joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4641a0
Capabilities:
Delete registry key

Disassembly:
push 0xffffffffffffffff
push 0x525298
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov eax, dword [0x589560]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push str.SoftWareMicrosoftCTFSortOrderAssemblyItem
push 0x80000001
call esi
push str.SoftWareMicrosoftCTFAssemblies
push 0x80000001
call esi
mov esi, dword [esp + 0x3c]
call fcn.004635d0
test al, al
jne 0x4641fb
mov ecx, esi
call fcn.00470870
mov eax, dword [edi + 4]
xor ebx, ebx
cmp eax, ebx
jne 0x464208
xor ebp, ebp
jmp 0x46421e
mov ecx, dword [edi + 8]
sub ecx, eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 3
mov ebp, edx
shr ebp, 0x1f
add ebp, edx
xor esi, esi
cmp ebp, ebx
jle 0x46426a
mov eax, dword [edi + 4]
test eax, eax
je 0x464245
mov ecx, dword [edi + 8]
sub ecx, eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp esi, eax
jb 0x46424a
call fcn.004fed81
mov ecx, dword [edi + 4]
mov eax, dword [esp + 0x3c]
push 1
add ecx, ebx
push eax
call fcn.00469020
add esi, 1
add esp, 8
add ebx, 0x30
cmp esi, ebp
jl 0x464224
xor ebx, ebx
cmp byte [0x5bd8b5], 0
jne 0x4642ae
push 0x562270
mov byte [0x5bd8b5], 1
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, ebx
jne 0x464295
mov byte [0x5bd8b6], 0
jmp 0x4643a6
push str.GetLocaleInfoEx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x464289
mov byte [0x5bd8b6], 1
jmp 0x4642bb
cmp byte [0x5bd8b6], 0
je 0x4643a6
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
lea ecx, [esp + 0x18]
push ecx
mov esi, edi
mov dword [esp + 0x38], ebx
call fcn.004637e0
xor ebp, ebp
xor esi, esi
jmp 0x4642e0
mov ecx, dword [esp + 0x1c]
cmp ecx, ebx
je 0x4643a6
mov edx, dword [esp + 0x20]
mov eax, edx
sub eax, ecx
sar eax, 4
cmp ebp, eax
jae 0x46436b
lea edx, [esi + ecx]
mov ecx, dword [esp + 0x3c]
push edx
call fcn.00463a30
mov eax, dword [esp + 0x20]
add esp, 4
cmp eax, ebx
je 0x464320
mov ecx, dword [esp + 0x20]
sub ecx, eax
sar ecx, 4
cmp ebp, ecx
jb 0x464329
call fcn.004fed81
mov eax, dword [esp + 0x1c]
mov edx, dword [esi + eax + 4]
cmp edx, ebx
lea edi, [esi + eax + 4]
je 0x46434e
mov ecx, dword [esi + eax + 8]
sub ecx, edx
mov eax, 0x2aaaaaab
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0x464353
call fcn.004fed81
mov ecx, dword [edi]
mov ebx, dword [esp + 0x3c]
call fcn.00464b40
add ebp, 1
add esi, 0x10
xor ebx, ebx
jmp 0x4642e0
cmp ecx, ebx
je 0x4643a6
cmp ecx, edx
mov edi, edx
je 0x46439d
lea esi, [ecx + 4]
mov eax, dword [esi]
cmp eax, ebx
je 0x464387
push eax
call fcn.004fc79f
add esp, 4
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
add esi, 0x10
lea ecx, [esi - 4]
cmp ecx, edi
jne 0x464378
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.004fc79f
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x466170
Capabilities:
Get geographical location

Disassembly:
push 0xffffffffffffffff
push 0x525256
mov eax, dword fs:[0]
push eax
