joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a470
Capabilities:
Set current directory

Disassembly:
push 0xffffffffffffffff
push 0x4e00ca
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x630ddc]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x1c], esi
mov dword [esi], vtable.CBaseDlgPrinterSelectDirect.0
mov edi, dword [esi + 0x88]
cmp dword [esi + 0x84], edi
lea ebx, [esi + 0x80]
mov dword [esp + 0x28], 0xf
jbe 0x41a4c4
call fcn.004b83f7
mov ebp, dword [ebx + 4]
cmp ebp, dword [ebx + 8]
jbe 0x41a4d1
call fcn.004b83f7
push edi
push ebx
push ebp
push ebx
lea eax, [esp + 0x24]
push eax
mov ecx, ebx
call fcn.00413ec0
mov eax, dword [esi + 0x51c]
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
je 0x41a4f4
push eax
call edi
mov eax, dword [esi + 0x520]
test eax, eax
je 0x41a501
push eax
call edi
lea ecx, [esi + 0x524]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [esi + 0x74]
test ecx, ecx
je 0x41a51e
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push 1
call eax
mov ecx, dword [esi + 0x634]
test ecx, ecx
je 0x41a53b
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push 1
call eax
mov dword [esi + 0x634], 0
mov ebp, dword [esi + 0x98]
cmp dword [esi + 0x94], ebp
lea edi, [esi + 0x90]
jbe 0x41a554
call fcn.004b83f7
mov eax, dword [edi + 4]
cmp eax, dword [edi + 8]
mov dword [esp + 0x14], eax
jbe 0x41a569
call fcn.004b83f7
mov eax, dword [esp + 0x14]
push ebp
push edi
push eax
push edi
lea ecx, [esp + 0x24]
push ecx
mov ecx, edi
call fcn.00413ec0
mov eax, dword [esi + 0x630]
xor ebp, ebp
cmp eax, ebp
je 0x41a58c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esi + 0x4c8]
mov dword [esi + 0x630], ebp
mov byte [esp + 0x28], 0xe
call fcn.004ae64f
lea ecx, [esi + 0x454]
mov byte [esp + 0x28], 0xd
call fcn.00496060
lea ecx, [esi + 0x400]
mov byte [esp + 0x28], 0xc
call fcn.004ae6a5
lea ecx, [esi + 0x3ac]
mov byte [esp + 0x28], 0xb
call fcn.004ae6a5
lea ecx, [esi + 0x358]
mov byte [esp + 0x28], 0xa
call fcn.004ae6a5
lea ecx, [esi + 0x304]
mov byte [esp + 0x28], 9
call fcn.004ae6a5
lea ecx, [esi + 0x2b0]
mov byte [esp + 0x28], 8
call fcn.004ae6a5
lea ecx, [esi + 0x254]
mov byte [esp + 0x28], 7
call fcn.004960e0
lea ecx, [esi + 0x1f8]
mov byte [esp + 0x28], 6
call fcn.004960e0
lea ecx, [esi + 0x1a0]
mov byte [esp + 0x28], 5
call fcn.004aee58
lea ecx, [esi + 0x148]
mov byte [esp + 0x28], 4
call fcn.004aec68
lea ecx, [esi + 0xf4]
mov byte [esp + 0x28], 3
call fcn.004aec68
lea ecx, [esi + 0xa0]
mov byte [esp + 0x28], 2
call fcn.004aec68
mov eax, dword [edi + 4]
cmp eax, ebp
je 0x41a672
push eax
call fcn.004a5792
add esp, 4
mov dword [edi + 4], ebp
mov dword [edi + 8], ebp
mov dword [edi + 0xc], ebp
mov eax, dword [ebx + 4]
cmp eax, ebp
je 0x41a68b
push eax
call fcn.004a5792
add esp, 4
mov ecx, esi
mov dword [ebx + 4], ebp
mov dword [ebx + 8], ebp
mov dword [ebx + 0xc], ebp
mov dword [esp + 0x28], 0xffffffff
call fcn.004af5c7
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x41b580
