joyce8/EMBER2024-capa huggingface dataset:
Function at 0x467b5c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0044f74c
lea edx, [ebp - 6]
mov ecx, 2
mov eax, ebx
call fcn.0044f724
cmp word [ebp - 6], 0x5a4d
je 0x467b99
mov eax, 0x467cd4
call fcn.00467ad4
mov edx, 0x3c
mov eax, ebx
call fcn.0044f74c
lea edx, [ebp - 0xc]
mov ecx, 4
mov eax, ebx
call fcn.0044f724
cmp dword [ebp - 0xc], 0
jne 0x467bc4
mov eax, 0x467cf8
call fcn.00467ad4
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.0044f74c
lea edx, [ebp - 0x10]
mov ecx, 4
mov eax, ebx
call fcn.0044f724
cmp dword [ebp - 0x10], 0x4550
je 0x467bf0
mov eax, 0x467d1c
call fcn.00467ad4
lea edx, [ebp - 0x24]
mov ecx, 0x14
mov eax, ebx
call fcn.0044f724
movzx eax, word [ebp - 0x14]
cmp eax, 0xe0
je 0x467c14
mov eax, 0x467d40
call fcn.00467ad4
lea edx, [ebp - 0x104]
mov ecx, 0xe0
mov eax, ebx
call fcn.0044f724
cmp word [ebp - 0x104], 0x10b
je 0x467c3b
mov eax, 0x467d64
call fcn.00467ad4
cmp dword [ebp - 0x94], 0
je 0x467c4d
cmp dword [ebp - 0x90], 0
jne 0x467c57
mov eax, 0x467d88
call fcn.00467ad4
mov eax, dword [ebp - 0x94]
mov dword [edi], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax], edx
movzx esi, word [ebp - 0x22]
dec esi
test esi, esi
jl 0x467cb0
inc esi
lea edx, [ebp - 0x12c]
mov ecx, 0x28
mov eax, ebx
call fcn.0044f724
mov eax, dword [edi]
cmp eax, dword [ebp - 0x120]
jne 0x467cad
cmp dword [ebp - 0x11c], 0
je 0x467cad
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x118]
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x11c]
mov dword [eax], edx
jmp 0x467cb0
dec esi
jne 0x467c70
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x467cc2
mov eax, 0x467da4
call fcn.00467ad4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x469bac
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x469ca9
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 2
lea eax, [ebp - 4]
push eax
xor eax, eax
mov al, byte [0x49022f]
mov ecx, dword [eax*4 + 0x48eaec]
mov edx, 0x80000002
xor eax, eax
call fcn.0042dc1c
test eax, eax
jne 0x469c31
mov eax, esi
call fcn.0040358c
inc eax
push eax
mov eax, esi
call fcn.00403750
push eax
push 1
push 0
mov eax, edi
call fcn.00403750
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.004057f4
test eax, eax
je 0x469c26
mov eax, 0x469cc0
call fcn.00455348
mov eax, dword [ebp - 4]
push eax
call fcn.004057ac
jmp 0x469c3b
mov eax, 0x469cf4
call fcn.00455348
test bl, bl
je 0x469c8e
mov eax, esi
call fcn.00403750
push eax
call fcn.00405b8c
test eax, eax
je 0x469c62
push 0
push 0
push 0x1d
push 0xffff
call fcn.0040614c
jmp 0x469c8e
lea ecx, [ebp - 0xc]
mov edx, 0x469d20
mov al, 0x33
call fcn.004503a4
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.0042e4d0
mov eax, dword [ebp - 8]
mov edx, dword [0x48fc1c]
call fcn.00468468
test al, al
je 0x469c3f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x469cb0
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403438
ret
Function at 0x46cafc
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov edi, ecx
mov esi, edx
mov byte [ebp - 1], al
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x46cbd0
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
je 0x46cbba
lea edx, [ebp - 0x18]
mov eax, esi
call fcn.00451920
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x46cbe8
call fcn.00455538
mov edx, ebx
mov eax, dword [0x4901ac]
call fcn.0040b420
mov ebx, eax
mov eax, dword [ebx]
push eax
mov eax, dword [ebx]
call fcn.0040358c
mov ecx, 0x14
cdq
idiv ecx
push eax
mov ecx, edi
mov edx, esi
mov al, byte [ebp - 1]