sub esp, 0x3b8
mov eax, dword [0x589560]
xor eax, esp
mov dword [esp + 0x3b0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x589560]
xor eax, esp
push eax
lea eax, [esp + 0x3cc]
mov dword fs:[0], eax
mov eax, dword [esp + 0x3dc]
mov ebp, dword [esp + 0x3e0]
mov esi, ecx
lea ecx, [esp + 0x94]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], esi
call fcn.0046a650
xor eax, eax
mov dword [esp + 0x3d4], eax
mov byte [esp + 0x1c], al
mov dword [esp + 0x18], eax
mov eax, esi
lea ebx, [esp + 0x94]
lea edi, [esp + 0x18]
mov byte [esp + 0x3d4], 1
call fcn.004603f0
test al, al
mov ecx, edi
jne 0x466212
call fcn.004707c0
cmp byte [esp + 0x1b0], 0
jmp 0x466390
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x20]
push edx
push eax
mov eax, esi
mov dword [esp + 0x28], 0xffffffff
call fcn.00466090
xor ebx, ebx
push 0x206
lea ecx, [esp + 0x1ca]
push ebx
push ecx
mov word [esp + 0x1d0], bx
call fcn.005002f0
movzx eax, word [esi + 0xc]
add esp, 0x14
push 0x104
lea edx, [esp + 0x1c0]
push edx
push 2
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x46629f
push 0x5621fc
lea eax, [esp + 0x98]
call fcn.0046aa40
lea ecx, [esp + 0x1bc]
push ecx
lea eax, [esp + 0x98]
call fcn.0046aa40
push 0x54ea80
lea eax, [esp + 0x98]
call fcn.0046aa40
push 0x30
lea edx, [esp + 0x34]
push ebx
push edx
call fcn.005002f0
mov edi, dword [esp + 0xa4]
mov eax, dword [ebp]
add edi, 1
mov ecx, edi
add esp, 0xc
lea esi, [esp + 0x9c]
mov dword [esp + 0x2c], 7
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ebx
mov dword [esp + 0x1b4], ecx
call fcn.0046b260
cmp byte [esp + 0x1b0], bl
lea eax, [esp + 0xa0]
jne 0x4662f8
mov eax, dword [esp + 0x9c]
mov ecx, dword [esp + 0x20]
add eax, 4
push 0x30
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], edi
mov dword [esp + 0x4c], ecx
call fcn.004fdc99
mov esi, dword [esp + 0x2c]
add esp, 4
lea edx, [esp + 0x2c]
push edx
mov edi, eax
push ebx
mov ecx, 0xc
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x2c]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0x104d
push edi
mov dword [esp + 0x5c], eax
call esi
mov edx, dword [ebp]
xor eax, eax
cmp byte [esp + 0x3e4], bl
lea ecx, [esp + 0x60]
setne al
push ecx
push edx
push 0x102b
push edi
mov dword [esp + 0x80], 0xf000
add eax, 1
shl eax, 0xc
mov dword [esp + 0x7c], eax
call esi
add dword [ebp], 1
lea edi, [esp + 0x94]
call fcn.0046ab70
lea ecx, [esp + 0x18]
call fcn.004707c0
cmp byte [esp + 0x1b0], bl
mov dword [esp + 0x94], vtable.t_str.0
jne 0x4663b8
mov eax, dword [esp + 0x9c]
lea ecx, [esp + 0xa0]
cmp eax, ecx
je 0x4663b8
push eax
call fcn.004fdda1
add esp, 4
mov ecx, dword [esp + 0x3cc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3b0]
xor ecx, esp
call fcn.004fe05a
add esp, 0x3c4
ret
Function at 0x466470
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x10a0
call fcn.00503810
mov eax, dword [0x589560]
xor eax, esp
mov dword [esp + 0x109c], eax
push ebp
push esi
push edi
xor esi, esi
push 0x7fe
