
push eax
call fcn.0044d6a0
and eax, 0x7f
mov ecx, dword [eax*4 + 0x4be064]
mov edx, 0x80000002
xor eax, eax
call fcn.0044d8c4
test eax, eax
jne 0x477b6e
mov eax, esi
call fcn.00403efc
push eax
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
call fcn.00403efc
push eax
call sub.gdi32.dll_RemoveFontResourceA
test eax, eax
je 0x477b8f
push 0
push 0
push 0x1d
push 0xffff
call sub.user32.dll_SendNotifyMessageA
pop edx
pop esi
pop ebx
ret
Function at 0x477b94
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov edi, ecx
mov esi, edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x477cdc
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x477cf0
push 0x477d04
call sub.kernel32.dll_GetModuleHandleA_2
push eax
call sub.kernel32.dll_GetProcAddress_1
mov ebx, eax
lea edx, [ebp - 0xc]
mov al, byte [ebp - 1]
call fcn.00474590
test al, al
jne 0x477bf2
mov byte [ebp - 2], 0
jmp 0x477cc1
xor eax, eax
push ebp
push 0x477cba
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x477c36
push 0
mov eax, dword [ebp + 8]
push eax
push edi
lea edx, [ebp - 0x24]
mov eax, esi
call fcn.0044c280
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.0044bec0
mov eax, dword [ebp - 0x20]
call fcn.00403efc
push eax
call ebx
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 2], al
jmp 0x477ca4
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x30]
mov eax, esi
call fcn.0044c280
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
call fcn.0044c348
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.0044bec0
mov eax, dword [ebp - 0x28]
call fcn.00403efc
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 2], al
cmp byte [ebp - 2], 0
je 0x477ca4
mov ecx, edi
mov eax, dword [ebp - 0x14]
imul dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
call fcn.00450dd4
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x14]
imul dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.00450dd4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x477cc1
lea eax, [ebp - 0xc]
call fcn.004745cc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x477ce3
lea eax, [ebp - 0x30]
mov edx, 5
call fcn.00403adc
ret
Function at 0x477e84
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov byte [ebp - 1], dl
mov esi, eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 2], 0
test edi, edi
je 0x477ed1
xor ebx, ebx
jmp 0x477ec6
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov eax, edi
call fcn.004096f8
test eax, eax
jne 0x477ec5
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 2
jmp 0x477f81
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x477ea7
mov al, byte [ebp - 1]
sub al, 1
jb 0x477edc
je 0x477ee5
jmp 0x477eee
call fcn.0044de2c
mov edi, eax
jmp 0x477ef0
call sub.kernel32.dll_GetUserDefaultLangID
mov edi, eax
jmp 0x477ef0
xor edi, edi
test di, di
je 0x477f81
xor ebx, ebx
jmp 0x477f2c
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
movzx edx, di
cmp eax, edx
jne 0x477f2b
mov eax, dword [ebp - 8]
cmp dword [eax + 0x2c], 0
je 0x477f20
call sub.kernel32.dll_GetACP
mov edx, dword [ebp - 8]
cmp eax, dword [edx + 0x2c]
jne 0x477f2b
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x477f81
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x477efd
xor ebx, ebx
jmp 0x477f76
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
and eax, 0x3ff
mov edx, edi
and dx, 0x3ff
movzx edx, dx
cmp eax, edx
jne 0x477f75
mov eax, dword [ebp - 8]
cmp dword [eax + 0x2c], 0
je 0x477f6a
call sub.kernel32.dll_GetACP
mov edx, dword [ebp - 8]
cmp eax, dword [edx + 0x2c]
jne 0x477f75
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x477f81
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x477f3b
mov al, byte [ebp - 2]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x47aad0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
add esp, 0xfffffff4
mov ebx, edx
mov esi, eax
cmp byte [esi + 4], 0
je 0x47abaa
mov byte [esi + 5], 1
mov eax, dword [esi + 0x10]
mov dword [esp + 4], eax
mov byte [esp + 8], 0
lea edx, [esp + 4]
xor ecx, ecx
mov eax, 0x47abb8
call fcn.004799a8
mov eax, dword [esi + 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x47ab28
mov eax, 0x47abec
call fcn.00479788
push 1