call fcn.00459f24
test al, al
jne 0x46cbba
call fcn.00405934
cmp eax, 2
jne 0x46cb9f
mov eax, 0x46cc1c
call fcn.00455348
jmp 0x46cbba
call fcn.00405934
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
lea edx, [ebp - 0x20]
xor ecx, ecx
mov eax, 0x46cc78
call fcn.00455538
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46cbd7
lea eax, [ebp - 0x18]
call fcn.00403418
ret
Function at 0x46e2d4
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x148], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46e426
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x144]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0042c3e0
lea eax, [ebp - 0x148]
mov edx, 0x46e43c
call fcn.00403594
mov eax, dword [ebp - 0x148]
call fcn.00403750
push eax
call fcn.0040587c
mov ebx, eax
cmp ebx, 0xffffffff
je 0x46e405
lea eax, [ebp - 4]
lea edx, [ebp - 0x118]
mov ecx, 0x104
call fcn.00403574
mov eax, dword [ebp - 4]
call fcn.0040358c
cmp eax, 9
jl 0x46e3ea
lea eax, [ebp - 0x148]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00403790
mov eax, dword [ebp - 0x148]
mov edx, 0x46e450
call fcn.00406a24
test eax, eax
jne 0x46e3ea
mov eax, dword [ebp - 4]
mov al, byte [eax + 5]
add al, 0xd0
sub al, 0xa
jae 0x46e3ea
mov eax, dword [ebp - 4]
mov al, byte [eax + 6]
add al, 0xd0
sub al, 0xa
jae 0x46e3ea
mov eax, dword [ebp - 4]
mov al, byte [eax + 7]
add al, 0xd0
sub al, 0xa
jae 0x46e3ea
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0x2e
jne 0x46e3ea
lea eax, [ebp - 0x148]
push eax
mov ecx, 3
mov edx, 6
mov eax, dword [ebp - 4]
call fcn.00403790
mov eax, dword [ebp - 0x148]
call fcn.00406d30
mov edx, dword [ebp + 8]
mov byte [edx + eax - 0x3ec], 1
lea eax, [ebp - 0x144]
push eax
push ebx
call fcn.00405884
test eax, eax
jne 0x46e33d
push ebx
call fcn.00405874
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46e42d
lea eax, [ebp - 0x148]
call fcn.00403418
lea eax, [ebp - 4]
call fcn.00403418
ret

Function at 0x46ea10
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, 0x490028
mov esi, dword [ebp + 8]
add esi, 0xfffffff0
cmp dword [esi], 0
je 0x46ea7e
jmp 0x46ea3c
mov edx, 0x46ea8c
mov al, 0x41
call fcn.0046e8c0
test al, al
jne 0x46ea3c
call fcn.00408b78
mov eax, dword [ebx]
call fcn.00406ee8
test al, al
je 0x46ea27
jmp 0x46ea5e
mov edx, 0x46eaa0
mov al, 0x40
call fcn.0046e8c0
test al, al
jne 0x46ea5e
call fcn.00408b78
mov eax, dword [ebx]
call fcn.00403750
push eax
mov eax, dword [esi]
call fcn.00403750
push eax
call fcn.00405a54
test eax, eax
je 0x46ea49
mov eax, esi
call fcn.00403418
pop esi
pop ebx
pop ebp
ret
Function at 0x473f64
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x473f6c
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4740d7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.00451d94
mov edx, dword [ebp - 0x10]
mov eax, 0x48fff8
call fcn.00403468
mov edx, 0x4740f0
lea eax, [ebp - 0x10]
call fcn.004034ac
lea eax, [ebp - 0x10]
mov edx, dword [0x48fff8]
call fcn.00403594
mov eax, dword [ebp - 0x10]
call fcn.00455348
cmp byte [0x48fee8], 0
je 0x473fcf
mov eax, dword [0x48fff8]
call fcn.00454c6c
lea edx, [ebp - 0x10]
mov eax, dword [0x48fff8]
call fcn.0042c3e0
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
mov ecx, 0x474118
call fcn.004035d8
push 0
mov eax, dword [ebp - 4]
call fcn.00403750
push eax
call fcn.0040581c
test eax, eax
jne 0x474061
call fcn.00405934
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x20]
mov edx, dword [ebp - 4]
mov al, 0x2f
call fcn.004503a4
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
lea edx, [ebp - 0x24]