lea eax, [esp + 0xae]
push esi
push eax
mov word [esp + 0xb4], si
call fcn.005002f0
push 0x7fe
lea ecx, [esp + 0x8ba]
push esi
push ecx
mov word [esp + 0x8c0], si
call fcn.005002f0
push 0x30
lea edx, [esp + 0x2c]
push esi
push edx
call fcn.005002f0
mov eax, dword [esp + 0x10d4]
mov ebp, dword [esp + 0x10d8]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], esi
lea ecx, [esp + 0xcc]
mov dword [esp + 0x44], ecx
mov eax, 0x400
mov dword [esp + 0x48], eax
add esp, 0x24
mov dword [esp + 0xc], 7
mov ecx, 0xd
lea esi, [esp + 0xc]
lea edi, [esp + 0x40]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esp + 0x58], eax
lea eax, [esp + 0xc]
push eax
push 0
push 0x104b
lea edx, [esp + 0x8b4]
push ebx
mov dword [esp + 0x54], ebp
mov dword [esp + 0x64], edx
call esi
lea ecx, [esp + 0x40]
push ecx
push 0
push 0x104b
push ebx
call esi
mov edx, dword [esp + 0x10b0]
push 0xf000
push edx
push 0x102c
push ebx
call esi
push 0xf000
push ebp
mov edi, eax
push 0x102c
shr edi, 0xc
push ebx
sub edi, 1
call esi
mov ecx, dword [esp + 0x10b0]
lea edx, [esp + 0xc]
push edx
push 0
mov ebp, eax
mov eax, dword [esp + 0x10bc]
push 0x104c
shr ebp, 0xc
push ebx
sub ebp, 1
mov dword [esp + 0x20], eax
mov dword [esp + 0x54], ecx
call esi
lea eax, [esp + 0x40]
push eax
push 0
push 0x104c
push ebx
call esi
mov eax, dword [esp + 0x10b0]
xor ecx, ecx
test ebp, ebp
setne cl
lea edx, [esp + 0x74]
push edx
push eax
push 0x102b
push ebx
mov dword [esp + 0x94], 0xf000
add ecx, 1
shl ecx, 0xc
mov dword [esp + 0x90], ecx
call esi
mov eax, dword [esp + 0x10b4]
xor ecx, ecx
test edi, edi
setne cl
lea edx, [esp + 0x74]
push edx
push eax
push 0x102b
push ebx
mov dword [esp + 0x94], 0xf000
add ecx, 1
shl ecx, 0xc
mov dword [esp + 0x90], ecx
call esi
mov ecx, dword [esp + 0x10a8]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.004fe05a
add esp, 0x10a0
ret
Function at 0x466b80
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x210
mov eax, dword [0x589560]
xor eax, esp
mov dword [esp + 0x20c], eax
mov eax, dword [esp + 0x214]
push ebp
mov ebp, dword [esp + 0x21c]
cmp dword [ebp + 0x120], 0
push esi
push edi
mov dword [esp + 0xc], eax
mov edi, ecx
je 0x466bbe
mov dword [ebp + 0x120], 0
lea esi, [ebp + 8]
mov ecx, 1
mov dword [ebp + 4], 0
call fcn.0046b260
cmp byte [esi + 0x114], 0
je 0x466be0
add esi, 4
jmp 0x466be2
mov esi, dword [esi]
mov word [esi + 4], 0
cmp word [edi], 0
je 0x466c5a
mov edi, edi
push 0x25
push edi
call fcn.004fe7a6
add esp, 8
push edi
mov esi, eax
test esi, esi
push 0x551604
push ebp
je 0x466c74
mov word [esi], 0
add esi, 2
call fcn.0046adf0
push 0x25
push esi
call fcn.004fe7a6
add esp, 0x14
test eax, eax
je 0x466c7e
push 0x104
lea ecx, [esp + 0x14]
push ecx
push esi
mov word [eax], 0
lea edi, [eax + 2]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x466cb4
lea edx, [esp + 0x10]
push edx
push 0x551604
push ebp
call fcn.0046adf0
add esp, 0xc
cmp word [edi], 0
jne 0x466bf0
pop edi
pop esi