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_TerminateProcess
push 0x2710
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x47ab13
push esp
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
je 0x47ab7b
cmp dword [esp], 0
jne 0x47ab5d
mov eax, 0x47ac1c
call fcn.00479788
jmp 0x47ab85
mov eax, dword [esp]
mov dword [esp + 4], eax
mov byte [esp + 8], 0
lea edx, [esp + 4]
xor ecx, ecx
mov eax, 0x47ac3c
call fcn.004799a8
jmp 0x47ab85
mov eax, 0x47ac74
call fcn.00479788
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [esi + 8], eax
xor eax, eax
mov dword [esi + 0x10], eax
mov byte [esi + 4], 0
test bl, bl
je 0x47abaa
push 0xfa
call sub.kernel32.dll_Sleep
add esp, 0xc
pop esi
pop ebx
ret
Function at 0x47aca8
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47aee6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
inc dword [eax + 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
mov ebx, dword [ebp - 4]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x24], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x28], ecx
xor eax, eax
lea ebx, [eax + 0xc]
add ebx, ecx
xor edx, edx
push ebp
push 0x47ae8b
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
push 0xffffffffffffffff
push 0
call sub.kernel32.dll_CreateEventA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x47ad1d
mov eax, 0x47af00
call fcn.00475364
xor edx, edx
push ebp
push 0x47ae20
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x14
call fcn.00402acc
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 8]
push eax
push 0x14
mov eax, dword [ebp - 4]
add eax, 0x4034
push eax
push ebx
mov eax, dword [ebp - 4]
add eax, 0x20
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_TransactNamedPipe
test eax, eax
jne 0x47ae09
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x3e5
je 0x47ad85
mov eax, 0x47af14
call fcn.00475364
xor edx, edx
push ebp
push 0x47adf2
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [ebp + 8], 0
je 0x47adc5
mov eax, dword [ebp - 4]
cmp word [eax + 0x1a], 0
je 0x47adc5
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x1c]
call dword [ebx + 0x18]
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xc]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x47ada3
pop dword fs:[0]
add esp, 8
push 0x47adf9
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_GetOverlappedResult
mov ebx, eax
call sub.kernel32.dll_GetLastError_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47ae27
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
Function at 0x47e8b8
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffe08
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x11f4], ebx
mov dword [ebp - 0x11f8], ebx
mov dword [ebp - 0x11ec], ebx
mov dword [ebp - 0x11f0], ebx
mov dword [ebp - 0x11e8], ebx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x11cc], edx
mov dword [ebp - 0x11d0], eax
lea esi, [ebp - 0x11de]
lea edi, [ebp - 0x11d0]
xor eax, eax
push ebp
push 0x47eab3
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x11d4], eax
xor eax, eax
mov dword [ebp - 0x11c8], eax
mov eax, dword [edi]
add eax, 0x10
push eax
lea ecx, [ebp - 0x11c4]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x11cc]
call fcn.0047bd50
cmp dword [ebp - 0x1084], 0x30
jle 0x47e96e
lea ecx, [ebp - 0x11e8]
mov edx, dword [ebp - 4]
mov al, 0xb7
call fcn.004731d0
mov ecx, dword [ebp - 0x11e8]
mov dl, 1
mov eax, dword [0x408a18]
call fcn.0040c3f4
call fcn.00403588
lea eax, [ebp - 0x11f0]
lea edx, [ebp - 0x1184]
mov ecx, 0x80
call fcn.00403ce8
mov edx, dword [ebp - 0x11f0]
lea ecx, [ebp - 0x11ec]
mov eax, dword [edi]
mov eax, dword [eax]
call fcn.0047e2d4
mov edx, dword [ebp - 0x11ec]
mov eax, dword [edi]
add eax, 0x14
call fcn.00403b0c
lea eax, [ebp - 0x11f8]
lea edx, [ebp - 0x1104]
mov ecx, 0x80
call fcn.00403ce8
mov edx, dword [ebp - 0x11f8]
lea ecx, [ebp - 0x11f4]
mov eax, dword [edi]
mov eax, dword [eax]
call fcn.0047e2d4
mov edx, dword [ebp - 0x11f4]
mov eax, dword [edi]
add eax, 0x18
call fcn.00403b0c
lea eax, [ebp - 0x1078]
mov al, byte [eax]
mov edx, dword [edi]
mov byte [edx + 0x1d], al
mov ebx, dword [ebp - 0x1080]
test ebx, ebx
jle 0x47ea95
push ebp
mov eax, esi
