joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415715
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x415815
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x4157ad
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x415780
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x41577e
push 0
push 0
push 0
push 0
push 0
push 0
push 0xd4a
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x4157ab
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x4157ab
push 0x72d9
push 0
push 0x1b1c
push 1
push 1
push 0x2635
push 0
call fcn.00422979
add esp, 0x1c
jmp 0x415813
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x4157f2
mov byte [ebp - 3], 0
push 0
push 0x2c2e
push 0x3680
push 1
push 0x4084
push 0x4b3e
push 0xa55
lea eax, [ebp - 3]
push eax
call fcn.004167d6
add esp, 0x20
jmp 0x415813
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x415813
push 0x262
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
jmp 0x415859
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x2c]
push 1
push dword [ebp - 0x30]
push dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
call fcn.0040d067
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x418e36
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x418e77
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0xc], eax
push dword [ebp - 4]
push 1
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.00418f3f
add esp, 0x14
jmp 0x418f3b
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x418ec3
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
push 0
push dword [ebp - 0x20]
push dword [ebp - 0x24]
call fcn.00415cc2
add esp, 0xc
jmp 0x418f3b
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x418f0b
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x418f09
push 0
push 0x1416
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
jmp 0x418f3b
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
test eax, eax
je 0x418f3b
push 0xd3e
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esp, ebp
pop ebp
ret
Function at 0x4288ca
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x428929
lea eax, [ebp + 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x42891c
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
push 0x2564
push 1
push 0x7de
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.004289a3
add esp, 0x14
jmp 0x428927
push 0
push 1
call fcn.00415699
pop ecx
pop ecx
jmp 0x42899f
lea eax, [ebp + 0x24]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x428973
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
push dword [ebp - 0x24]
push 0x136
push dword [ebp - 0x28]
push 0x5302
push 1
call fcn.00424f2e
add esp, 0x14
jmp 0x42899f
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x42898b
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
jmp 0x42899f
push 0
push 0x1416
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
mov esp, ebp
pop ebp
ret
Function at 0x42cc08
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x42cc33
mov eax, dword [ebp + 0x20]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push 0x3e31
push 1
call fcn.0042ccef
add esp, 0xc
jmp 0x42cceb
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x42cc75
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
push 0x42d1
push 0
call fcn.004098d3
add esp, 0xc
jmp 0x42cceb
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x42ccde
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x42ccbf
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x42ccdc
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x38]
call fcn.00438351
mov dword [eax], 0x55b65ab4
jmp 0x42ccb4
jmp 0x42cceb
push 0x11a0
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov esp, ebp
pop ebp
ret
Function at 0x42e937
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x42ea0c
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x42e9d3
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x42e9b5
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x42e9b3
push 0
push 0x1933
push 0xca6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
jmp 0x42e9d1
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x42e9d1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
jmp 0x42ea0a
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
push 0
push dword [ebp - 0x2c]
push 0x32d5
push 0x4dce
push 0x32b2
push 0x114c
push 0
push dword [ebp - 0x30]
push 0xb7a
call fcn.0040f6ce
add esp, 0x24
jmp 0x42ea2f
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
push 0x5834
push dword [ebp - 0x34]
push 0
push dword [ebp - 0x38]
push 1
call fcn.0041a95d
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x42fa89
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x42fb11
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x42fb01
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x42faf9
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x42faff
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
jmp 0x42fb0f
push 0
push 0
push 1
call fcn.0042c4b3
add esp, 0xc
jmp 0x42fb58
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x3c], eax
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push 1
push dword [ebp - 0x38]
push 0x5680
push 1
push 0x3fe3
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x40]
call fcn.0040cb61
add esp, 0x24
mov esp, ebp
pop ebp
ret
Function at 0x43ebf4
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x43ec5d
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x43ec4d
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x43ec34
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
jmp 0x43ec4b
mov byte [ebp - 1], 0
lea eax, [ebp - 1]
push eax
push 0
push 0x9a1
call fcn.004549b0
add esp, 0xc
jmp 0x43ec5b
push 0
push 0x6b6f
call fcn.0043fec5
pop ecx
pop ecx
jmp 0x43ec6b
push 0
push 0x7b5b
call fcn.0043f9ba
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x43ffd3
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x440024
lea eax, [ebp + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 8], eax
push 1
push dword [ebp - 4]
push dword [ebp - 8]
push 0x70ab
push dword [ebp - 0xc]
push 0x7bcb
push 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
push eax
