joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45a648
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x45a65f
add esp, 0xfffffff0
call fcn.00403d54
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041a9c8
mov eax, dword [0x489b88]
cmp word [eax + 2], 0
jne 0x45a687
mov eax, dword [0x489b88]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045bdc8
mov eax, dword [0x489c38]
cmp word [eax + 2], 0
jne 0x45a6a1
mov eax, dword [0x489c38]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045bfc0
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x4128c4]
call fcn.00403a00
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4128c4]
call fcn.00403a00
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41cf14]
call fcn.004246a4
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x45a828
mov eax, dword [0x489aa4]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00424a74
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x45c570
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x489aa4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040d3f0
test eax, eax
je 0x45a796
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.0040945c
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040d418
test eax, eax
je 0x45a7aa
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004049f0
mov eax, dword [0x48997c]
cmp byte [eax], 0
jne 0x45a7de
mov eax, ebx
call fcn.0045a950
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0045c74c
mov eax, ebx
call fcn.0045d110
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45a81e
call fcn.00403dac
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45abd0
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x48abb0]
cmp dword [eax + 0x30], 0
je 0x45ac7a
cmp dword [ebx + 0x94], 0
jne 0x45ac74
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45ab60
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45ac74
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45ac3a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45ac74
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00414c2c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45ac49
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45b7dc
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45b811
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404870
jmp 0x45b81e
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004047d4
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45c928
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45c969
mov eax, esi
call fcn.00442574
test al, al
je 0x45c969
mov eax, dword [ebx + 0x84]
call fcn.00442270
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45c969
push 0
mov eax, dword [ebx + 0x84]
call fcn.00442270
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x460030
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x46005e
mov eax, ebx
call fcn.00460ae4
cmp dword [ebx + 0x40], 0
je 0x460057
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4600cf
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4600c1
cmp dword [ebx + 8], 0
je 0x460080
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x460092
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4600c1
cmp dword [ebx + 8], 0
je 0x460073
cmp eax, 3
je 0x4600a5
dec eax
jne 0x460073
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x460073
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x460073
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4600ed
cmp dword [ebx + 0x14], 0xcc
je 0x4600ed
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004600f8
pop ebx
ret
Function at 0x47061c
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4706de
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00404780
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 0x20], bl
mov byte [ebp - 0x1c], 2
lea edx, [ebp - 0x20]
xor ecx, ecx
mov eax, 0x4706f4
call fcn.00409afc
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00408464
mov eax, dword [ebp - 0x14]
call fcn.00404c40
push 0
push 0
push 3
push 0
push 3
push 0
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4706c3
xor eax, eax
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 4]
push eax
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0x2d1080
push ebx
call sub.kernel32.dll_DeviceIoControl
test eax, eax
je 0x4706bd
mov eax, dword [ebp - 0xc]
xor edx, edx
push edx
push eax
mov eax, esi
call fcn.00408af8
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4706e5
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004047a4
ret

Function at 0x470700
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4707c3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00404780