mov eax, ebx
call fcn.00406d00
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
lea edx, [ebp - 0x28]
mov eax, ebx
call fcn.0042e638
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1c]
mov ecx, 2
mov al, 0x60
call fcn.00450374
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, 0x406360
call fcn.00408ba4
call fcn.00403134
lea eax, [ebp - 0xc]
mov ecx, 0x474128
mov edx, dword [ebp - 4]
call fcn.004035d8
mov edx, dword [ebp - 0xc]
mov eax, 0x474140
call fcn.00473f0c
lea eax, [ebp - 8]
call fcn.00455f20
cmp dword [ebp - 8], 0
je 0x4740af
lea eax, [ebp - 0xc]
mov ecx, 0x474154
mov edx, dword [ebp - 4]
call fcn.004035d8
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00473f0c
mov eax, dword [ebp - 0xc]
call fcn.00455f8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4740de
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.00403438
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00403438
ret
Function at 0x475440
Capabilities:
Identify system language via api

Disassembly:
push ebx
push esi
push edi
push ebp
cmp byte [0x490157], 0
sete byte [0x49022c]
cmp dword [0x48ff80], 0
je 0x47549e
mov eax, dword [0x4901a4]
mov edi, dword [eax + 8]
dec edi
test edi, edi
jl 0x47549e
inc edi
xor esi, esi
mov edx, esi
mov eax, dword [0x4901a4]
call fcn.0040b420
mov edx, dword [eax]
mov eax, dword [0x48ff80]
call fcn.00406a24
test eax, eax
jne 0x47549a
mov eax, esi
call fcn.00475288
mov byte [0x49022c], 0
jmp 0x475573
inc esi
dec edi
jne 0x47546b
mov al, byte [0x490158]
sub al, 1
jb 0x4754ab
je 0x4754b4
jmp 0x4754bd
call fcn.0042e23c
mov ebp, eax
jmp 0x4754bf
call fcn.004059b4
mov ebp, eax
jmp 0x4754bf
xor ebp, ebp
test bp, bp
je 0x47555c
mov eax, dword [0x4901a4]
mov edi, dword [eax + 8]
dec edi
test edi, edi
jl 0x47550b
inc edi
xor esi, esi
mov edx, esi
mov eax, dword [0x4901a4]
call fcn.0040b420
mov ebx, eax
movzx eax, bp
cmp eax, dword [ebx + 0x28]
jne 0x475507
cmp dword [ebx + 0x2c], 0
je 0x4754fe
call fcn.004058bc
cmp eax, dword [ebx + 0x2c]
jne 0x475507
mov eax, esi
call fcn.00475288
jmp 0x475573
inc esi
dec edi
jne 0x4754d8
mov eax, dword [0x4901a4]
mov edi, dword [eax + 8]
dec edi
test edi, edi
jl 0x47555c
inc edi
xor esi, esi
mov edx, esi
mov eax, dword [0x4901a4]
call fcn.0040b420
mov ebx, eax
mov eax, dword [ebx + 0x28]
and eax, 0x3ff
mov edx, ebp
and dx, 0x3ff
movzx edx, dx
cmp eax, edx
jne 0x475558
cmp dword [ebx + 0x2c], 0
je 0x47554f
call fcn.004058bc
cmp eax, dword [ebx + 0x2c]
jne 0x475558
mov eax, esi
call fcn.00475288
jmp 0x475573
inc esi
dec edi
jne 0x47551b
xor eax, eax
call fcn.00475288
cmp byte [0x490157], 2
jne 0x475573
mov byte [0x49022c], 1
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x47694c
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x158], ebx
mov dword [ebp - 0x15c], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x476b48
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
push edi
push dword [ebp - 4]
lea eax, [ebp - 8]
mov edx, 3
call fcn.0040364c
xor eax, eax
mov dword [ebx + 4], eax
xor eax, eax
mov dword [ebx], eax
lea eax, [ebp - 0x154]
push eax
mov eax, dword [ebp - 8]
call fcn.00403750
push eax
call fcn.0040587c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x476a07
mov eax, dword [ebp - 0x154]
test al, 0x10
jne 0x4769ea
cmp byte [ebp + 0x10], 0
je 0x4769ce
test al, 2
jne 0x4769ea
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.00430264
lea eax, [ebp - 0x154]
push eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.00405884
test eax, eax
jne 0x4769ba
mov eax, dword [ebp - 0xc]
push eax
