joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45bf34
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
lea eax, [ebp - 4]
push eax
xor edi, edi
push 0x28
mov dword [ebp - 4], edi
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x45bfaa
lea eax, [ebp - 0x10]
push eax
push str.SeShutdownPrivilege
push edi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x45bfaa
push edi
push edi
push edi
lea eax, [ebp - 0x14]
push eax
push edi
push dword [ebp - 4]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x45bfaa
push 0x40000
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
cmp eax, 1
jne 0x45bfaa
inc ebx
cmp dword [ebp - 4], edi
je 0x45bfb8
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, ebx
pop ebx
leave
ret

Function at 0x45c08a
Capabilities:
Create thread
Terminate thread

Disassembly:
push esi
push edi
mov esi, eax
push 0xffffffffffffffff
call fcn.004577f4
mov eax, dword [esi]
xor edi, edi
cmp eax, edi
je 0x45c0af
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], edi
mov eax, dword [esp + 0xc]
mov dword [esi + 8], eax
lea eax, [esi + 0xc]
push eax
push edi
push esi
push 0x457817
push edi
push edi
mov dword [esi + 4], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
cmp eax, edi
setne cl
mov dword [esi], eax
pop edi
pop esi
mov eax, ecx
ret 4

Function at 0x45c81e
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4aa8c1
call fcn.004a8204
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea eax, [ebx + 4]
push eax
mov dword [ebx], vtable.CSinglerReport.0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor esi, esi
mov dword [ebp - 4], esi
or dword [ebx + 0x30], 0xffffffff
mov dword [ebx + 0x24], esi
mov dword [ebx + 0x28], esi
mov dword [ebx + 0x2c], esi
lea edi, [ebx + 0x34]
call fcn.00456754
lea eax, [ebx + 0x94]
mov byte [ebp - 4], 2
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov dword [eax + 0xc], esi
lea esi, [ebx + 0xbc]
mov ecx, 0x4db1bc
call fcn.00405e9a
and dword [ebx + 0x1c], 0
and dword [ebx + 0x20], 0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x45cf0b
Capabilities:
Accept command line arguments

Disassembly:
mov eax, 0x4aa0a9
call fcn.004a8204
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
call fcn.00406156
pop ecx
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
jne 0x45cf3c
add eax, 0xfffffff0
call fcn.00405bdc
jmp 0x45d04a
push esi
push 0x5c
lea esi, [ebp - 0x10]
call fcn.0040674f
cmp eax, 0xffffffff
jne 0x45cf5c
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00405bdc
jmp 0x45d049
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx - 0xc]
sub ecx, eax
push ebx
lea eax, [ebp - 0x18]
push eax
dec ecx
lea eax, [ebp - 0x10]
call fcn.00406809
mov byte [ebp - 4], 1
mov ebx, dword [ebp - 0x18]
cmp dword [ebx - 0xc], 0
je 0x45cf93
push str..exe
xor ecx, ecx
lea esi, [ebp - 0x18]
call fcn.00409405
cmp eax, 0xffffffff
jne 0x45cfab
lea eax, [ebx - 0x10]
call fcn.00405bdc
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00405bdc
jmp 0x45d048
mov ecx, eax
push edi
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x18]
call fcn.00406859
mov byte [ebp - 4], 2
mov edi, dword [ebp + 8]
call fcn.0040520c
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.00405bdc
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00405e57
push str..exe
xor ecx, ecx
lea esi, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.00409405
cmp eax, 0xffffffff
je 0x45d029
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx - 0xc]
sub ecx, eax
lea eax, [ebp + 8]
push eax
sub ecx, 5
mov eax, esi
call fcn.00406809
mov edi, dword [ebp + 0xc]
mov byte [ebp - 4], 4
call fcn.0040520c
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.00405bdc
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00405bdc
lea eax, [ebx - 0x10]
call fcn.00405bdc
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00405bdc
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 8

Function at 0x45dad9
Capabilities:
Create process on windows

Disassembly:
mov ecx, dword [eax + 8]
push esi
xor esi, esi
inc esi
cmp ecx, esi
jne 0x45db36
mov eax, dword [eax + 0xc]
cmp eax, esi