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 0x20], bl
mov byte [ebp - 0x1c], 2
lea edx, [ebp - 0x20]
xor ecx, ecx
mov eax, 0x4707d8
call fcn.00409afc
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00408464
mov eax, dword [ebp - 0x14]
call fcn.00404c40
push 0
push 0
push 3
push 0
push 3
push 0
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4707a8
xor eax, eax
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 4]
push eax
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0x2d1080
push ebx
call sub.kernel32.dll_DeviceIoControl
test eax, eax
je 0x4707a2
mov eax, dword [ebp - 0xc]
inc eax
xor edx, edx
push edx
push eax
mov eax, esi
call fcn.00408af8
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4707ca
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004047a4
ret
Function at 0x4708e8
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4709af
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, 0x4709c4
call fcn.004047d4
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 0x20], bl
mov byte [ebp - 0x1c], 2
lea edx, [ebp - 0x20]
xor ecx, ecx
mov eax, 0x4709d0
call fcn.00409afc
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00408464
mov eax, dword [ebp - 0x14]
call fcn.00404c40
push 0
push 0
push 3
push 0
push 3
push 0
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x470994
xor eax, eax
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 4]
push eax
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0x2d1080
push ebx
call sub.kernel32.dll_DeviceIoControl
test eax, eax
je 0x47098e
mov eax, dword [ebp - 0xc]
xor edx, edx
push edx
push eax
mov eax, esi
call fcn.00408af8
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4709b6
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004047a4
ret

Function at 0x4709dc
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x470aa3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, 0x470ab8
call fcn.004047d4
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 0x20], bl
mov byte [ebp - 0x1c], 2
lea edx, [ebp - 0x20]
xor ecx, ecx
mov eax, 0x470ac4
call fcn.00409afc
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00408464
mov eax, dword [ebp - 0x14]
call fcn.00404c40
push 0
push 0
push 3
push 0
push 3
push 0
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x470a88
xor eax, eax
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 4]
push eax
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0x2d1080
push ebx
call sub.kernel32.dll_DeviceIoControl
test eax, eax
je 0x470a82
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
mov eax, esi
call fcn.00408af8
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x470aaa
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004047a4
ret
Function at 0x470ad0
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x470b81
push dword fs:[eax]
mov dword fs:[eax], esp
or esi, 0xffffffff
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 0x20], bl
mov byte [ebp - 0x1c], 2
lea edx, [ebp - 0x20]
xor ecx, ecx
mov eax, 0x470b98
call fcn.00409afc
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00408464
mov eax, dword [ebp - 0x14]
call fcn.00404c40
push 0
push 0
push 3
push 0
push 3
push 0
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x470b66
xor eax, eax
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 4]
push eax
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0x2d1080
push ebx
call sub.kernel32.dll_DeviceIoControl
test eax, eax
je 0x470b60
mov esi, dword [ebp - 0xc]
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x470b88
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004047a4
ret

Function at 0x470ba4
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x240], eax
xor eax, eax
push ebp
push 0x470ca3
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
mov byte [ebp - 0x12], 0
lea ebx, [ebp - 0x238]
mov dword [ebx + 4], 0x227
lea eax, [ebp - 0x240]
push eax
mov al, byte [ebp + 8]
mov byte [ebp - 0x248], al
mov byte [ebp - 0x244], 2
lea edx, [ebp - 0x248]
xor ecx, ecx
mov eax, 0x470cc0
call fcn.00409afc
mov eax, dword [ebp - 0x240]
lea edx, [ebp - 0x23c]
call fcn.00408464
mov eax, dword [ebp - 0x23c]
call fcn.00404c40
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push eax
call sub.kernel32.dll_CreateFileA_1
mov esi, eax
cmp esi, 0xffffffff
jne 0x470c47
xor ebx, ebx
jmp 0x470c85
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebx + 4]
push eax
push ebx
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0x2d1400
push esi
call sub.kernel32.dll_DeviceIoControl
mov edi, eax
push esi
call sub.kernel32.dll_CloseHandle_1
cmp dword [ebx + 0x1c], 7