call fcn.00405874
cmp byte [ebp + 0xc], 0
je 0x476b22
lea eax, [ebp - 0x154]
push eax
mov edx, esi
lea eax, [ebp - 0x158]
call fcn.004034ac
lea eax, [ebp - 0x158]
mov edx, edi
call fcn.00403594
lea eax, [ebp - 0x158]
mov edx, 0x476b60
call fcn.00403594
mov eax, dword [ebp - 0x158]
call fcn.00403750
push eax
call fcn.0040587c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x476b22
xor eax, eax
push ebp
push 0x476b1b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x154]
call fcn.004749e4
test al, al
je 0x476aec
mov eax, dword [ebp + 0x14]
push eax
mov al, byte [ebp + 0x10]
push eax
mov al, byte [ebp + 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
mov edx, edi
lea eax, [ebp - 0x158]
call fcn.004034ac
lea eax, [ebp - 0x15c]
lea edx, [ebp - 0x128]
mov ecx, 0x104
call fcn.00403574
mov edx, dword [ebp - 0x15c]
lea eax, [ebp - 0x158]
call fcn.00403594
lea eax, [ebp - 0x158]
mov edx, 0x476b6c
call fcn.00403594
mov edx, dword [ebp - 0x158]
mov ecx, dword [ebp - 4]
mov eax, esi
call fcn.0047694c
pop ecx
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.00430264
lea eax, [ebp - 0x154]
push eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.00405884
test eax, eax
jne 0x476a6e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x476b22
mov eax, dword [ebp - 0xc]
push eax
call fcn.00405874
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x476b4f
lea eax, [ebp - 0x15c]
mov edx, 2
call fcn.00403438
lea eax, [ebp - 8]
call fcn.00403418
ret
Function at 0x47a09c
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
cmp dword [0x48ff3c], 0
je 0x47a133
mov eax, dword [0x48ff3c]
call fcn.0041835c
test al, al
je 0x47a133
mov eax, dword [0x48ff3c]
cmp byte [eax + 0xc7], 0
je 0x47a0e3
cmp byte [ebx + 0x1b5], 0
jne 0x47a0e3
mov eax, dword [0x48f628]
mov eax, dword [eax + 0x20]
push eax
call fcn.00406034
test eax, eax
je 0x47a0e7
xor eax, eax
jmp 0x47a0e9
mov al, 1
mov ebx, eax
push 0xfffffffffffffff0
mov eax, dword [0x48ff3c]
call fcn.004181c4
push eax
call fcn.00405fd4
test eax, 0x10000000
setne al
cmp bl, al
je 0x47a133
test bl, bl
je 0x47a121
push 5
mov eax, dword [0x48ff3c]
call fcn.004181c4
push eax
call fcn.004061f4
jmp 0x47a133
push 0
mov eax, dword [0x48ff3c]
call fcn.004181c4
push eax
call fcn.004061f4
pop ebx
ret

Function at 0x47a1dc
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
add esp, 0xffffffd8
mov byte [0x490230], 0
push 0x47a2b4
call fcn.0040595c
mov ebx, eax
push 0x47a2c4
push ebx
call fcn.00405974
test eax, eax
je 0x47a268
lea edx, [esp + 4]
push edx
call eax
push 0x47a2d8
push ebx
call fcn.00405974
mov esi, eax
test esi, esi
je 0x47a272
push esp
call fcn.004058dc
push eax
call esi
test eax, eax
je 0x47a272
cmp dword [esp], 0
je 0x47a272
call fcn.00450b60
test al, al
je 0x47a272
push 0x47a2e8
push ebx
call fcn.00405974
test eax, eax
je 0x47a272
push 0x47a304
push 0x47a314
call fcn.0040595c
push eax
call fcn.00405974
test eax, eax
je 0x47a272
mov byte [0x490230], 1
jmp 0x47a272
lea eax, [esp + 4]
push eax
call fcn.0040599c
mov ax, word [esp + 4]
sub ax, 1
jb 0x47a28b
sub ax, 5
je 0x47a294
sub ax, 3
je 0x47a29d
jmp 0x47a2a6
mov byte [0x48eb4c], 1
jmp 0x47a2ad
mov byte [0x48eb4c], 3
jmp 0x47a2ad
mov byte [0x48eb4c], 2
jmp 0x47a2ad
mov byte [0x48eb4c], 0
add esp, 0x28
pop esi
pop ebx
ret

Function at 0x47a324
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push 0
push 1
lea eax, [ebp - 4]
push eax
mov ecx, 0x47a394
mov edx, 0x80000002
xor eax, eax
call fcn.0042dc1c
test eax, eax
jne 0x47a38d
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x47a3c0
