joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45dae4
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405410
xor eax, eax
push ebp
push 0x45dc23
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
test edi, edi
je 0x45dc00
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x45dc3c
mov edx, 0x45dc48
mov eax, dword [ebp - 4]
call fcn.00456d0c
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
call fcn.00405008
cmp dword [ebp - 4], 0
je 0x45db63
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x45db63
lea eax, [ebp - 4]
push eax
mov ecx, 0x7fffffff
mov edx, 2
mov eax, dword [ebp - 4]
call fcn.00405480
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 4]
call fcn.00405420
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x45dbfe
xor eax, eax
push ebp
push 0x45dbf7
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
xor ebx, ebx
mov ebx, 0x400
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.004055ac
push ebx
lea eax, [ebp - 0xc]
call fcn.00405478
push eax
push esi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegEnumKeyA
mov ebx, eax
test ebx, ebx
jne 0x45dbdc
mov eax, dword [ebp - 0xc]
call fcn.00405420
mov edx, eax
lea eax, [ebp - 0x14]
call fcn.00405160
mov edx, dword [ebp - 0x14]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
test ebx, ebx
je 0x45db96
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45dbfe
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45dc2a
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404f94
lea eax, [ebp - 4]
call fcn.00404f70
ret
Function at 0x45dd90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405410
mov eax, dword [ebp - 8]
call fcn.00405410
xor eax, eax
push ebp
push 0x45deb2
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
push 0
lea eax, [ebp - 0x1c]
push eax
mov ecx, 0x45decc
mov edx, 0x45ded8
mov eax, dword [ebp - 4]
call fcn.00456d0c
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 4]
call fcn.00405008
cmp dword [ebp - 4], 0
je 0x45de0d
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x45de0d
lea eax, [ebp - 4]
push eax
mov ecx, 0x7fffffff
mov edx, 2
mov eax, dword [ebp - 4]
call fcn.00405480
lea eax, [ebp - 0x10]
push eax
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00405420
push eax
mov eax, dword [ebp + 8]
push eax
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x45de8f
xor eax, eax
push ebp
push 0x45de88
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x14], 4
lea eax, [ebp - 0x14]
push eax
push ebx
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00405420
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x45de71
cmp dword [ebp - 0x18], 4
jne 0x45de6d
mov byte [ebp - 9], 1
jmp 0x45de71
xor eax, eax
mov dword [ebx], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45de8f
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45deb9
lea eax, [ebp - 0x1c]
call fcn.00404f70
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404f94
ret
Function at 0x45dedc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00405410
mov eax, dword [ebp - 8]
call fcn.00405410
xor eax, eax
push ebp
push 0x45e0a6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404f70
push 0
lea eax, [ebp - 0x1c]
push eax
mov ecx, 0x45e0c0
mov edx, 0x45e0cc
mov eax, dword [ebp - 4]
call fcn.00456d0c
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 4]
call fcn.00405008
cmp dword [ebp - 4], 0
je 0x45df63
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x45df63
lea eax, [ebp - 4]
push eax
mov ecx, 0x7fffffff
mov edx, 2
mov eax, dword [ebp - 4]
call fcn.00405480
mov dword [ebp - 0x10], 0x3e8
mov eax, dword [ebp - 0x10]
call fcn.00402a58
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x45e07c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00405420
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x45e066
xor eax, eax
push ebp
push 0x45e05f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00405420
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x45e041
cmp dword [ebp - 0x14], 4
jne 0x45dffd
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x11c]
call fcn.004064d8
lea edx, [ebp - 0x11c]
mov eax, ebx
call fcn.004051cc
jmp 0x45e048
cmp dword [ebp - 0x14], 1
jne 0x45e023
mov edx, dword [ebp - 0x10]
dec edx
mov eax, ebx
call fcn.004055ac
mov eax, ebx
call fcn.00405478
mov ecx, dword [ebp - 0x10]
dec ecx
mov edx, dword [ebp - 0x18]
call fcn.00409630
jmp 0x45e048
mov eax, ebx
mov edx, dword [ebp - 0x10]
call fcn.004055ac
mov eax, ebx
call fcn.00405478
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
call fcn.00409630
jmp 0x45e048
mov eax, ebx
call fcn.00404f70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45e066
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45e083
mov eax, dword [ebp - 0x18]
call fcn.00402a78
ret
Function at 0x45e148
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00405410
mov eax, dword [ebp - 8]
call fcn.00405410
xor eax, eax
push ebp
push 0x45e28a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x45e2a8
mov edx, 0x45e2b4
mov eax, dword [ebp - 4]
call fcn.00456d0c
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 4]
call fcn.00405008
cmp dword [ebp - 4], 0
je 0x45e1ca
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x45e1ca
lea eax, [ebp - 4]
push eax
mov ecx, 0x7fffffff
mov edx, 2
mov eax, dword [ebp - 4]
call fcn.00405480
lea eax, [ebp - 0x10]
push eax
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00405420
push eax
mov eax, dword [ebp + 8]
push eax
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x45e267
xor eax, eax
push ebp
push 0x45e260
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebx], eax
push ebx
push 0
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00405420
mov edi, eax
push edi
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x45e249
mov eax, dword [ebx]
call fcn.00402a58
mov dword [esi], eax
push ebx
mov eax, dword [esi]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push edi
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x45e242
mov byte [ebp - 9], 1
jmp 0x45e249
mov eax, dword [esi]
call fcn.00402a78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45e267
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45e291
lea eax, [ebp - 0x18]
call fcn.00404f70
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404f94
ret
Function at 0x45e870
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405410
xor eax, eax
push ebp
push 0x45e9a1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4159bc]
call fcn.00404150
mov dword [ebp - 8], eax
lea eax, [ebp - 0x150]
push eax
mov eax, dword [ebp - 4]
call fcn.00405420
push eax
call sub.KERNEL32.DLL_FindFirstFileA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x45e983
xor edx, edx
push ebp
push 0x45e97c
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x10]
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.004051d8
mov eax, dword [ebp - 0x10]
mov edx, 0x45e9bc
call fcn.0040536c
je 0x45e94d
mov eax, dword [ebp - 0x10]
mov edx, 0x45e9c8
call fcn.0040536c
je 0x45e94d
mov eax, dword [ebp - 0x150]
and eax, 0x10
cmp eax, 0x10
sete al
test bl, bl
jne 0x45e922
test al, al
jne 0x45e94d
mov eax, 0x140
call fcn.00402a58
mov esi, eax
lea edx, [ebp - 0x150]
mov ecx, 0x140
mov eax, esi
call fcn.00409630
mov ecx, esi
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi + 0x3c]
lea eax, [ebp - 0x150]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
jne 0x45e8da
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45e983
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_FindClose
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45e9a8
lea eax, [ebp - 0x10]
call fcn.00404f70
lea eax, [ebp - 4]
call fcn.00404f70
ret
Function at 0x45e9cc
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd9c
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x264], ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00405ae0
xor eax, eax
push ebp
push 0x45eb01
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4159bc]
call fcn.00404150
mov dword [ebp - 8], eax
lea eax, [ebp - 0x260]
push eax
mov eax, dword [ebp - 4]
call fcn.00405854
push eax
call sub.KERNEL32.DLL_FindFirstFileW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x45ead8
xor edx, edx
push ebp
push 0x45ead1
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x10]
lea edx, [ebp - 0x234]
mov ecx, 0x104
call fcn.00405828
mov eax, dword [ebp - 0x10]
mov edx, 0x45eb18
call fcn.0040597c
je 0x45eaa6
mov eax, dword [ebp - 0x10]
mov edx, 0x45eb20
call fcn.0040597c
je 0x45eaa6
mov eax, dword [ebp - 0x260]
and eax, 0x10
cmp eax, 0x10
sete al
test bl, bl
jne 0x45ea84
test al, al
jne 0x45eaa6
lea edx, [ebp - 0x264]
mov eax, dword [ebp - 0x10]
call fcn.00456840
mov edx, dword [ebp - 0x264]
mov ecx, dword [ebp - 0x260]
mov eax, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi + 0x3c]
lea eax, [ebp - 0x260]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_FindNextFileW
test eax, eax
jne 0x45ea3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ead8
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_FindClose
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45eb08
lea eax, [ebp - 0x264]
call fcn.00404f70
lea eax, [ebp - 0x10]
call fcn.00405660
lea eax, [ebp - 4]
call fcn.00405660
ret
Function at 0x45ed5c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x45ed64
push ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00405ae0
xor eax, eax
push ebp
push 0x45ee88
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.KERNEL32.DLL_GetTickCount
xor edx, edx
push edx
push eax
lea edx, [ebp - 8]
mov eax, 8
call fcn.00458be4
push dword [ebp - 4]
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00405844
push dword [ebp - 0x14]
lea edx, [ebp - 0x1c]
mov eax, 0x45eea0
call fcn.0045846c
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
call fcn.00405844
push dword [ebp - 0x18]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00405934
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.004051f0
mov eax, dword [ebp - 8]
call fcn.00405228
push eax
lea eax, [ebp - 8]
call fcn.00405478
push eax
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0xc]
call fcn.00405844
mov ecx, dword [ebp - 0x20]
pop eax
pop edx
call fcn.0045b790
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0xc]
call fcn.00405844
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.0045bc94
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 8]
call fcn.0040536c
sete bl
mov eax, dword [ebp - 0xc]
call fcn.00405420
push eax
call sub.KERNEL32.DLL_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ee8f
lea eax, [ebp - 0x28]
call fcn.00405660
lea eax, [ebp - 0x24]
call fcn.00404f70
lea eax, [ebp - 0x20]
call fcn.00405660
lea eax, [ebp - 0x1c]
call fcn.00404f70
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00405678
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404f94
lea eax, [ebp - 4]
call fcn.00405660
ret
Function at 0x46010c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x46023f
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea edx, [ebp - 0x1c]
mov eax, 0x460258
call fcn.00458524
mov eax, dword [ebp - 0x1c]
push eax
lea edx, [ebp - 0x20]
mov eax, 0x460284
call fcn.00458524
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 8]
pop ecx
call fcn.00405274
mov dword [ebp - 0x14], 0x3e8
mov eax, dword [ebp - 0x14]
call fcn.00402a58
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x460215
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 8]
call fcn.00405420
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4601ff
xor eax, eax
push ebp
push 0x4601f8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
lea edx, [ebp - 0x24]
mov eax, 0x4602ac
call fcn.00457b84
mov eax, dword [ebp - 0x24]
call fcn.00405420
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x4601e1
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4601ff
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46021c
mov eax, dword [ebp - 0x18]
call fcn.00402a78
ret
Function at 0x4607d0
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x4608e8
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [edi + 8]
cmp eax, dword [esi + 8]
jne 0x4608cd
test eax, eax
jne 0x46081c
mov eax, dword [esi + 0x10]
push eax
mov eax, dword [edi + 0x10]
push eax
call sub.advapi32.dll_EqualSid
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x4608cd
cmp eax, 3
jne 0x460841
mov ebx, dword [edi + 0x10]
mov esi, dword [esi + 0x10]
mov eax, dword [esi + 0x24]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.advapi32.dll_EqualSid
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
jmp 0x4608cd
cmp eax, 1
jne 0x460885
lea eax, [ebp - 8]
mov edx, dword [edi + 0x10]
call fcn.00405160
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00456e44
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x10]
mov edx, dword [esi + 0x10]
call fcn.00405160
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00456e44
mov edx, dword [ebp - 0xc]
pop eax
call fcn.0040536c
jne 0x4608cd
mov bl, 1
jmp 0x4608cd
cmp eax, 4
jne 0x4608cd
mov edi, dword [edi + 0x10]
mov esi, dword [esi + 0x10]
lea eax, [ebp - 0x18]
mov edx, dword [edi + 0x10]
call fcn.00405190
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00456e44
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x20]
mov edx, dword [esi + 0x10]
call fcn.00405190
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.00456e44
mov edx, dword [ebp - 0x1c]
pop eax
call fcn.0040536c
jne 0x4608cd
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4608ef
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.00404f94
ret

Function at 0x460d94
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405410
xor eax, eax
push ebp
push 0x460e48
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xc], 0xffffffff
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
call fcn.00405420
push eax
call sub.KERNEL32.DLL_GetDiskFreeSpaceA
test eax, eax
je 0x460e32
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x18]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x14]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
call fcn.00406220
call fcn.00406220
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
fild qword [ebp - 0x30]
fdiv dword [0x460e5c]
call fcn.00402ecc
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460e4f
lea eax, [ebp - 4]
call fcn.00404f70
ret
Function at 0x460ea4
Capabilities:
Access peb ldr_data
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405410
mov eax, dword [ebp - 8]
call fcn.00405410
xor eax, eax
push ebp
push 0x460f48
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4b8a8c]
mov byte [eax], 1
mov byte [ebx + 8], 0
mov al, byte [ebp + 8]
mov byte [ebx + 0x34], al
inc dword [0x4bc3ec]
xor eax, eax
mov dword [ebx + 0xc], eax
lea eax, [ebx + 0x20]
mov edx, dword [ebp - 4]
call fcn.00404fc4
lea eax, [ebx + 0x24]
mov edx, dword [ebp - 8]
call fcn.00404fc4
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [ebx + 0x30], eax
lea eax, [ebp - 0xc]
push eax
push 4
push ebx
push 0x460e60
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [ebx + 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460f4f
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404f94
ret

Function at 0x46196c
Capabilities:
Enumerate gui resources
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405410
xor eax, eax
push ebp
push 0x461a48
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
call fcn.004615c8
mov esi, eax
test esi, esi
jle 0x461a32
test ebx, ebx
jle 0x4619d0
push esi
push 0x46193c
call sub.user32.dll_EnumWindows
jmp 0x4619c0
push 0x64
call sub.KERNEL32.DLL_Sleep_2
sub ebx, 0x64
test ebx, ebx
jle 0x4619d0
mov eax, dword [ebp - 4]
call fcn.00461578
test al, al
jne 0x4619b6
mov eax, dword [ebp - 4]
call fcn.00461578
test al, al
je 0x461a32
push esi
push 0
push 0x1f0fff
call sub.KERNEL32.DLL_OpenProcess
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x461a2b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_GetExitCodeProcess
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461a32
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461a4f
lea eax, [ebp - 4]
call fcn.00404f70
ret
Function at 0x461bc8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
push ebx
xor edx, edx
mov dword [ebp - 0x118], edx
mov dword [ebp - 0x11c], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405410
xor eax, eax
push ebp
push 0x461c7a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x11c]
mov edx, dword [ebp - 4]
call fcn.00405844
mov eax, dword [ebp - 0x11c]
lea edx, [ebp - 0x118]
call fcn.00455ef8
mov edx, dword [ebp - 0x118]
lea eax, [ebp - 4]
call fcn.004051f0
xor ebx, ebx
push ebx
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0x101
lea eax, [ebp - 0x111]
push eax
mov eax, dword [ebp - 4]
call fcn.00405420
push eax
call sub.KERNEL32.DLL_GetVolumeInformationA
mov ebx, dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461c81
lea eax, [ebp - 0x11c]
mov edx, 2
call fcn.00405678
lea eax, [ebp - 4]
call fcn.00404f70
ret

Function at 0x462044
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x462100
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, 0x462114
call fcn.00458524
lea eax, [ebp - 4]
mov edx, 0x3e8
call fcn.004055ac
mov eax, dword [ebp - 4]
call fcn.00405228
push eax
lea eax, [ebp - 4]
call fcn.00405478
push eax
mov eax, dword [ebp - 8]
call fcn.00405420
push eax
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
mov edx, eax
dec edx
lea eax, [ebp - 4]
call fcn.004055ac
mov eax, dword [ebx]
mov edx, dword [ebp - 8]
call fcn.0040536c
jne 0x4620b8
mov eax, ebx
call fcn.00404f70
jmp 0x4620d8
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.00405844
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00455ef8
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004051f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462107
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00405678
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404f94
ret

Function at 0x462660
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00405410
lea eax, [ebp - 0x14]
mov edx, dword [0x459db0]
call fcn.00405b00
xor eax, eax
push ebp
push 0x4626e1
push dword fs:[eax]
mov dword fs:[eax], esp
test edi, edi
je 0x4626bd
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], edi
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.00405008
mov byte [ebp - 8], bl
lea eax, [ebp - 0x14]
push eax
push 0x462528
call sub.user32.dll_EnumWindows
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4626e8
lea eax, [ebp - 0x14]
mov edx, dword [0x459db0]
call fcn.00405bd0
lea eax, [ebp - 4]
call fcn.00404f70
ret