jne 0x470c83
test edi, edi
je 0x470c83
mov bl, 1
jmp 0x470c85
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x470caa
lea eax, [ebp - 0x240]
mov edx, 2
call fcn.004047a4
ret
Function at 0x470d04
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov edi, ecx
mov ebx, edx
mov esi, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x470d23
xor edx, edx
mov dword [eax], edx
xor eax, eax
push ebp
push 0x470e3e
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov eax, dword [ebp + 8]
xor edx, edx
call fcn.00404dcc
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
call fcn.00404780
mov ecx, eax
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.00471160
test al, al
je 0x470e28
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0x10]
call fcn.00404c40
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x470e28
xor eax, eax
push ebp
push 0x470e21
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, ebx
call fcn.00404c40
mov esi, eax
push esi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x470dbd
call fcn.00404268
jmp 0x470e28
cmp edi, dword [ebp - 0x14]
je 0x470dc9
call fcn.00404268
jmp 0x470e28
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
call fcn.00404dcc
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp + 8]
call fcn.00404c98
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push esi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x470e06
mov eax, dword [ebp + 8]
xor edx, edx
call fcn.00404dcc
call fcn.00404268
jmp 0x470e28
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x470e28
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x470e45
lea eax, [ebp - 0x10]
call fcn.00404780
ret
Function at 0x470e54
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404c30
mov eax, dword [ebp - 8]
call fcn.00404c30
mov eax, dword [ebp + 8]
call fcn.00404c30
xor eax, eax
push ebp
push 0x470f5e
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
lea eax, [ebp - 0x18]
call fcn.00404780
mov ecx, eax
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00471160
test al, al
je 0x470f33
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x20006
push 0
push 0
push 0
mov eax, dword [ebp - 0x18]
call fcn.00404c40
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
jne 0x470f33
xor eax, eax
push ebp
push 0x470f2c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404a40
push eax
lea eax, [ebp + 8]
call fcn.00404c98
push eax
push ebx
push 0
mov eax, dword [ebp - 8]
call fcn.00404c40
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
sete byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x470f33
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x470f65
lea eax, [ebp - 0x18]
call fcn.00404780
lea eax, [ebp - 8]
mov edx, 2
call fcn.004047a4
lea eax, [ebp + 8]
call fcn.00404780
ret
Function at 0x4715ec
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff3c
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47189d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404780
lea eax, [ebp - 0xc0]
push eax
call sub.kernel32.dll_GetSystemInfo
xor eax, eax
push ebp
push 0x471873
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x9c]
call fcn.00471ab8
test al, al
jne 0x47164d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x471884
mov eax, dword [ebp - 0x98]
sub eax, 4
je 0x471667
dec eax
je 0x4716b1
dec eax
je 0x471776
jmp 0x471869
mov eax, dword [ebp - 0x94]
sub eax, 1
jb 0x47167e
je 0x47168f
sub eax, 8
je 0x4716a0
jmp 0x471869
mov eax, ebx
mov edx, 0x4718b4
call fcn.004047d4
jmp 0x471869
mov eax, ebx
mov edx, 0x4718c8
call fcn.004047d4
jmp 0x471869
mov eax, ebx
mov edx, 0x4718dc
call fcn.004047d4
jmp 0x471869
mov eax, dword [ebp - 0x94]
sub eax, 1
jb 0x4716c6
je 0x4716f2
dec eax
je 0x47170a
jmp 0x471869
cmp byte [ebp - 2], 1
jne 0x4716da
mov eax, ebx
mov edx, 0x4718f0
call fcn.004047d4
jmp 0x4716e6
mov eax, ebx
mov edx, 0x471904
call fcn.004047d4
mov byte [0x48abe8], 1
jmp 0x471869
mov eax, ebx
mov edx, 0x47191c
call fcn.004047d4
mov byte [0x48abe8], 1
jmp 0x471869
cmp byte [ebp - 2], 1
jne 0x471726
cmp word [ebp - 0xc0], 9
jne 0x471726
mov eax, ebx
mov edx, 0x471930
call fcn.004047d4
push 0x59
call sub.user32.dll_GetSystemMetrics
test eax, eax
jne 0x471746
mov eax, ebx
mov edx, 0x471944
call fcn.004047d4
mov byte [0x48abe8], 1
jmp 0x471759
mov eax, ebx
mov edx, 0x47195c
call fcn.004047d4
mov byte [0x48abe8], 1
cmp word [ebp - 4], 0x8000
jne 0x471869
mov eax, ebx
mov edx, 0x471974
call fcn.004047d4
jmp 0x471869
mov eax, dword [ebp - 0x94]
sub eax, 1
jb 0x471792
je 0x4717ba
dec eax
je 0x4717e6
dec eax
je 0x471842
jmp 0x471869
cmp byte [ebp - 2], 1
jne 0x4717a9
mov eax, ebx
mov edx, 0x47198c
call fcn.004047d4