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e02fa
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x630ddc]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
push eax
push ecx
mov ecx, esi
call fcn.004af652
xor ebp, ebp
lea edi, [esi + 0x80]
mov dword [esi], vtable.CBaseDlgPrinterSelectDirect.0
mov dword [esp + 0x24], ebp
mov dword [edi + 4], ebp
mov dword [edi + 8], ebp
mov dword [edi + 0xc], ebp
lea ebx, [esi + 0x90]
mov dword [ebx + 4], ebp
mov dword [ebx + 8], ebp
mov dword [ebx + 0xc], ebp
lea ecx, [esi + 0xa0]
mov byte [esp + 0x24], 2
call fcn.004aa84b
mov dword [esi + 0xa0], vtable.CListCtrl.0
lea ecx, [esi + 0xf4]
mov byte [esp + 0x24], 3
call fcn.004aa84b
mov dword [esi + 0xf4], vtable.CListCtrl.0
lea ecx, [esi + 0x148]
mov byte [esp + 0x24], 4
call fcn.004aa84b
mov dword [esi + method.CListCtrl.virtual_0], vtable.CListCtrl.0
lea ecx, [esi + 0x1a0]
mov byte [esp + 0x24], 5
call fcn.004aa84b
mov dword [esi + method.CTabCtrl.virtual_0], vtable.CTabCtrl.0
lea ecx, [esi + 0x1f8]
mov byte [esp + 0x24], 6
call fcn.004960c0
lea ecx, [esi + 0x254]
mov byte [esp + 0x24], 7
call fcn.004960c0
lea ecx, [esi + 0x2b0]
mov byte [esp + 0x24], 8
call fcn.004aa84b
mov dword [esi + method.CButton.virtual_0], vtable.CButton.0
lea ecx, [esi + 0x304]
mov byte [esp + 0x24], 9
call fcn.004aa84b
mov dword [esi + method.CButton.virtual_0], vtable.CButton.0
lea ecx, [esi + 0x358]
mov byte [esp + 0x24], 0xa
call fcn.004aa84b
mov dword [esi + method.CButton.virtual_0], vtable.CButton.0
lea ecx, [esi + 0x3ac]
mov byte [esp + 0x24], 0xb
call fcn.004aa84b
mov dword [esi + method.CButton.virtual_0], vtable.CButton.0
lea ecx, [esi + 0x400]
mov byte [esp + 0x24], 0xc
call fcn.004aa84b
mov dword [esi + 0x400], 0x56b65c
lea ecx, [esi + 0x454]
mov byte [esp + 0x24], 0xd
call fcn.00496040
lea ecx, [esi + 0x4c8]
mov byte [esp + 0x24], 0xe
call fcn.004aa84b
mov dword [esi + 0x4c8], 0x56b984
mov byte [esp + 0x24], 0xf
call fcn.004a63de
call fcn.004a63de
mov eax, dword [eax + 0xc]
push 0xfa0
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov ecx, esi
mov dword [esi + 0x1f4], eax
call fcn.00416250
mov eax, dword [edi + 8]
cmp dword [edi + 4], eax
mov dword [esp + 0x2c], eax
jbe 0x41b758
call fcn.004b83f7
mov eax, dword [edi + 4]
cmp eax, dword [edi + 8]
mov dword [esp + 0x30], eax
jbe 0x41b76d
call fcn.004b83f7
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push edx
push edi
push eax
push edi
lea eax, [esp + 0x24]
push eax
mov ecx, edi
call fcn.00413ec0
mov dword [0x6322cc], ebp
mov dword [esi + 0x630], ebp
mov dword [esi + 0x634], ebp
mov dword [esi + 0x19c], ebp
mov edi, dword [ebx + 8]
cmp dword [ebx + 4], edi
jbe 0x41b7a6
call fcn.004b83f7
mov ebp, dword [ebx + 4]
cmp ebp, dword [ebx + 8]
jbe 0x41b7b3
call fcn.004b83f7
push edi
push ebx
push ebp
push ebx
lea ecx, [esp + 0x24]
push ecx
mov ecx, ebx
call fcn.00413ec0
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8
Function at 0x424505
Capabilities:
Copy file
Enumerate files on windows
Set file attributes