mov edx, 0xa
call fcn.0047e840
pop ecx
mov eax, dword [esi + 6]
push eax
mov eax, dword [edi]
mov eax, dword [eax]
mov ecx, dword [esi + 2]
mov dx, word [esi]
call fcn.0047c360
mov dword [ebp - 0x11e4], eax
cmp dword [ebp - 0x11e4], 0
jne 0x47ea36
push ebp
call fcn.0047e69c
pop ecx
xor eax, eax
push ebp
push 0x47ea67
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
mov eax, dword [ebp - 0x11e4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 0x11e4]
add eax, 0x12
call fcn.0047e840
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47ea81
mov edx, dword [ebp - 0x11e4]
mov eax, dword [edi]
call fcn.0047c39c
dec ebx
jne 0x47e9ff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47eaba
lea eax, [ebp - 0x11f8]
mov edx, 5
call fcn.00403adc
ret
Function at 0x484fe8
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
push ebx
xor edx, edx
mov dword [ebp - 0x14c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4850ba
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea eax, [ebp - 0x148]
push eax
lea edx, [ebp - 0x14c]
mov eax, ebx
call fcn.0044bec0
lea eax, [ebp - 0x14c]
mov edx, 0x4850d4
call fcn.00403d40
mov eax, dword [ebp - 0x14c]
call fcn.00403efc
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x4850a1
xor eax, eax
push ebp
push 0x48509a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x148]
call fcn.00484f9c
test al, al
je 0x48506f
mov byte [ebp - 1], 1
jmp 0x485083
lea eax, [ebp - 0x148]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x48505a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4850a1
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindClose_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4850c1
lea eax, [ebp - 0x14c]
call fcn.00403ab8
ret

Function at 0x4850d8
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffea0
mov ebx, edx
mov esi, eax
push 0x200
push 0x160
lea eax, [esp + 8]
push eax
push 0
mov eax, esi
call fcn.00403efc
push eax
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x485118
mov eax, ebx
lea edx, [esp + 0xc]
mov ecx, 0x104
call fcn.00403ce8
jmp 0x48511f
mov eax, ebx
call fcn.00403ab8
add esp, 0x160
pop esi
pop ebx
ret

Function at 0x485128
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffea0
mov ebx, edx
mov esi, eax
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x4be124]
or eax, 0x4001
push eax
push 0x160
lea eax, [esp + 8]
push eax
push 0
mov eax, esi
call fcn.00403efc
push eax
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x485168
mov eax, dword [esp + 4]
jmp 0x48516a
xor eax, eax
add esp, 0x160
pop esi
pop ebx
ret

Function at 0x485174
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffea0
mov ebx, eax
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x4be12c]
or eax, 0x4011
push eax
push 0x160
lea eax, [esp + 8]
push eax
push 0x10
push 0x4851b8
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x4851ae
mov eax, dword [esp + 4]
jmp 0x4851b0
xor eax, eax
add esp, 0x160
pop ebx
ret
Function at 0x485480
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebx
add esp, 0xfffffff0
call sub.kernel32.dll_GetVersion
mov edx, eax
and dx, 0xff
cmp dx, 5
jne 0x485507
shr ax, 8
cmp ax, 1
jb 0x485507
mov bl, 1
push esp
push 1
push 0
push 0x485510
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x485509
mov dword [esp + 0xc], 4
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
push 0
push 0x48554c
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4854fc
cmp dword [esp + 4], 4
jne 0x4854fc
cmp dword [esp + 0xc], 4
jne 0x4854fc
cmp dword [esp + 8], 0
setne bl
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x485509
xor ebx, ebx
mov eax, ebx
add esp, 0x10
pop ebx
ret

Function at 0x48557c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
test dl, dl
je 0x485590
add esp, 0xfffffff0
call fcn.00403130
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.0042f0fc
mov eax, dword [0x485634]
not eax
and eax, dword [esi + 0x40]
mov dword [esi + 0x40], eax
mov edx, 0x79
mov eax, esi
call fcn.0042c7d4
mov edx, 0x61
mov eax, esi
call fcn.0042c7f4
xor edx, edx
mov eax, esi
call fcn.0042d120
mov dl, 1
mov eax, esi
call fcn.004332bc
call sub.kernel32.dll_GetVersion
and eax, 0xff