mov al, 1
pop ebp
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.004fe05a
add esp, 0x210
ret
call fcn.0046adf0
add esp, 0xc
jmp 0x466c5a
mov ecx, dword [esp + 0xc]
call fcn.00470820
push 0x56229c
push 0x551604
push eax
call fcn.0046adf0
add esp, 0xc
pop edi
pop esi
xor al, al
pop ebp
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.004fe05a
add esp, 0x210
ret
mov ecx, dword [esp + 0xc]
call fcn.00470820
push 0x5622ac
mov edi, eax
push 0x551604
push edi
call fcn.0046adf0
push esi
push 0x551604
push edi
call fcn.0046adf0
mov ecx, dword [esp + 0x230]
add esp, 0x18
pop edi
pop esi
pop ebp
xor ecx, esp
xor al, al
call fcn.004fe05a
add esp, 0x210
ret
Function at 0x467e30
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x520d91
mov eax, dword fs:[0]
push eax
sub esp, 0x384
mov eax, dword [0x589560]
xor eax, esp
mov dword [esp + 0x380], eax
push ebx
push esi
mov eax, dword [0x589560]
xor eax, esp
push eax
lea eax, [esp + 0x390]
mov dword fs:[0], eax
mov ecx, 0x105
mov esi, 0x5bea60
mov dword [0x5beb78], ecx
call fcn.0046b260
xor ebx, ebx
cmp byte [0x5beb74], bl
mov eax, 0x5bea64
jne 0x467e92
mov eax, dword [0x5bea60]
push ebx
push 0x1a
add eax, 4
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp eax, 1
je 0x467ee5
cmp dword [0x5beb78], ebx
je 0x467eb3
mov dword [0x5beb78], ebx
mov ecx, 1
mov esi, 0x5bea60
mov dword [0x5bea5c], ebx
call fcn.0046b260
cmp byte [0x5beb74], bl
mov eax, 0x5bea64
jne 0x467eda
mov eax, dword [0x5bea60]
mov word [eax + 4], bx
xor al, al
jmp 0x4680b8
mov ecx, 0x5bea58
call fcn.0046e040
push 0x562270
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, ebx
je 0x4680b6
push str.GetLocaleInfoEx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x4680b6
lea ecx, [esp + 0x264]
call fcn.0046da30
lea eax, [esp + 0x264]
push eax
mov ecx, 0x5bea58
mov dword [esp + 0x39c], ebx
call fcn.0046f810
test al, al
jne 0x467f75
cmp byte [esp + 0x380], bl
mov dword [esp + method.t_str.virtual_0], vtable.t_str.0
jne 0x467f6e
mov eax, dword [esp + 0x26c]
lea ecx, [esp + 0x270]
cmp eax, ecx
je 0x467f6e
push eax
call fcn.004fdda1
add esp, 4
xor al, al
jmp 0x4680b8
mov dword [esp + 0x10], str.LocalLow
mov dword [esp + 0x14], str.Roaming
mov dword [esp + 0x18], str.Local
xor esi, esi
nop
cmp byte [esp + 0x380], bl
lea eax, [esp + 0x270]
jne 0x467fa7
mov eax, dword [esp + 0x26c]
mov edx, dword [esp + esi*4 + 0x10]
lea ecx, [eax + 4]
call fcn.00467cf0
test al, al
jne 0x467fcf
add esi, 1
cmp esi, 3
jb 0x467f90
mov dword [esp + method.t_str.virtual_0], vtable.t_str.0
jmp 0x468092
mov esi, dword [esp + esi*4 + 0x10]
cmp esi, ebx
jne 0x467fe7
mov dword [esp + method.t_str.virtual_0], vtable.t_str.0
jmp 0x468092
lea ecx, [esp + 0x1c]
call fcn.0046a650
mov eax, esi
lea edx, [esp + 0x1c]
call fcn.0046a7f0
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x144]
push ecx
lea ecx, [esp + 0x26c]
mov byte [esp + 0x3a0], 2
call fcn.0046e1d0
cmp byte [eax + 0x11c], bl
je 0x468029
add eax, 0xc
jmp 0x46802c
mov eax, dword [eax + 8]
add eax, 4
mov edx, 0x5bea58
call fcn.0046a7f0
cmp byte [esp + 0x25c], bl
mov esi, vtable.t_str.0
mov dword [esp + 0x140], esi
jne 0x468069
mov eax, dword [esp + 0x148]
lea edx, [esp + 0x14c]
cmp eax, edx
je 0x468069
push eax
call fcn.004fdda1
add esp, 4
cmp byte [esp + 0x138], bl
mov dword [esp + 0x1c], esi
jne 0x46808b
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x28]
cmp eax, ecx
je 0x46808b
push eax
call fcn.004fdda1
add esp, 4
mov dword [esp + 0x264], esi
cmp byte [esp + 0x380], bl
jne 0x4680b6
mov eax, dword [esp + 0x26c]
lea edx, [esp + 0x270]
cmp eax, edx
je 0x4680b6
push eax
call fcn.004fdda1
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x390]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x380]
xor ecx, esp
call fcn.004fe05a
add esp, 0x390
ret
Function at 0x46b690
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea eax, [edi + edi + 2]
cmp dword [esp + 4], eax
push ebp
mov ebp, dword [esp + 0xc]
ja 0x46b6a3
xor al, al
pop ebp
ret
xor dl, dl
xor eax, eax
test edi, edi
jbe 0x46b6e6
push ebx
lea esp, [esp]
mov cl, byte [eax + ebp]
mov bl, cl
shr bl, 4
xor dl, cl
movzx bx, bl
movzx ecx, cl
add bx, 0x61
and ecx, 0x8000000f
mov word [esi + eax*4], bx
jns 0x46b6d6
dec ecx
or ecx, 0xfffffff0
inc ecx
add ecx, 0x61
mov word [esi + eax*4 + 2], cx
add eax, 1
cmp eax, edi
jb 0x46b6b0
pop ebx
mov al, dl
shr al, 4
movzx cx, al
movzx edx, dl
add cx, 0x61
and edx, 0x8000000f
mov word [esi + edi*4], cx
jns 0x46b707
dec edx
or edx, 0xfffffff0
inc edx
add edx, 0x61
mov word [esi + edi*4 + 2], dx
mov word [esi + edi*4 + 4], 0
mov al, 1
pop ebp
ret

Function at 0x46b7d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov edi, eax
xor eax, eax
cmp word [edi], ax
mov dword [esp + 0x10], eax
je 0x46b862
jmp 0x46b7f0
lea ecx, [eax + 1]
cmp ecx, 0x201
mov dword [esp + 0x18], ecx
jge 0x46b872
xor edx, edx
xor esi, esi
movzx ecx, word [edi]
test cx, cx
je 0x46b872
cmp cx, 0x61
jb 0x46b81f
cmp cx, 0x7a
ja 0x46b81f
movzx ecx, cx
sub ecx, 0x61
jmp 0x46b831
cmp cx, 0x30
jb 0x46b872
cmp cx, 0x39
ja 0x46b872
movzx ecx, cx
sub ecx, 0x16
movzx ebx, al
and ebx, 0x1f
shl edx, 5
xor ebx, ecx
add ebx, edx
add esi, 1
add edi, 2
cmp esi, 4
movzx edx, bx
jl 0x46b803
add dword [esp + 0x10], 1
mov eax, dword [esp + 0x18]
mov word [ebp], dx
add ebp, 2
cmp word [edi], 0
jne 0x46b7f0
mov eax, dword [esp + 0x10]
pop edi
pop esi
mov word [ebp], 0
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret
Function at 0x46b940
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
sub esp, 0x804
mov eax, dword [0x589560]
xor eax, esp
mov dword [esp + 0x800], eax
push esi
mov esi, dword [esp + 0x80c]
push 0x5be258
push esi
call fcn.0050266c
add esp, 8
test eax, eax
je 0x46b986
xor eax, eax
pop esi
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.004fe05a
add esp, 0x804
ret
test word [0x5be25e], 0x4000
je 0x46baa6
push edi
push esi
push str._s.