jmp 0x471869
mov eax, ebx
mov edx, 0x4719a0
call fcn.004047d4
jmp 0x471869
cmp byte [ebp - 2], 1
jne 0x4717ce
mov eax, ebx
mov edx, 0x4719b8
call fcn.004047d4
jmp 0x4717da
mov eax, ebx
mov edx, 0x4719cc
call fcn.004047d4
mov byte [0x48abe8], 1
jmp 0x471869
cmp byte [ebp - 2], 1
jne 0x4717fa
mov eax, ebx
mov edx, 0x4719e4
call fcn.004047d4
jmp 0x471806
mov eax, ebx
mov edx, 0x4719f8
call fcn.004047d4
lea ecx, [ebp - 0xc4]
mov edx, 0x471a10
mov eax, 0x471a28
call fcn.00470f70
mov eax, dword [ebp - 0xc4]
mov edx, 0x471a70
call fcn.00404b8c
jne 0x471839
mov eax, ebx
mov edx, 0x471a7c
call fcn.004047d4
mov byte [0x48abe8], 1
jmp 0x471869
cmp byte [ebp - 2], 1
jne 0x471856
mov eax, ebx
mov edx, 0x471a90
call fcn.004047d4
jmp 0x471862
mov eax, ebx
mov edx, 0x471aa8
call fcn.004047d4
mov byte [0x48abe8], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x471884
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4718a4
lea eax, [ebp - 0xc4]
call fcn.00404780
ret
Function at 0x473874
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404c30
mov eax, dword [ebp - 8]
call fcn.00404c30
xor eax, eax
push ebp
push 0x473942
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 4]
call fcn.00408f34
test al, al
je 0x47391a
lea eax, [ebp - 0x26]
xor ecx, ecx
mov edx, 0x1e
call fcn.00403050
xor eax, eax
mov dword [ebp - 0x26], eax
lea eax, [ebp - 0x2c]
mov ecx, 0x473958
mov edx, dword [ebp - 4]
call fcn.00404a8c
mov eax, dword [ebp - 0x2c]
call fcn.00404c40
mov dword [ebp - 0x1e], eax
lea eax, [ebp - 0x30]
mov ecx, 0x473958
mov edx, dword [ebp - 8]
call fcn.00404a8c
mov eax, dword [ebp - 0x30]
call fcn.00404c40
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x22], 2
mov word [ebp - 0x16], 0x14
lea eax, [ebp - 0x26]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x473949
lea eax, [ebp - 0x30]
mov edx, 2
call fcn.004047a4
lea eax, [ebp - 8]
mov edx, 2
call fcn.004047a4
ret

Function at 0x474620
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47474b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.00402a64
mov eax, dword [ebp - 0x1c]
call fcn.00404c40
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
mov eax, ebx
call fcn.00402704
mov esi, eax
push esi
push ebx
push 0
lea edx, [ebp - 0x20]
xor eax, eax
call fcn.00402a64
mov eax, dword [ebp - 0x20]
call fcn.00404c40
push eax
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x47475c
push esi
call sub.version.dll_VerQueryValueA
mov eax, dword [ebp - 0xc]
mov edi, dword [eax + 8]
shr edi, 0x10
mov dx, word [eax + 8]
and dx, 0xffff
mov word [ebp - 0x12], dx
mov edx, dword [eax + 0xc]
shr edx, 0x10
mov word [ebp - 0x14], dx
mov ax, word [eax + 0xc]
and ax, 0xffff
mov word [ebp - 0x16], ax
mov edx, ebx
mov eax, esi
call fcn.00402724
lea edx, [ebp - 0x24]
movzx eax, di
call fcn.00408a0c
push dword [ebp - 0x24]
push 0x474768
lea edx, [ebp - 0x28]
movzx eax, word [ebp - 0x12]
call fcn.00408a0c
push dword [ebp - 0x28]
push 0x474768
lea edx, [ebp - 0x2c]
movzx eax, word [ebp - 0x14]
call fcn.00408a0c
push dword [ebp - 0x2c]
push 0x474768
lea edx, [ebp - 0x30]
movzx eax, word [ebp - 0x16]
call fcn.00408a0c
push dword [ebp - 0x30]
mov eax, dword [ebp - 4]
mov edx, 7
call fcn.00404b00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474752
lea eax, [ebp - 0x30]
mov edx, 6
call fcn.004047a4
ret
Function at 0x474a88
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor edx, edx
mov dword [ebp - 0x24], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x474b10
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1e]
xor ecx, ecx
mov edx, 0x1e
call fcn.00403050
xor eax, eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], 3
lea eax, [ebp - 0x24]
mov ecx, 0x474b28
mov edx, ebx
call fcn.00404a8c
mov eax, dword [ebp - 0x24]
call fcn.00404c40
mov dword [ebp - 0x16], eax
mov eax, 0x474b2c
mov dword [ebp - 0x12], eax
mov word [ebp - 0xe], 0x414
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x1e]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474b17
lea eax, [ebp - 0x24]
call fcn.00404780
ret

Function at 0x474c5c
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
mov esi, eax
push 1
push 0
push 0
mov eax, esi
call fcn.00404c40
push eax
push 0
mov eax, dword [0x48ac44]
call fcn.00442270
push eax
call sub.shell32.dll_ShellExecuteA
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x474f9c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, eax
call sub.kernel32.dll_GetTickCount
mov ebx, eax
mov eax, dword [0x489c1c]
mov eax, dword [eax]
call fcn.0045bb1c
call sub.kernel32.dll_GetTickCount
mov edx, eax
sub edx, ebx
cmp esi, edx
jle 0x474fc4
cmp ebx, eax
jle 0x474fa7
pop esi
pop ebx
ret