jne 0x45daf5
push edi
call fcn.0045dc85
mov eax, esi
pop esi
ret
cmp eax, 0x64
jne 0x45db12
push esi
xor eax, eax
push eax
push eax
push 0x4befe8
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x45daf1
cmp eax, 0x65
jne 0x45db28
call fcn.0045d0e9
push 2
pop ecx
mov eax, edi
call fcn.0042f855
jmp 0x45daf1
cmp eax, 0x66
jne 0x45db36
call fcn.0045d0e9
push 3
jmp 0x45db1e
and dword [edi + 0x504], 0
xor eax, eax
pop esi
ret
Function at 0x45ecec
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, 0x4ace9f
call fcn.004a8204
sub esp, 0x21c
mov eax, dword [0x4db1bc]
push ebx
push esi
push edi
mov ecx, 0x4db1bc
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
xor ebx, ebx
push 0x206
lea eax, [ebp - 0x226]
push ebx
mov dword [ebp - 4], ebx
push eax
mov word [ebp - 0x228], bx
call fcn.0047a1f0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x228]
push eax
push 0x400000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00406072
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00406072
push 0x2e
lea esi, [ebp - 0x10]
call fcn.0040674f
cmp eax, 0xffffffff
je 0x45eda1
mov ecx, eax
lea edx, [ebp - 0x14]
mov eax, esi
call fcn.00406859
mov edi, esi
mov byte [ebp - 4], 1
call fcn.0040520c
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00405bdc
mov eax, dword [0x4db1bc]
mov ecx, 0x4db1bc
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
mov byte [ebp - 4], 2
fld1
lea eax, [ebp - 0x10]
fstp qword [ebp - 0x20]
push eax
call fcn.0045e9ec
test eax, eax
jne 0x45edfe
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00405bdc
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00405bdc
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0xc
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
jne 0x45ee39
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00405bdc
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00405bdc
mov eax, ebx
jmp 0x45eded
push ebx
push eax
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, ebx
je 0x45eea1
mov esi, dword [ebp + 0xc]
push ebx
lea eax, [ebp - 0x14]
push eax
push edi
lea eax, [edi + 0xa]
push eax
mov dword [ebp - 0x14], ebx
call fcn.00408708
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
cmp esi, ebx
je 0x45ee97
cmp dword [ebp - 0x14], edi
jne 0x45ee97
mov eax, dword [ebp + 0x10]
cmp eax, ebx
je 0x45ee7f
fld qword [ebp - 0x20]
fstp qword [eax]
mov esi, dword [ebp + 0xc]
mov eax, edi
call fcn.00409be2
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
inc ebx
jmp 0x45ee1f
mov edx, dword [ebp + 0xc]
xor eax, eax
call fcn.0040872e
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, esi
jmp 0x45ee1f
Function at 0x461621
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4aa06d
call fcn.004a8204
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [esi + 4], edi
mov dword [ebp - 4], edi
fld1
fstp qword [esi + 0x10]
mov dword [esi], vtable.CBkPngSkin.0
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x4c], edi
mov eax, vtable.CBkBitmap.0
mov dword [esi + 0x48], eax
mov dword [esi + 0x58], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x60], eax
mov dword [esi + 0x70], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov byte [ebp - 4], 2
mov dword [esi + 0x74], edi
mov dword [esi + 0x78], edi
call fcn.0046d30d
lea ecx, [esi + 0x80]
mov dword [ecx], eax
mov byte [eax + 0x15], 1
mov eax, dword [ecx]
mov dword [eax + 4], eax
mov eax, dword [ecx]
mov dword [eax], eax
mov ecx, dword [ecx]
mov dword [ecx + 8], ecx
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x84], edi
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x464fb7
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
xor edi, edi
mov esi, ecx
mov ecx, dword [eax + 8]
inc edi
cmp ecx, edi
jne 0x4650b2
mov eax, dword [eax + 0xc]
cmp eax, edi
jne 0x464fdf
mov ecx, esi
call fcn.004676ea
mov eax, edi
jmp 0x4650bb
cmp eax, 2
jne 0x464ff1
push 6
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x464fd8
cmp eax, 0x65
jne 0x464fff
mov eax, esi
call fcn.00467d40
jmp 0x464fd8
cmp eax, 0x6c
jne 0x46500b
call fcn.00467df0
jmp 0x464fd8
cmp eax, 0x66
jne 0x465023
xor eax, eax
cmp dword [esi + 0x510], eax
sete al
push eax
call fcn.00468ae4
jmp 0x464fd8
cmp eax, 0x191
jne 0x465032
push edi
call fcn.00468149
jmp 0x464fd8
cmp eax, 0x96
jne 0x465057
lea eax, [esi + 0x5a8]
lea ecx, [esi + 0x558]
call fcn.0046e792
xor eax, eax
push eax
push eax
mov eax, esi
call fcn.00467651
jmp 0x464fd8
cmp eax, 0x1f5
jne 0x46506c
xor ecx, ecx
mov eax, esi
call fcn.0042f855
jmp 0x464fd8
cmp eax, 0x3e9
jne 0x46508e
push edi
xor eax, eax
push eax
push eax
push str.https:__sysrepair.imeitools.com_license_userAgreement.html
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x464fd8
cmp eax, 0x3ea
jne 0x4650a1
push edi
xor eax, eax
push eax
push eax
push 0x4befe8
jmp 0x46507d
cmp eax, 0x68
jne 0x4650b2
mov ebx, esi
call fcn.0046872b
jmp 0x464fd8
and dword [esi + 0x5b8], 0
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x465358
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
push dword [ebp + 8]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x4653cf
xor eax, eax
mov dword [ebp - 0xc], esi
lea edi, [ebp - 8]
stosd dword es:[edi], eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x4653cf
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
shrd ecx, eax, 0x14
shr eax, 0x14
mov dword [ebp - 8], eax
and dword [ebp - 8], 0x80000000
and eax, 0x7fffffff
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], esi
fild qword [ebp - 0x14]
fild qword [ebp - 0xc]
fchs
faddp st(1)
fmul qword [0x4c0d60]
fcomp qword [0x4c0d58]
fnstsw ax
test ah, 1
jne 0x4653cf
inc esi
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x465e49
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x4aacb0
call fcn.004a8204
sub esp, 0x5c
mov eax, dword [0x4db1bc]
push esi
push edi
mov ecx, 0x4db1bc
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push str._stop__uninstall
push dword [ebp + 8]
xor esi, esi
push 0x4be9b0
lea eax, [ebp - 0x10]
mov dword [ebp - 4], esi
call fcn.00406b6d
push 0x40
lea eax, [ebp - 0x64]
push esi
push eax
call fcn.0047a1f0
xor eax, eax
mov dword [ebp - 0x24], esi
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
add esp, 0x18
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp - 0x10]
mov dword [ebp - 0x68], 0x44
push esi
mov dword [ebp - 0x3c], 1
mov word [ebp - 0x38], si
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x24]
cmp eax, esi
je 0x465eec
cmp dword [ebp - 0x14], esi
je 0x465ee6
cmp ebx, esi
je 0x465ee6
mov dword [ebx], eax
jmp 0x465eec
push eax
call edi
mov dword [ebp - 0x24], esi
cmp dword [ebp - 0x20], esi
je 0x465ef9
push dword [ebp - 0x20]
call edi
mov dword [ebp - 0x20], esi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00405bdc
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x465f15
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x4ad0e1
call fcn.004a8204
sub esp, 0x218
push ebx
push esi
push edi
xor ebx, ebx
push 0x206
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x222]
push ebx
mov dword [ebp - 0x18], ebx
push eax
mov word [ebp - 0x224], bx
call fcn.0047a1f0
mov esi, dword [ebp + 8]
mov edi, 0x4db1bc
add esp, 0xc
mov ecx, edi
call fcn.00405e9a
mov dword [ebp - 4], ebx
mov eax, dword [0x4db1bc]
xor esi, esi
inc esi
mov ecx, edi
mov dword [ebp - 0x18], esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 4], esi
call fcn.00405e57
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], ebx
jne 0x465f97
lea ecx, [ebp - 0x10]
call fcn.00435eb4
lea eax, [ebp - 0x1c]
push str.data_baseconfig.dat
push eax
lea ecx, [ebp - 0x10]
call fcn.00409436
pop ecx
pop ecx
lea edi, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.0040520c
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.00405bdc
mov esi, dword [ebp - 0x14]
push esi
push 0x208
lea eax, [ebp - 0x224]
push eax
push 0x4b9580
push str.TryNo
push 0x4be4e4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x465ffd
lea eax, [ebp - 0x224]
push eax
push dword [ebp + 8]
call fcn.00406072
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00405bdc
lea eax, [esi - 0x10]
call fcn.00405bdc
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x466501
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [edi + 0x5b0], 0
jne 0x46653d