lea edx, [esp + 0x10]
call fcn.0046c100
add esp, 8
push 0x5be008
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x46baa5
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea ebx, [ebx]
mov ecx, 0x5543b8
mov eax, 0x5be034
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x46ba06
test dx, dx
je 0x46ba02
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x46ba06
add eax, 4
add ecx, 4
test dx, dx
jne 0x46b9e0
xor eax, eax
jmp 0x46ba0b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x46ba8d
mov ecx, 0x562920
mov eax, 0x5be034
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x46ba46
test dx, dx
je 0x46ba42
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x46ba46
add eax, 4
add ecx, 4
test dx, dx
jne 0x46ba20
xor eax, eax
jmp 0x46ba4b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x46ba8d
push 0x5be034
push esi
push 0x562928
lea edx, [esp + 0x18]
call fcn.0046c100
add esp, 0xc
test byte [0x5be008], 0x10
je 0x46ba7e
lea ecx, [esp + 0xc]
push ecx
call fcn.0046b940
add esp, 4
jmp 0x46ba8d
push 4
push 0
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 0x5be008
push edi
call ebp
test eax, eax
jne 0x46b9d0
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebp
pop edi
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [esp + 0x804]
pop esi
xor ecx, esp
call fcn.004fe05a
add esp, 0x804
ret
Function at 0x46bae0
Capabilities:
Delete directory
Delete file

Disassembly:
sub esp, 0x804
mov eax, dword [0x589560]
xor eax, esp
mov dword [esp + 0x800], eax
push esi
mov esi, dword [esp + 0x80c]
push 0x5bdfd8
push esi
call fcn.0050266c
add esp, 8
test eax, eax
je 0x46bb26
xor eax, eax
pop esi
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.004fe05a
add esp, 0x804
ret
test word [0x5bdfde], 0x4000
je 0x46bc46
push edi
push esi
push str._s.
lea edx, [esp + 0x10]
call fcn.0046c100
add esp, 8
push 0x5bdd88
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x46bc28
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea ebx, [ebx]
mov ecx, 0x5543b8
mov eax, 0x5bddb4
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x46bba6
test dx, dx
je 0x46bba2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x46bba6
add eax, 4
add ecx, 4
test dx, dx
jne 0x46bb80
xor eax, eax
jmp 0x46bbab
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x46bc10
mov ecx, 0x562920
mov eax, 0x5bddb4
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x46bbe6
test dx, dx
je 0x46bbe2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x46bbe6
add eax, 4
add ecx, 4
test dx, dx
jne 0x46bbc0
xor eax, eax
jmp 0x46bbeb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x46bc10
push 0x5bddb4
push esi
push 0x562928
lea edx, [esp + 0x18]
call fcn.0046c100
lea ecx, [esp + 0x18]
push ecx
call fcn.0046bae0
add esp, 0x10
push 0x5bdd88
push edi
call ebx
test eax, eax
jne 0x46bb70
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop edi
pop esi
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.004fe05a
add esp, 0x804
ret
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x804]
pop esi
xor ecx, esp
call fcn.004fe05a
add esp, 0x804
ret
Function at 0x46bc80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x22c
mov eax, dword [0x589560]
xor eax, esp
mov dword [esp + 0x228], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
lea ecx, [esp + 0x10]
push ecx
push 0x20019
xor edi, edi
push edi
push str.HTTP_shellopencommand
push 0x80000000
mov dword [esp + 0x30], eax
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x46bdc8
push 0x206
lea edx, [esp + 0x2e]
push edi
push edx
mov word [esp + 0x34], di
call fcn.005002f0
mov edx, dword [esp + 0x1c]
add esp, 0xc
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x2c]
push ecx
push edi
push edx
mov dword [esp + 0x28], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x46bdc8
xor ebx, ebx
cmp word [esp + 0x28], 0x22
jne 0x46bd1c
lea ebx, [edi + 1]
lea eax, [esp + 0x28]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x46bd23
sub eax, edx
sar eax, 1
lea esi, [eax - 1]