Disassembly:
sub esp, 0xf4c
mov eax, dword [0x630ddc]
xor eax, esp
mov dword [esp + 0xf48], eax
push ebx
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
push edi
call edx
mov edx, dword [eax]
mov edx, dword [edx + 0x18c]
lea ecx, [esp + 0xb54]
push ecx
push 0
mov ecx, eax
call edx
mov ecx, 0x6322f8
call fcn.00403df0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x28]
call eax
mov edx, dword [eax]
mov edx, dword [edx + 0xc]
lea ecx, [esp + 0x354]
push ecx
lea ecx, [esp + 0xb58]
push ecx
mov ecx, eax
call edx
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [esp + 0x354]
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x354]
sub ecx, 1
cmp byte [eax + ecx], 0x5c
je 0x424587
push 0x56f620
lea edx, [esp + 0x358]
push edx
call ebx
mov eax, dword [esi]
mov edx, dword [eax + 0xc]
mov ecx, esi
call edx
mov edx, dword [eax]
mov edx, dword [edx + 0x84]
lea ecx, [esp + 0x14c]
push ecx
mov ecx, eax
call edx
lea eax, [esp + 0x14c]
push eax
call edi
lea ecx, [esp + 0x14c]
sub ecx, 1
cmp byte [eax + ecx], 0x5c
je 0x4245cd
push 0x56f620
lea edx, [esp + 0x150]
push edx
call ebx
lea eax, [esp + 0x354]
push eax
push str._s.CAT
lea ecx, [esp + 0x75c]
push 0x400
push ecx
call fcn.004b7eb8
push 0x140
lea edx, [esp + 0x20]
push 0
push edx
call fcn.004b79d0
add esp, 0x1c
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x758]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4246b0
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ebx, dword [sym.imp.KERNEL32.dll_CopyFileA]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x35c]
push eax
push 0x56b394
lea ecx, [esp + 0x764]
push 0x400
push ecx
call fcn.004b7eb8
lea edx, [esp + 0x50]
push edx
lea eax, [esp + 0x168]
push eax
push 0x56b394
lea ecx, [esp + 0x274]
push 0x104
push ecx
call fcn.004b7eb8
add esp, 0x28
push 0x20
lea edx, [esp + 0x258]
push edx
call edi
push 0
lea eax, [esp + 0x258]
push eax
lea ecx, [esp + 0x760]
push ecx
call ebx
lea edx, [esp + 0x10]
push edx
push esi
call ebp
test eax, eax
jne 0x424631
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebp
mov ecx, dword [esp + 0xf54]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.004b6bdf
add esp, 0xf4c
ret
Function at 0x457b92
Capabilities:
Check if file exists
Delete file
Set file attributes

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x5c]
push edi
call edx
lea edi, [esi + 0x14]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
je 0x457bbf
push 0x20
push edi
call ebx
push edi
call ebp
lea edi, [esi + 0x118]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x457bd8
push 0x20
push edi
call ebx
push edi
call ebp
add esi, 0x21c
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x457bf1
push 0x20
push esi
call ebx
push esi
call ebp
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x461d94
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x84
mov eax, dword [0x630ddc]
xor eax, esp
mov dword [esp + 0x80], eax
push ebx
mov ebx, dword [esp + 0x90]
push ebp
mov ebp, dword [esp + 0x90]
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x14]
push edi
call edx
mov edi, dword [esp + 0xa0]
cmp edi, 5
mov byte [ebx], 0
ja 0x461ddd
cmp edi, 2
jae 0x461e0d
mov eax, edi
sub eax, 0
je 0x461e0d
sub eax, 1
jne 0x461de5
or eax, 0xffffffff
mov ecx, dword [esp + 0x90]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004b6bdf
add esp, 0x84
ret 0xc
cmp edi, 0x400
je 0x461e0d
mov ecx, 0x6322f8
call fcn.00403e00
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
mov edx, dword [eax]
mov edx, dword [edx + 0x3c]
push str.Driver
lea ecx, [esp + 0x14]
push ecx
mov ecx, eax
call edx
jmp 0x461e39
mov ecx, 0x6322f8
call fcn.00403e00
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
mov edx, dword [eax]
mov edx, dword [edx + 0x9c]
push 0x40
push edi
push str.Driver
lea ecx, [esp + 0x1c]
push ecx
mov ecx, eax
call edx
add esi, 4
push esi
push 0x40
lea eax, [esp + 0x58]
push eax
push 0x56ab79
push ebp
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jle 0x461dbf
lea edx, [esp + 0x51]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
movsx eax, byte [esp + 0x50]
push eax
call fcn.004bab00
xor ecx, ecx
add esp, 4
cmp eax, 0x50
setne cl
mov eax, ecx
jmp 0x461dc2