mov eax, dword [ebp - 4]
push eax
call fcn.004057ec
test eax, eax
jne 0x47a384
cmp dword [ebp - 0xc], 4
jne 0x47a384
cmp dword [ebp - 8], 4
jne 0x47a384
mov ax, word [ebp - 0x10]
mov word [0x490244], ax
mov eax, dword [ebp - 4]
push eax
call fcn.004057ac
mov esp, ebp
pop ebp
ret
Function at 0x47a508
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffed0
mov dword [esp], 0x94
push esp
call fcn.004059c4
test eax, eax
je 0x47a5ba
xor eax, eax
mov al, byte [esp + 4]
shl eax, 0x18
xor edx, edx
mov dl, byte [esp + 8]
shl edx, 0x10
or eax, edx
movzx edx, word [esp + 0xc]
or eax, edx
mov dword [0x490240], eax
cmp byte [0x49022f], 0
je 0x47a5ba
mov eax, dword [esp + 4]
cmp eax, 5
jl 0x47a5ab
mov dword [esp + 0x94], 0x9c
lea eax, [esp + 0x94]
push eax
call fcn.004059c4
test eax, eax
je 0x47a5ba
xor eax, eax
mov al, byte [esp + 0x128]
shl eax, 8
xor edx, edx
mov dl, byte [esp + 0x12a]
or ax, dx
mov word [0x490244], ax
mov al, byte [esp + 0x12e]
mov byte [0x490246], al
mov ax, word [esp + 0x12c]
mov word [0x490248], ax
jmp 0x47a5ba
cmp eax, 4
jne 0x47a5ba
call fcn.0047a324
call fcn.0047a3cc
add esp, 0x130
ret
Function at 0x483130
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x4832d1
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 0x10]
mov ecx, 0x200
xor edx, edx
call fcn.004034f8
push 0
xor eax, eax
mov al, byte [ebp + 8]
mov eax, dword [eax*4 + 0x48ef3c]
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00403750
mov ecx, eax
mov edx, edi
mov eax, ebx
call fcn.0042dc1c
test eax, eax
jne 0x4832b6
xor edx, edx
push ebp
push 0x4832ab
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [esi]
xor ecx, ecx
mov edx, dword [esi + 4]
call fcn.0043605c
xor ebx, ebx
mov eax, dword [ebp - 0x10]
call fcn.0040358c
mov dword [ebp - 0x18], eax
cmp byte [ebp + 8], 0
je 0x4831e8
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
call fcn.0040375c
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
call fcn.004057cc
jmp 0x483207
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
call fcn.0040375c
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
call fcn.004057d4
sub eax, 1
jb 0x483255
sub eax, 0xe9
je 0x48321a
sub eax, 0x19
je 0x483294
jmp 0x48324e
mov eax, dword [ebp - 0x10]
call fcn.0040358c
cmp eax, 0x10000
jl 0x483233
call fcn.004031d4
jmp 0x4832b6
mov eax, dword [ebp - 0x10]
call fcn.0040358c
mov ecx, eax
add ecx, ecx
lea eax, [ebp - 0x10]
xor edx, edx
call fcn.004034f8
jmp 0x4831b6
call fcn.004031d4
jmp 0x4832b6
lea ecx, [ebx + 1]
mov eax, dword [esi]
mov edx, dword [esi + 4]
call fcn.0043605c
lea eax, [ebp - 0x10]
call fcn.0040375c
mov edx, eax
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
call fcn.004034f8
lea ecx, [ebp - 0x24]
mov eax, esi
mov edx, ebx
call fcn.00442a7c
lea eax, [ebp - 0x24]
mov edx, dword [ebp - 0x14]
call fcn.00435014
inc ebx
jmp 0x4831b6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4832b2
mov eax, dword [ebp - 0xc]
push eax
call fcn.004057ac
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4832d8
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00403438
ret
Function at 0x48ba08
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x48baab
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x48bac4
push ebx
push 0x48bad0
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040364c
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402934
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403750
push eax
push 0
call fcn.0040584c
test eax, eax
jne 0x48ba89
mov eax, dword [0x48fcf4]
call fcn.0048b960