push esi
lea esi, [ebp - 4]
call fcn.00466545
push dword [eax]
push 2
push 0x4b9c38
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [edi + 0x5b0], eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00405bdc
pop esi
mov eax, dword [edi + 0x5b0]
leave
ret
Function at 0x466a12
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4aa58c
call fcn.004a8204
sub esp, 0xc
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], edi
call fcn.004770bd
lea esi, [ebp - 0x14]
call fcn.00477108
mov eax, dword [eax]
push 1
push eax
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [ebp - 0x10]
call fcn.0045662f
mov ebx, eax
mov eax, dword [ebp - 0x14]
neg ebx
sbb bl, bl
add eax, 0xfffffff0
inc bl
call fcn.00405bdc
test bl, bl
jne 0x466b4f
mov eax, dword [0x4db1bc]
mov ecx, 0x4db1bc
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push str.installpath
mov eax, esi
push eax
mov byte [ebp - 4], 1
call fcn.004060a5
test eax, eax
mov ebx, dword [ebp - 0x14]
je 0x466b47
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x466b47
mov esi, dword [ebp + 8]
lea edi, [esi + 0x5a8]
lea eax, [ebp - 0x14]
call fcn.0040520c
xor edi, edi
inc edi
mov eax, esi
mov dword [esi + 0x9bc], edi
call fcn.0046925d
test eax, eax
je 0x466ae6
lea eax, [ebx - 0x10]
call fcn.00405bdc
cmp dword [ebp - 0x10], 0
je 0x466ae2
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x466b60
call fcn.0045d0e9
push 3
mov ecx, esi
call fcn.00469a46
cmp eax, edi
jne 0x466aff
call fcn.0045d0e9
jmp 0x466acb
cmp eax, 2
je 0x466b08
test eax, eax
jne 0x466b0d
call fcn.0045d0e9
call fcn.0045d0e9
mov edx, eax
push 0
mov eax, esi
call fcn.0046925d
push eax
push dword [esi + 0x9bc]
push 3
push edx
call fcn.0045c896
lea eax, [ebx - 0x10]
call fcn.00405bdc
cmp dword [ebp - 0x10], 0
je 0x466b43
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x466b60
lea eax, [ebx - 0x10]
call fcn.00405bdc
cmp dword [ebp - 0x10], edi
je 0x466b5d
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
Function at 0x4671b0
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4ad24c
call fcn.004a8204
sub esp, 0x1c
mov eax, dword [0x4db1bc]
push ebx
push esi
push edi
mov ecx, 0x4db1bc
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push str._x_
lea eax, [ebp - 0x14]
call fcn.00406b6d
pop ecx
pop ecx
lea eax, [ebp - 0x1c]
push eax
call fcn.00466f87
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x18]
push ecx
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.00406895
pop ecx
pop ecx
mov byte [ebp - 4], 2
mov esi, dword [ebp + 8]
lea edi, [esi + 0x5dc]
mov dword [ebp - 0x10], edi
call fcn.0040520c
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00405bdc
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.00405bdc
add esi, 0x5bc
call fcn.004760b3
test eax, eax
je 0x46733f
cmp dword [esi + 8], 0x100000
jb 0x46733f
call fcn.00476162
test eax, eax
jne 0x467272
mov ebx, esi
call fcn.004761ba
test eax, eax
je 0x46733f
push dword [edi]
mov ecx, esi
push 0
call fcn.00475f15
lea eax, [ebp - 0x18]
push 0x4b9484
push eax
mov ecx, edi
call fcn.00409436
lea ecx, [ebp - 0x1c]
push 0x4db5f0
push ecx
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.00406895
add esp, 0x10
push eax
push ecx
mov byte [ebp - 4], 4
call fcn.004770bd
pop ecx
mov ecx, eax
call fcn.0047713a
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.00405bdc
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00405bdc
push dword [edi]
lea eax, [ebp - 0x28]
push eax
call fcn.00465f15
pop ecx
pop ecx
mov byte [ebp - 4], 5
mov esi, dword [eax]
call fcn.004770bd
mov ebx, dword [eax + 0x14]
call fcn.004770bd
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x1c], eax
call fcn.004770bd
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x18], eax
call fcn.004770bd
mov eax, dword [eax + 8]
mov dword [ebp - 0x20], eax
call fcn.004770bd
mov eax, dword [eax + 4]
push esi
push ebx
push dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
push dword [ebp - 0x18]
push dword [ebp - 0x20]
call fcn.0045d0e9
mov ecx, dword [ebp - 0x24]
call fcn.0045cba4
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x28]
add eax, 0xfffffff0