Function at 0x461e9e
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x44
mov eax, dword [0x630ddc]
xor eax, esp
mov dword [esp + 0x40], eax
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x14]
push edi
mov edi, dword [esp + 0x50]
call edx
mov ecx, 0x6322f8
call fcn.00403e00
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
mov edx, dword [eax]
mov edx, dword [edx + 0x3c]
push str.Version
lea ecx, [esp + 0xc]
push ecx
mov ecx, eax
call edx
add esi, 4
push esi
push 0x40
push edi
push str.0.00
lea eax, [esp + 0x18]
push eax
push str.CheckVersion
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [esp + 0x48]
pop edi
pop esi
xor ecx, esp
call fcn.004b6bdf
add esp, 0x44
ret 4

Function at 0x461f1e
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x44
mov eax, dword [0x630ddc]
xor eax, esp
mov dword [esp + 0x40], eax
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x14]
push edi
mov edi, dword [esp + 0x50]
call edx
mov ecx, 0x6322f8
call fcn.00403e00
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
mov edx, dword [eax]
mov edx, dword [edx + 0x3c]
push str.NewSpecVersion
lea ecx, [esp + 0xc]
push ecx
mov ecx, eax
call edx
add esi, 4
push esi
push 0x40
push edi
push str.0.00
lea eax, [esp + 0x18]
push eax
push str.CheckNewSpecDriverVersion
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [esp + 0x48]
pop edi
pop esi
xor ecx, esp
call fcn.004b6bdf
add esp, 0x44
ret 4
Function at 0x461fcc
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x630ddc]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
mov ebx, dword [esp + 0x114]
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x14]
push edi
mov edi, dword [esp + 0x118]
call edx
mov ecx, 0x6322f8
call fcn.00403e00
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
mov edx, dword [eax]
mov edx, dword [edx + 0x3c]
push str.OldModel
lea ecx, [esp + 0x10]
push ecx
mov ecx, eax
call edx
add esi, 4
push esi
push 0x208
push edi
push 0x56ab79
push ebx
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jle 0x46202a
mov eax, 5
jmp 0x462034
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
mov ecx, dword [esp + 0x110]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004b6bdf
add esp, 0x108
ret 8