mov eax, dword [ebp - 0x54]
push eax
call fcn.004057fc
mov ebx, dword [ebp - 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48bab2
lea eax, [ebp - 4]
call fcn.00403418
ret
Function at 0x48c0bc
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48c28d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.0042d830
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00451c2c
test al, al
jne 0x48c123
xor eax, eax
push ebp
push 0x48c119
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
xor eax, eax
call fcn.00451f7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48c123
push 0
mov eax, dword [ebp - 4]
call fcn.00403750
push eax
mov eax, dword [0x490310]
call fcn.00403750
push eax
call fcn.00405814
test eax, eax
jne 0x48c14c
mov eax, dword [0x48fcf0]
call fcn.0048b960
push 0x80
mov eax, dword [ebp - 4]
call fcn.00403750
push eax
call fcn.00405abc
push 0
mov eax, dword [0x48f014]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x48c29c
push 0x48c2a0
push 0
call fcn.00405e14
mov dword [ebp - 8], eax
push 0x48bb10
push 0xfffffffffffffffc
mov eax, dword [ebp - 8]
push eax
call fcn.004061b4
mov dword [0x490338], eax
xor eax, eax
push ebp
push 0x48c260
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x97
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x48f628]
mov eax, dword [eax + 0x20]
push eax
call fcn.004061c4
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x24]
xor eax, eax
call fcn.0042d308
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
lea edx, [ebp - 0x20]
mov ecx, 1
mov eax, 0x48c2b0
call fcn.0040788c
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x24]
call fcn.0042d178
mov edx, dword [ebp - 0x24]
pop eax
call fcn.00403594
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0048ba08
mov dword [ebp - 0xc], eax
call fcn.0048bad4
test al, al
jne 0x48c240
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xc]
push eax
push 1
call fcn.004060ac
dec eax
je 0x48c220
mov eax, dword [ebp - 0xc]
push eax
call fcn.004057fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c267
mov eax, dword [ebp - 8]
push eax
call fcn.00405e54
ret
Function at 0x48cfec
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x48d21b
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x48d234
mov eax, dword [0x48f628]
call fcn.004242a8
push 5
mov eax, dword [0x48f628]
mov eax, dword [eax + 0x20]
push eax
call fcn.004061f4
xor eax, eax
push ebp
push 0x48d1e7
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00475ee8
lea eax, [ebp - 0x10]
call fcn.0042d780
mov eax, dword [ebp - 0x10]
call fcn.00407240
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.0042d308
mov edx, dword [ebp - 0x10]
mov eax, 0x490310
call fcn.00403468
call fcn.0048bcac
push 2
push 0
push 1
mov ecx, dword [0x490310]
mov dl, 1
mov eax, 0x44f52c
call fcn.0044f788
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48d115
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 4]
mov edx, dword [ebp - 0x18]
sub edx, 8
mov eax, dword [ebp - 4]
call fcn.0044f74c
lea edx, [ebp - 0xc]
mov ecx, 8
mov eax, dword [ebp - 4]
call fcn.0044f724
cmp dword [ebp - 0xc], 0x67734d49
je 0x48d0f0
lea ecx, [ebp - 0x10]
mov edx, 0x48d248
mov eax, dword [0x490310]
call fcn.0042c484
mov edx, dword [ebp - 0x10]
mov eax, 0x490318
call fcn.00403468
mov cl, 1
xor edx, edx
mov eax, dword [0x490318]
call fcn.004504f8
jmp 0x48d0ff
mov cl, 1
mov edx, dword [ebp - 8]
mov eax, dword [0x490310]
call fcn.004504f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48d11c
mov eax, dword [ebp - 4]
call fcn.00402b70
ret