call fcn.00405bdc
call fcn.00473b49
mov ecx, edi
mov edx, eax
call fcn.00473b8b
mov ebx, dword [ebp + 8]
call fcn.0046914b
mov edi, ebx
push edi
call fcn.004692fe
call fcn.004668ea
push edi
call fcn.0046704d
mov ecx, dword [ebp - 0x10]
lea eax, [ebp + 8]
push str._res
push eax
call fcn.00409436
pop ecx
pop ecx
mov byte [ebp - 4], 6
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4673a6
push dword [ebp + 8]
call fcn.0040e83f
push eax
call fcn.00406072
call fcn.0040ed9d
mov ebx, eax
call fcn.0040edc8
call fcn.004648ec
call fcn.00464c30
call fcn.00464dba
mov byte [ebp - 4], 0
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.00405bdc
push edi
call fcn.00468d42
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00405bdc
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
Function at 0x4673e6
Capabilities:
Inspect load icon resource

Disassembly:
push ecx
push ecx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_LoadIconW]
push edi
push 0xc8
push 0x400000
call esi
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
push eax
push 1
push 0x80
lea edi, [ebx + 4]
push dword [edi]
call ebp
push 0xc8
push 0x400000
call esi
push eax
push 0
push 0x80
push dword [edi]
call ebp
push dword [ebx + 0x9b4]
push dword [edi]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, dword [edi]
push edi
call fcn.0043546a
lea esi, [ebx + 0x24]
lea eax, [esi - 0x24]
neg esi
sbb esi, esi
and esi, eax
push 0xa1
call fcn.0042f6b5
mov ebp, eax
test ebp, ebp
je 0x467471
mov eax, dword [ebp]
push 0
push 4
mov ecx, ebp
call dword [eax + 0x28]
push 1
push ebp
push esi
call fcn.004302ff
push 0
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
call fcn.0046666f
push dword [eax]
push dword [edi]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
call fcn.00405bdc
mov eax, 0x24f
cmp dword [ebx + 0x9b8], eax
je 0x4674aa
cmp dword [ebx + 0xb0c], eax
jne 0x4674b1
and dword [ebx + 0x428], 0
push 0
push 0
push 0x474
push dword [edi]
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
xor eax, eax
pop ebp
pop ecx
pop ecx
ret
Function at 0x467d40
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, eax
push edi
lea ebp, [esi + 0x24]
push 0xa1
mov eax, ebp
call fcn.0046a218
test eax, eax
je 0x467d66
mov eax, ebp
call fcn.0046a1a1
mov dword [0x4d67bc], eax
xor ebx, ebx
cmp dword [0x4d67bc], ebx
jne 0x467d7b
push esi
call fcn.004690c3
mov dword [0x4d67bc], eax
push ebx
push 0xc
mov eax, ebp
call fcn.0042fa55
mov edi, dword [sym.imp.USER32.dll_SetTimer]
push ebx
push 0x32
push 0x3eb
push dword [esi + 4]
call edi
push ebx
push 0x50
push 0x3ed
push dword [esi + 4]
call edi
push ebx
push 0x1e
push 1
push dword [esi + 4]
call edi
push ebx
push 0x64
mov eax, ebp
call fcn.0042fa55
push 1
push 0xc8
mov eax, ebp
call fcn.0042fa55
push ebx
call fcn.00468ae4
push ebx
push ebx
push esi
push 0x467d26
push ebx
push ebx
call fcn.0047ed0f
add esp, 0x18
mov dword [esi + 0x9b0], eax
call fcn.0045d0e9
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x468663
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push dword [edi]
lea esi, [ebp - 4]
call fcn.0045b200
mov eax, dword [ebp - 4]
pop ecx
add eax, 0xfffffff0
call fcn.00405bdc
mov eax, dword [edi]
push 3
pop esi
cmp dword [eax - 0xc], esi
jl 0x468724
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4686a6
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 1
je 0x468724
mov ecx, esi
lea edx, [ebp - 4]
mov eax, edi
call fcn.00406859
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, esi
mov eax, dword [ebp - 4]
setne bl
add eax, 0xfffffff0
call fcn.00405bdc
test bl, bl
je 0x4686d3
push 2
pop eax
jmp 0x468727
push edi
call fcn.004685d7
test eax, eax
pop ecx
je 0x4686e2
mov eax, esi
jmp 0x468727
mov ecx, esi
lea edx, [ebp - 4]
mov eax, edi
call fcn.00406859
push dword [eax]
call fcn.00465358
mov ebx, eax
mov eax, dword [ebp - 4]
neg ebx
sbb bl, bl
pop ecx
add eax, 0xfffffff0
inc bl
call fcn.00405bdc
test bl, bl
je 0x468711
push 4
jmp 0x4686d0
mov eax, dword [edi]
cmp dword [eax - 0xc], 0x96
jle 0x468720
push 5
jmp 0x4686d0
xor eax, eax
jmp 0x468727
xor eax, eax
inc eax
pop esi
pop ebx
leave
ret