cmp ax, 6
jae 0x4855ef
mov dx, 0xfffe
mov eax, esi
call fcn.0042d160
push 0
lea eax, [ebp - 0x3c]
push eax
push 0x3c
push 0x1f
call sub.user32.dll_SystemParametersInfoA
test eax, eax
je 0x485615
lea eax, [ebp - 0x3c]
push eax
call sub.gdi32.dll_CreateFontIndirectA
mov edx, eax
mov eax, dword [esi + 0x58]
call fcn.0041849c
mov eax, esi
test bl, bl
je 0x48562a
call fcn.00403188
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x485638
Capabilities:
Check os version

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
call sub.comctl32.dll_InitCommonControls
mov edx, edi
mov eax, esi
call fcn.00430154
mov ecx, 0x4856c8
mov edx, edi
mov eax, esi
call fcn.00430080
mov eax, dword [edi + 4]
or eax, 0x2000000
or eax, 0x4000000
or eax, 4
or eax, 1
or eax, 0x20
or eax, 8
mov dword [edi + 4], eax
call fcn.00485480
mov ebx, eax
mov byte [esi + 0x1f8], bl
test bl, bl
je 0x48569a
mov eax, dword [edi + 4]
or eax, 0x200
or eax, 0x400
mov dword [edi + 4], eax
jmp 0x4856b7
call sub.kernel32.dll_GetVersion
and eax, 0xff
cmp ax, 6
jb 0x4856b3
or dword [edi + 4], 0x200
jmp 0x4856b7
or dword [edi + 4], 2
or dword [edi + 8], 0x200
and dword [edi + 0x24], 0xfffffffc
pop edi
pop esi
pop ebx
ret
Function at 0x4864b0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
xor eax, eax
push ebp
push 0x486575
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetLogicalDrives
mov esi, eax
mov bl, 0x41
test esi, 1
jne 0x4864e6
mov eax, ebx
call fcn.004851c8
test al, al
je 0x48654e
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403c60
lea eax, [ebp - 8]
mov edx, 0x48658c
call fcn.00403d40
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.004850d8
mov eax, dword [ebp - 4]
push eax
push 0
lea eax, [ebp - 0x10]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x10]
lea eax, [ebp - 0x14]
call fcn.0040298c
mov edx, 0x486590
lea eax, [ebp - 0x14]
mov cl, 2
call fcn.0040295c
lea edx, [ebp - 0x14]
lea eax, [ebp - 0xc]
call fcn.00403cdc
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
xor edx, edx
call fcn.0048600c
shr esi, 1
inc ebx
cmp bl, 0x5b
jne 0x4864d3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48657c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403adc
ret
Function at 0x486594
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x15c], ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x158], ecx
mov dword [ebp - 0x154], ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x48675c
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x48672f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00403d38
cmp eax, 3
jne 0x48662b
mov eax, ebx
call fcn.004853d0
test al, al
jne 0x48660b
mov byte [ebp - 1], 0
call fcn.00403628
jmp 0x486736
lea edx, [ebp - 0x154]
mov eax, ebx
call fcn.004850d8
mov ecx, dword [ebp - 0x154]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, esi
call fcn.00486994
mov byte [ebp - 1], 1
lea eax, [ebp - 0x150]
push eax
lea edx, [ebp - 0x158]
mov eax, ebx
call fcn.0044bec0
lea eax, [ebp - 0x158]
mov edx, 0x486774
call fcn.00403d40
mov eax, dword [ebp - 0x158]
call fcn.00403efc
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x486718
xor eax, eax
push ebp
push 0x486711
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x150]
call fcn.00484f9c
test al, al
je 0x4866e6
lea eax, [ebp - 0x10]
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.00403ce8
lea edx, [ebp - 0x160]
mov eax, ebx
call fcn.0044bec0
lea eax, [ebp - 0x160]
mov edx, dword [ebp - 0x10]
call fcn.00403d40
mov eax, dword [ebp - 0x160]
lea edx, [ebp - 0x15c]
call fcn.004850d8
mov eax, dword [ebp - 0x15c]
push eax
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 0x10]
mov edx, esi
call fcn.0048600c
lea eax, [ebp - 0x150]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x48667f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x486718
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FindClose_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x486736
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetErrorMode
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x486763
lea eax, [ebp - 0x160]
mov edx, 4
call fcn.00403adc
lea eax, [ebp - 0x10]
call fcn.00403ab8
ret