cmp esi, ebx
jle 0x46bdc8
lea edi, [esp + esi*2 + 0x24]
xor eax, eax
push 3
push edi
mov word [esp + 0x28], ax
mov dword [esp + 0x2a], eax
mov word [esp + 0x2e], ax
lea eax, [esp + 0x28]
push 4
push eax
call fcn.004fe994
lea ecx, [esp + 0x30]
push 0x562964
push ecx
mov word [esp + 0x3e], 0
call fcn.004fe715
add esp, 0x18
test eax, eax
je 0x46bd89
sub esi, 1
sub edi, 2
cmp esi, ebx
jg 0x46bd41
jmp 0x46bdc6
mov edi, dword [esp + 0x1c]
sub esi, ebx
add esi, 1
push esi
lea edx, [esp + ebx*2 + 0x2c]
push edx
lea eax, [edi + 2]
push 0x103
push eax
mov word [edi], 0x22
call fcn.004fe994
push 0x554328
push 0x104
push edi
call fcn.004fe162
add esp, 0x1c
mov dword [esp + 0xc], 1
xor edi, edi
mov eax, dword [esp + 0x10]
cmp eax, edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x46bdd9
push eax
call esi
mov eax, dword [esp + 0xc]
cmp eax, edi
jne 0x46be77
lea ecx, [esp + 0x14]
push ecx
push 0x20019
push edi
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x46be68
push 0x206
lea edx, [esp + 0x2e]
push edi
push edx
mov word [esp + 0x34], di
call fcn.005002f0
add esp, 0xc
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x28]
push edx
push edi
push str.ProgramFilesDir
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x46be68
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x28]
push ecx
push str._sInternet_ExplorerIEXPLORE.exe
push 0x104
push edx
call fcn.004fe127
add esp, 0x10
mov dword [esp + 0xc], 1
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x46be73
push eax
call esi
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004fe05a
mov esp, ebp
pop ebp
ret
Function at 0x46be90
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x20c
mov eax, dword [0x589560]
xor eax, esp
mov dword [esp + 0x208], eax
cmp byte [0x5b9f9a], 0
jne 0x46bedb
lea eax, [esp]
push eax
call fcn.0046bc80
add esp, 4
cmp eax, 1
push 5
push 0
jne 0x46becf
push esi
lea ecx, [esp + 0xc]
push ecx
push str.open
jmp 0x46bed4
push 0
push esi
push 0
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.004fe05a
add esp, 0x20c
ret

Function at 0x46bef0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
lea eax, [esp + 0xc]
xor ebx, ebx
push eax
push ebp
mov byte [esp + 0x13], bl
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
cmp eax, ebx
mov dword [esp + 0xc], eax
jne 0x46bf26
pop ebp
xor al, al
pop ebx
add esp, 0x10
ret
push esi
push eax
call fcn.004fdc99
mov ecx, dword [esp + 0x14]
add esp, 4
mov esi, eax
push esi
push ecx
push ebx
push ebp
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x46bf84
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push eax
push 0x54ea84
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x46bf84
mov eax, dword [esp + 0x14]
movzx ecx, word [eax + 0xa]
movzx edx, word [eax + 8]
mov word [edi], cx
movzx ecx, word [eax + 0xe]
mov word [edi + 2], dx
movzx edx, word [eax + 0xc]
mov word [edi + 4], cx
mov word [edi + 6], dx
mov byte [esp + 0xf], 1
cmp esi, ebx
je 0x46bf91
push esi
call fcn.004fdda1
add esp, 4
mov al, byte [esp + 0xf]
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x46bfa0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x214
mov eax, dword [0x589560]
xor eax, esp
mov dword [esp + 0x210], eax
push 0x206
lea eax, [esp + 0xe]
push 0
push eax
mov word [esp + 0x14], 0
call fcn.005002f0
add esp, 0xc
push 0x104
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x46bffa
xor al, al
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.004fe05a
add esp, 0x214
ret
push edi
push str.kernel32.dll
lea edx, [esp + 0x10]
push 0x104
push edx
call fcn.004fe162
lea eax, [esp + 0x18]
push eax
lea edi, [esp + 0x14]
call fcn.0046bef0
add esp, 0x10
test al, al
pop edi
je 0x46bfe3
movzx ecx, word [esp]
movzx eax, word [esp + 4]
movzx edx, word [esp + 2]
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0x210]
mov dword [esi + 0xc], eax
xor ecx, esp
mov dword [esi], 0x114
mov dword [esi + 8], edx
mov dword [esi + 0x10], 2
mov word [esi + 0x14], 0
mov al, 1
call fcn.004fe05a
add esp, 0x214
ret