Function at 0x467700
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
sub esp, 8
push esi
push edi
mov esi, ecx
push 6
lea edi, [esi + 4]
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [edi], 0
mov dword [esi + 8], 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jge 0x46773c
cmp eax, 0x80010106
jne 0x4677aa
lea eax, [esp + 0xc]
push eax
push 0x571398
push 1
push 0
push 0x571388
mov dword [esi + 8], 1
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jl 0x467788
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
lea edx, [esp + 8]
push edx
push eax
mov eax, dword [ecx + 0x1c]
call eax
mov esi, eax
test esi, esi
jl 0x467788
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
push edi
push eax
call edx
mov esi, eax
mov eax, dword [esp + 8]
test eax, eax
je 0x467798
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4677a8
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, esi
pop edi
pop esi
add esp, 8
ret
Function at 0x469220
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4edcfb
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x630ddc]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
lea edi, [esi + 0x10]
mov ecx, edi
mov dword [esi], vtable.CBaseInfoMgr.0
call fcn.00468240
mov dword [edi + 4], eax
mov byte [eax + 0x15], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
xor ebx, ebx
mov dword [eax + 8], eax
mov dword [edi + 8], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov eax, dword [edi + 4]
mov ecx, dword [eax + 4]
push ecx
mov ecx, edi
mov dword [esp + 0x20], ebx
call fcn.004681c0
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [edi + 8], ebx
mov dword [eax], eax
mov edi, dword [edi + 4]
mov dword [edi + 8], edi
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x4696b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push edi
xor edi, edi
cmp dword [ecx + 0x30], 2
jne 0x4696de
cmp dword [ecx + 0x24], 4
jbe 0x4696de
mov edx, dword [esp + 0x10]
mov eax, dword [ecx]
mov eax, dword [eax + 0x74]
push edx
push 0x26
call eax
test eax, eax
je 0x46973f
lea eax, [edi + 1]
pop edi
add esp, 8
ret 8
lea ecx, [esp + 4]
push ecx
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x1c], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x46973f
mov eax, dword [esp + 0x10]
push esi
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0
push str.ProgramFilesDir
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
mov eax, 1
je 0x469741
mov eax, edi
pop edi
add esp, 8
ret 8

Function at 0x46a5e0
Capabilities:
Get system information on windows

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 0xbc]
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
push eax
mov dword [eax + 0x20], ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esi + 0xd4]
cmp eax, 0x24a
ja 0x46a62b
je 0x46a627
sub eax, 0x182
je 0x46a627
sub eax, 0x64
jne 0x46a639
xor eax, eax
pop esi
ret
cmp eax, 0x898
je 0x46a67b
cmp eax, 0x21d8
je 0x46a656
push 0xe
push str.Windows_NT_x86
lea ecx, [esi + 0xe0]
mov dword [esi + 8], 0
call fcn.004035e0
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x24]
imul eax, eax, 0x64
add eax, dword [esi + 0x28]
push 0xb
push str.Windows_x64
lea ecx, [esi + 0xe0]
mov dword [esi + 8], eax
call fcn.004035e0
mov eax, 0x20000000
pop esi
ret
mov ecx, dword [esi + 0x24]
imul ecx, ecx, 0x64
add ecx, dword [esi + 0x28]
push 0xc
mov dword [esi + 8], ecx
push str.Windows_IA64
lea ecx, [esi + 0xe0]
call fcn.004035e0
mov eax, 0x10000000
pop esi
ret
Function at 0x46a714
Capabilities:
Check if file exists
Delete file
Set file attributes

Disassembly:
sub esp, 0x10c
mov eax, dword [0x630ddc]
xor eax, esp
mov dword [esp + 0x108], eax
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x14]
mov dword [esp + 4], 0
call edx
mov ecx, 0x6322f8
call fcn.00403df0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x3c]
call eax
mov edx, dword [eax]
mov edx, dword [edx + 0x44]
lea ecx, [esp + 4]
push ecx
mov ecx, eax
call edx
mov eax, dword [esp + 4]
test eax, eax
je 0x46a76b
cmp eax, 0x3e8
je 0x46a76b
cmp eax, 0x270f
je 0x46a76b
cmp dword [esp + 0x114], 1
jne 0x46a83b
push ebx
push ebp
mov ebp, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
push edi
lea edi, [esi + 0x108]
push edi
call ebp
test eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
je 0x46a793
push 0x20
push edi
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esi, 4
push esi
call ebp
test eax, eax
je 0x46a7a9
push 0x20
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, 0x6322f8
call fcn.00403df0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x24]
call eax
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
mov ecx, 0x6322f8
call fcn.00403df0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x28]
call eax
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x18]
call eax
push 0x103
lea ecx, [esp + 0x19]
push 0
push ecx
mov byte [esp + 0x20], 0
call fcn.004b79d0
add esp, 0xc
mov ecx, 0x6322f8
call fcn.00403df0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x28]
call eax
mov edx, dword [eax]
mov edx, dword [edx + 0xc]
lea ecx, [esp + 0x14]
push ecx
push str.RESTORE_COLOR_FOLDER
mov ecx, eax
call edx
mov ecx, 0x6322f8
call fcn.00403e20
mov edx, dword [eax]
mov edx, dword [edx + 0x74]
lea ecx, [esp + 0x14]
push ecx
mov ecx, eax
call edx
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x10c]
pop esi
xor ecx, esp
xor eax, eax
call fcn.004b6bdf
add esp, 0x10c
ret 4