call fcn.0044f478
add esp, 0x20
jmp 0x4400dd
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x44006b
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
push 1
push 0x33aa
push 0x3486
push dword [ebp - 0x1c]
call fcn.0043f973
add esp, 0x10
jmp 0x4400dd
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x4400bf
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x4400bd
push 0
push 0x796
push 0xb34
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
jmp 0x4400dd
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x4400dd
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esp, ebp
pop ebp
ret
Function at 0x44cb8a
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x44cbcf
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
push 1
push dword [ebp - 8]
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.0044ccbf
add esp, 0x14
jmp 0x44ccbb
lea eax, [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x44cca1
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x44cc70
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x44cc51
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x44cc6e
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x40]
call fcn.00438351
mov dword [eax], 0xfff7
jmp 0x44cc46
jmp 0x44cc9f
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
test eax, eax
je 0x44cc9f
push 0xbf6
push 0x1ef5
push 0
push 0x2656
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jmp 0x44ccbb
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
push 1
push 0
push 0x5d68
push dword [ebp - 0x54]
call fcn.0043e070
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x450f61
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x45106c
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x451006
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x450feb
mov dword [ebp - 4], 0x94f37831
mov dword [ebp - 0x14], 0x47c2c9eb
mov dword [ebp - 0x18], 0x29f58382
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
call fcn.00453ed3
add esp, 0x10
push 1
lea eax, [ebp - 4]
push eax
push 1
push 1
push 0
push 0x4f18
call fcn.0044dc8d
add esp, 0x18
jmp 0x451004
push 0xbda
push 0x233
push 1
push 0
push 0x5fd
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
jmp 0x451067
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x451034
push 0
push 0
push 0x200e
push 0x16a5
push 0
call dword [sym.imp.USER32.dll_InsertMenuW]
jmp 0x451067
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x451067
push 0
push 0x126e
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
jmp 0x451154
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x60], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 0x40], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x45111c
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x4510f7
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
movzx eax, byte [eax]
test eax, eax
je 0x4510f5
push 1
push 0x6f6d
push 0x913
push 0
push 0x2eb0
push 0x66c1
push 0
push 1
push 1
push 0x4463
call fcn.0044018e
add esp, 0x28
jmp 0x45111a
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
movzx eax, byte [eax]
test eax, eax
je 0x45111a
push 0x11a0
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x451154
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x64], eax
push 0x27c
push 0xcce
push 1
push 1
push 0x33a0
push dword [ebp - 0x64]
push 0x19af
push 0x2a2
push 0x6688
push 0x3501
call fcn.00441b9a
add esp, 0x28
mov esp, ebp
pop ebp
ret
Function at 0x45d624
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x45d692
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x45d658
push 1
push 0x4cd5
call fcn.0045d6bb
pop ecx
pop ecx
jmp 0x45d690
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x45d672
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x45d690
mov byte [ebp - 1], 0
lea eax, [ebp - 1]
push eax
push 0
push 0x5c59
push 0x218b
push 0
call fcn.00460575
add esp, 0x14
jmp 0x45d6b7
lea eax, [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
push 0x60f4
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x18]
push 1
call fcn.0045bd05
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x461882
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x461980
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x4618df
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
push 0
push dword [ebp - 0x10]
push 0x3ff7
call fcn.00463758
add esp, 0xc
jmp 0x46197e
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x46194e
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x46192f
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x46194c
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x38]
call fcn.00438351
mov dword [eax], 0x254e7f13
jmp 0x461924
jmp 0x46197e
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x46197e
push 0xd3e
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4619c2
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x48], eax
push dword [ebp - 0x48]
push 0x769
push 0x798e
push 0x5335
push 0x35cc
push 0x6e6b
push 0x29a8
push 0x72d8
push 1
push 0x2572
push 0x1553
push 1
call fcn.00445ef1
add esp, 0x30
mov esp, ebp
pop ebp
ret
Function at 0x461a01
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
movzx eax, byte [ebp + 0x34]
test eax, eax
je 0x461a86
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x40]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x3c]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x24], eax
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
push eax
push 0xde4
push 1
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push 0x43b1
call fcn.00461b0a
add esp, 0x34
jmp 0x461b06
lea eax, [ebp + 0x38]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x48], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x461af4
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x461adc
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x461ada
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
jmp 0x461af2
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
jmp 0x461b06
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
push dword [ebp - 0x4c]
push 0
call fcn.0043e29c
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret