joyce8/EMBER2024-capa huggingface dataset:
Function at 0x466f94
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x46705c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00407a60
xor eax, eax
push ebp
push 0x467036
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, esi
call fcn.004088f4
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsW
mov ebx, eax
test ebx, ebx
jle 0x46702c
inc ebx
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x466f68]
call fcn.00409de8
add esp, 4
push ebx
mov eax, dword [ebp - 4]
push eax
mov eax, esi
call fcn.004088f4
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsW
test eax, eax
je 0x467014
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.0040894c
push 0
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x466f68]
call fcn.00409de8
add esp, 4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x467040
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467063
lea eax, [ebp - 4]
mov edx, dword [0x466f68]
call fcn.00409f0c
ret

Function at 0x46ad00
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x2001f
push 0
push 0x46ad9c
push 0
mov eax, ebx
call fcn.004088f4
push eax
mov eax, dword [ebp + 8]
push eax
call sub.advapi32.dll_RegCreateKeyExW
mov ebx, eax
test ebx, ebx
jne 0x46ad77
mov ebx, esi
test ebx, ebx
je 0x46ad49
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, esi
call fcn.004088f4
push eax
push 1
push 0
mov eax, edi
call fcn.004088f4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
test ebx, ebx
je 0x46ad92
mov ecx, dword [0x4e97c0]
mov dl, 1
mov eax, dword [0x469248]
call fcn.00423890
call fcn.00407158
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x46bd50
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x208], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46be1f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00407a60
xor edx, edx
push ebp
push 0x46bdfc
push dword fs:[edx]
mov dword fs:[edx], esp
push 0xff
lea eax, [ebp - 0x200]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
test eax, eax
je 0x46bdf2
mov eax, ebx
lea edx, [ebp - 0x200]
call fcn.0040894c
mov eax, dword [ebx]
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0x204]
test eax, eax
je 0x46bdc2
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x46bdd8
mov eax, ebx
mov edx, 0x46be3c
call fcn.00408af8
lea edx, [ebp - 0x208]
mov eax, dword [ebx]
call fcn.0046bd00
mov edx, dword [ebp - 0x208]
mov eax, ebx
call fcn.00407e40
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46be06
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46be26
lea eax, [ebp - 0x208]
call fcn.00407a60
ret

Function at 0x46be40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x208], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46bf0f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00407a60
xor edx, edx
push ebp
push 0x46beec
push dword fs:[edx]
mov dword fs:[edx], esp
push 0xff
lea eax, [ebp - 0x200]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
test eax, eax
je 0x46bee2
mov eax, ebx
lea edx, [ebp - 0x200]
call fcn.0040894c
mov eax, dword [ebx]
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0x204]
test eax, eax
je 0x46beb2
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x46bec8
mov eax, ebx
mov edx, 0x46bf2c
call fcn.00408af8
lea edx, [ebp - 0x208]
mov eax, dword [ebx]
call fcn.0046bd00
mov edx, dword [ebp - 0x208]
mov eax, ebx
call fcn.00407e40
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46bef6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46bf16
lea eax, [ebp - 0x208]
call fcn.00407a60
ret

Function at 0x46bf30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x218], edx
mov dword [ebp - 0x210], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46c03b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00407a60
xor edx, edx
push ebp
push 0x46c00d
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x4e96a8]
cmp byte [eax], 0
jne 0x46bf8d
mov eax, ebx
call fcn.0046be40
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46c017
push 0x104
xor eax, eax
pop edx
pop ecx
Function at 0x46c14c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x208], edx
mov dword [ebp - 0x204], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46c240
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00407a60
xor edx, edx
push ebp
push 0x46c218
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x200]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathW
test eax, eax
je 0x46c20e
mov eax, ebx
lea edx, [ebp - 0x200]
call fcn.0040894c
lea edx, [ebp - 0x204]
mov eax, dword [ebx]
call fcn.00470424
mov edx, dword [ebp - 0x204]
mov eax, ebx
call fcn.00407e40
lea edx, [ebp - 0x208]
mov eax, dword [ebx]
call fcn.0046bd00
mov edx, dword [ebp - 0x208]
mov eax, ebx
call fcn.00407e40
mov eax, dword [ebx]
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x20c]
test eax, eax
je 0x46c1f8
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x46c20e
mov eax, ebx
mov edx, 0x46c25c
call fcn.00408af8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46c222
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46c247
lea eax, [ebp - 0x208]
mov edx, 2
call fcn.00407ac0
ret

Function at 0x46c260
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf8
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00407a60
xor edx, edx
push ebp
push 0x46c2ed
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x402]
push eax
push 0
push 0
push esi
push 0
call sub.SHFolder.dll_SHGetFolderPathW
test eax, 0x80000000
sete al
test al, al
je 0x46c2e3
mov edx, ebx
lea eax, [ebp - 0x402]
call fcn.0041efc4
cmp dword [ebx], 0
je 0x46c2e3
mov eax, dword [ebx]
mov dword [ebp - 0x408], eax
mov eax, dword [ebp - 0x408]
test eax, eax
je 0x46c2cd
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x46c2e3
mov eax, ebx
mov edx, 0x46c30c
call fcn.00408af8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46c2f7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46cb30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x46ccab
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
push ebp
push 0x46cc83
push dword fs:[ecx]
mov dword fs:[ecx], esp
call fcn.00460118
cmp al, 0xa
jb 0x46cc13
lea eax, [ebp - 4]
mov edx, 0x104
call fcn.00408a78
xor edx, edx
push ebp
push 0x46cc0c
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.004088f4
push eax
push 0
push 0
push 0x23
push 0
call sub.SHFolder.dll_SHGetFolderPathW
test eax, eax
jne 0x46cbf4
mov eax, dword [ebp - 4]
call fcn.004088f4
mov edx, dword [ebp - 8]
call fcn.0041efc4
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x46cbc6
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x46cbe2
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.004248f4
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00407e40
call fcn.0040724c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46cc8d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46cc13
lea eax, [ebp - 4]
xor edx, edx
call fcn.00408a78
ret
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x4e97b8]
mov eax, dword [eax]
mov ecx, 0x46ccc8
mov edx, 0x46ccf4
call fcn.00462990
test al, al
je 0x46cc79
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x46cc47
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x46cc79
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x46cc5c
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x46cc79
mov eax, dword [ebp - 8]
mov edx, 0x46cd84
call fcn.00408af8
mov eax, dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46cc8d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46ccb2
lea eax, [ebp - 0x10]
call fcn.00407a60
lea eax, [ebp - 4]
call fcn.00407a60
ret
Function at 0x46cd88
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x46cf1c
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
push ebp
push 0x46ceef
push dword fs:[ecx]
mov dword fs:[ecx], esp
call fcn.00460118
cmp al, 0xa
jb 0x46ce67
lea eax, [ebp - 4]
mov edx, 0x104
call fcn.00408a78
xor edx, edx
push ebp
push 0x46ce60
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.004088f4
push eax
push 0
push 0
push 0x1a
push 0
call sub.SHFolder.dll_SHGetFolderPathW
test eax, eax
jne 0x46ce48
mov eax, dword [ebp - 4]
call fcn.004088f4
mov edx, dword [ebp - 8]
call fcn.0041efc4
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x46ce1a
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x46ce36
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.004248f4
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00407e40
call fcn.0040724c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46cef9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46ce67
lea eax, [ebp - 4]
xor edx, edx
call fcn.00408a78
ret
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x4e986c]
mov eax, dword [eax]
mov ecx, 0x46cf38
mov edx, 0x46cf54
call fcn.00462990
test al, al
je 0x46cee5
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.0046bd00
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.00407e40
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x46ceb3
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x46cee5
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x46cec8
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x46cee5
mov eax, dword [ebp - 8]
mov edx, 0x46cfe4
call fcn.00408af8
mov eax, dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46cef9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46cf23
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00407ac0
lea eax, [ebp - 4]
call fcn.00407a60
ret
Function at 0x46cfe8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x46d17c
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
push ebp
push 0x46d14f
push dword fs:[ecx]
mov dword fs:[ecx], esp
call fcn.00460118
cmp al, 0xa
jb 0x46d0c7
lea eax, [ebp - 4]
mov edx, 0x104
call fcn.00408a78
xor edx, edx
push ebp
push 0x46d0c0
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.004088f4
push eax
push 0
push 0
push 0x1c
push 0
call sub.SHFolder.dll_SHGetFolderPathW
test eax, eax
jne 0x46d0a8
mov eax, dword [ebp - 4]
call fcn.004088f4
mov edx, dword [ebp - 8]
call fcn.0041efc4
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x46d07a
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x46d096
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.004248f4
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00407e40
call fcn.0040724c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46d159
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46d0c7
lea eax, [ebp - 4]
xor edx, edx
call fcn.00408a78
ret
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x4e986c]
mov eax, dword [eax]
mov ecx, 0x46d198
mov edx, 0x46d1c0
call fcn.00462990
test al, al
je 0x46d145
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.0046bd00
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.00407e40
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x46d113
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x46d145
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x46d128
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x46d145
mov eax, dword [ebp - 8]
mov edx, 0x46d250
call fcn.00408af8
mov eax, dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46d159
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46d183
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00407ac0
lea eax, [ebp - 4]
call fcn.00407a60
ret
Function at 0x46f8ac
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
mov byte [ebp - 0x12], cl
mov byte [ebp - 0x11], dl
mov esi, eax
xor eax, eax
push ebp
push 0x46fa45
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
xor eax, eax
mov dword [ebp - 0x18], eax
cmp byte [ebp - 0x11], 0
je 0x46f8ec
call fcn.00460a8c
mov dword [ebp - 0x18], eax
mov eax, esi
test eax, eax
je 0x46f8f7
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x46f902
xor ebx, ebx
jmp 0x46fa1d
cmp byte [ebp - 0x12], 0
je 0x46fa06
lea eax, [ebp - 0xc]
mov edx, esi
call fcn.00407e88
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00424944
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.00407e88
lea edx, [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.0041e82c
mov eax, dword [ebp - 8]
test eax, eax
je 0x46f943
sub eax, 4
mov eax, dword [eax]
cmp eax, 2
jne 0x46f970
lea eax, [ebp - 0x1c]
push eax
mov ecx, 1
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.00408cc0
mov eax, dword [ebp - 0x1c]
mov edx, 0x46fa60
call fcn.00408c88
sete al
jmp 0x46f972
xor eax, eax
test al, al
je 0x46f97a
mov al, 1
jmp 0x46f984
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.0041e138
test al, al
je 0x46f98c
mov al, 1
jmp 0x46f99a
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00408c88
sete al
test al, al
jne 0x46fa1d
cmp dword [ebp - 4], 0
jne 0x46f9be
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
call fcn.004088f4
push eax
call sub.kernel32.dll_CreateDirectoryW
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x46fa1d
mov eax, dword [ebp - 4]
call fcn.004088f4
mov edx, eax
lea eax, [ebp - 0x20]
call fcn.0040894c
mov eax, dword [ebp - 0x20]
movzx ecx, byte [ebp - 0x12]
movzx edx, byte [ebp - 0x11]
call fcn.0046f8ac
mov ebx, eax
test bl, bl
je 0x46f9fc
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
call fcn.004088f4
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x46fa00
xor eax, eax
jmp 0x46fa02
mov al, 1
mov ebx, eax
jmp 0x46fa1d
lea eax, [ebp - 0x18]
push eax
mov eax, esi
call fcn.004088f4
push eax
call sub.kernel32.dll_CreateDirectoryW
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46fa4c
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00407ac0
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00407ac0
ret

Function at 0x46fa64
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004088f4
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x46fa7d
test al, 0x10
jne 0x46fa81
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x47032c
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.004703dc
test al, al
je 0x47036c
mov eax, esi
call fcn.0041e61c
mov ebx, eax
test bl, bl
jne 0x47036c
mov eax, esi
call fcn.00470210
push 0x80
mov eax, esi
call fcn.004088f4
push eax
call sub.kernel32.dll_SetFileAttributesW
mov eax, esi
call fcn.0041e61c
mov ebx, eax
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x470374
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push ecx
mov byte [esp], dl
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.004703dc
test al, al
je 0x4703d4
mov eax, esi
call fcn.0041e61c
mov ebx, eax
test bl, bl
jne 0x4703d4
mov eax, esi
call fcn.00470210
push 0x80
mov eax, esi
call fcn.004088f4
push eax
call sub.kernel32.dll_SetFileAttributesW
mov eax, esi
call fcn.0041e61c
mov ebx, eax
test bl, bl
jne 0x4703d4
cmp byte [esp], 0
je 0x4703d4
call fcn.00460134
test al, al
je 0x4703d4
mov eax, esi
call fcn.00470950
mov ebx, eax
mov eax, ebx
pop edx
pop esi
pop ebx
ret

Function at 0x4703dc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004088f4
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4703f5
test al, 0x10
je 0x4703f9
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x470400
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004088f4
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x470419
test al, 0x10
je 0x47041d
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x470564
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4705cd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00407e88
lea eax, [ebp - 8]
mov edx, esi
call fcn.00407e88
mov eax, dword [ebp - 8]
call fcn.004088f4
push eax
mov eax, dword [ebp - 4]
call fcn.004088f4
push eax
call sub.kernel32.dll_MoveFileW
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4705d4
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407ac0
ret
Function at 0x475c4c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 8]
call fcn.00407b44
xor eax, eax
push ebp
push 0x475cb0
push dword fs:[eax]
mov dword fs:[eax], esp
push 5
mov eax, dword [ebp + 8]
call fcn.004088f4
push eax
mov eax, esi
call fcn.004088f4
push eax
mov eax, ebx
call fcn.004088f4
push eax
push 0x475cc0
push edi
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
seta bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x475cb7
lea eax, [ebp + 8]
call fcn.00407a60
ret

Function at 0x475ccc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 8]
call fcn.00407b44
xor eax, eax
push ebp
push 0x475d6b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x40
mov eax, 0x475d80
mov dword [ebp - 0x30], eax
mov eax, ebx
call fcn.004088f4
mov dword [ebp - 0x2c], eax
mov eax, esi
call fcn.004088f4
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x34], edi
mov eax, dword [ebp + 8]
call fcn.004088f4
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 1
lea ebx, [ebp - 0x3c]
push ebx
call sub.shell32.dll_ShellExecuteExW
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
test bl, bl
je 0x475d55
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x475d72
lea eax, [ebp + 8]
call fcn.00407a60
ret

Function at 0x475d8c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 8]
call fcn.00407b44
xor eax, eax
push ebp
push 0x475df0
push dword fs:[eax]
mov dword fs:[eax], esp
push 5
mov eax, dword [ebp + 8]
call fcn.004088f4
push eax
mov eax, esi
call fcn.004088f4
push eax
mov eax, ebx
call fcn.004088f4
push eax
push 0x475e00
push edi
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
seta bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x475df7
lea eax, [ebp + 8]
call fcn.00407a60
ret
Function at 0x476500
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407b44
xor eax, eax
push ebp
push 0x4765b3
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
xor edx, edx
push ebp
push 0x47658b
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0041d054
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.00407e88
cmp dword [ebp - 4], 0
jne 0x47655f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x476595
push 1
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004088f4
push eax
push 0x4765c8
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
setg byte [ebp - 5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x476595
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4765ba
lea eax, [ebp - 0xc]
call fcn.00407a60
lea eax, [ebp - 4]
call fcn.00407a60
ret

Function at 0x47aff4
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.00404f7c
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret

Function at 0x481df8
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov word [ebp - 2], cx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x481ed4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
mov edx, esi
call fcn.0040891c
mov eax, dword [ebp - 0x18]
push eax
call fcn.00483f90
pop edx
call fcn.00481228
test al, al
je 0x481e40
mov ebx, 1
jmp 0x481ebe
push 0
push 0x8000080
push 3
push 0
push 1
push 0xc0000000
push esi
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x481e6d
call sub.kernel32.dll_GetLastError_2
mov edx, dword [ebp + 8]
mov dword [edx], eax
xor ebx, ebx
jmp 0x481ebe
lea eax, [ebp - 0xc]
push eax
movzx eax, word [ebp - 2]
push eax
push edi
call sub.kernel32.dll_DosDateTimeToFileTime
test eax, eax
je 0x481ea1
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
call sub.kernel32.dll_LocalFileTimeToFileTime
test eax, eax
je 0x481ea1
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.kernel32.dll_SetFileTime
push ebx
call sub.kernel32.dll_CloseHandle_1
movzx eax, word [ebp + 0xc]
and ax, 0x27
movzx eax, ax
push eax
push esi
call sub.kernel32.dll_SetFileAttributesA
mov ebx, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x481edb
lea eax, [ebp - 0x18]
call fcn.00407a60
ret