Function at 0x470c70
Capabilities:
Check if file exists
Delete file
Set file attributes

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
call edx
add esi, 0x10
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x470c98
push 0x20
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
pop esi
ret
Function at 0x477924
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x630ddc]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
mov esi, ecx
cmp dword [esi + 0xc], 0
push edi
mov edi, dword [esp + 0x218]
mov eax, 1
je 0x4779be
test edi, edi
jne 0x477946
xor eax, eax
jmp 0x4779be
push ebx
mov ebx, dword [esp + 0x220]
push ebx
push 0
push edi
call fcn.004b79d0
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
mov eax, dword [eax + 0xfc]
add esp, 0xc
push 0x104
lea edx, [esp + 0x114]
push edx
call eax
mov esi, eax
test esi, esi
je 0x4779bd
push 0x104
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x4779bb
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
lea eax, [esp + 0x110]
push eax
lea ecx, [esp + 0x10]
push ecx
push 0x56b394
push 0xffffffffffffffff
push ebx
push edi
call fcn.004b7ed4
add esp, 0x18
mov eax, esi
jmp 0x4779bd
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x210]
pop edi
pop esi
xor ecx, esp
call fcn.004b6bdf
add esp, 0x20c
ret 8
Function at 0x48b7e0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4ffd3a
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x630ddc]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x14], edi
lea ebp, [edi + 0x10]
mov dword [edi], vtable.CBaseSetupCmdLineInfo.0
xor ebx, ebx
mov eax, 0xf
mov dword [ebp + 0x18], eax
mov dword [ebp + 0x14], ebx
mov byte [ebp + 4], bl
mov dword [edi + 0x44], eax
mov dword [edi + 0x40], ebx
mov dword [esp + 0x20], ebx
mov byte [edi + 0x30], bl
mov dword [edi + 0x60], eax
mov dword [edi + 0x5c], ebx
mov byte [edi + 0x4c], bl
mov dword [edi + 0x7c], eax
mov dword [edi + 0x78], ebx
mov byte [edi + 0x68], bl
lea esi, [edi + 0x84]
mov ecx, esi
mov byte [esp + 0x20], 3
call fcn.00405620
mov dword [esi + 4], eax
mov byte [eax + 0x45], 1
mov eax, dword [esi + 4]
mov dword [eax + 4], eax
mov eax, dword [esi + 4]
mov dword [eax], eax
mov eax, dword [esi + 4]
mov dword [eax + 8], eax
mov dword [esi + 8], ebx
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
push ecx
mov ecx, esi
mov byte [esp + 0x24], 4
call fcn.004505e0
mov eax, dword [esi + 4]
mov dword [eax + 4], eax
mov eax, dword [esi + 4]
mov dword [esi + 8], ebx
mov dword [eax], eax
mov esi, dword [esi + 4]
push ebx
mov dword [esi + 8], esi
push 0x56ab79
mov ecx, ebp
mov dword [edi + 4], ebx
call fcn.004035e0
push ebx
push 0x56ab79
lea ecx, [edi + 0x2c]
call fcn.004035e0
push ebx
push 0x56ab79
lea ecx, [edi + 0x48]
call fcn.004035e0
push ebx
push 0x56ab79
lea ecx, [edi + 0x64]
call fcn.004035e0
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x80], ebx
mov eax, edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret