joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412212
Capabilities:
Get graphical window text

Disassembly:
push ebp
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
call fcn.0045e790
cmp dword [0x893864], 0
je 0x412257
push 0
push 5
call fcn.004587e7
push 0
push 0x7a
push 0x1da
push 5
call fcn.00407903
jmp 0x4124cb
mov dword [0x893864], 1
push 0
push 0xc80000
mov eax, str.About_WinNTSetup
push eax
push 0x7a
push 0x1da
push 5
call fcn.0042b613
mov ebp, dword [0x4734ac]
fld qword [ebp + 0x10]
fadd qword [0x46e008]
push eax
fistp dword [esp]
mov eax, str.MS_Shell_Dlg
push eax
push 0xffffffff
call fcn.0045b112
mov dword [esp], eax
mov ebp, dword [0x473568]
push dword [ebp + 8]
push 0
push pe_nt_image_headers32
push 5
call fcn.004584dd
push eax
call sub.user32.dll_SendMessageW
push edx
call fcn.0045e620
pop edx
push eax
push 0
push edx
call fcn.0045e620
pop edx
push eax
mov edx, 0x463292
push edx
call fcn.0045e6f0
push edx
call fcn.0045e620
pop edx
push eax
push 0x46ba58
mov ebp, dword [0x47356c]
push dword [ebp + 4]
call fcn.00422512
pop eax
mov ebp, dword [0x473558]
mov edx, dword [ebp + 0xa4]
push edx
call fcn.0045e6f0
mov edx, str._x86
push edx
call fcn.0045e6f0
call fcn.0045e850
push 0x14
push 0x162
push 0xd
push 0x72
push 0xffffffff
call fcn.0044e2d2
add dword [esp + 0x14], edx
call fcn.00417ea2
call fcn.0044e2f0
mov dword [esp + 4], eax
push 0
mov eax, str._C__2009_2018_JFX
push eax
push 0x14
push 0x162
push 0x27
push 0x72
push 0xffffffff
call fcn.00417ea2
mov dword [esp + 8], eax
push 0
push 0
push 0
push 5
call fcn.004584dd
push eax
fld qword [0x47349c]
fmul qword [0x46e010]
push eax
fistp dword [esp]
fld qword [0x47349c]
fmul qword [0x46e018]
push eax
fistp dword [esp]
fld qword [0x47349c]
fmul qword [0x46e020]
push eax
fistp dword [esp]
fld qword [0x47349c]
fmul qword [0x46e028]
push eax
fistp dword [esp]
push 0x50010000
mov eax, str._a___a_Freeware___a_Forum__a_
push eax
mov eax, str.SysLink
push eax
push 0
call sub.user32.dll_CreateWindowExW
mov dword [esp + 0xc], eax
push dword [esp]
call fcn.0045b128
and eax, eax
je 0x41244f
push dword [esp]
call fcn.0045b13a
push eax
push dword [esp + 8]
call fcn.0045418d
push dword [esp]
call fcn.0045b13a
push eax
push dword [esp + 0xc]
call fcn.0045418d
push 0
push dword [esp + 4]
call fcn.0045b13a
push eax
push 0x30
push dword [esp + 0x18]
call sub.user32.dll_SendMessageW
mov ebp, dword [0x4734ac]
push dword [ebp + 0x20]
mov ebp, dword [0x4734ac]
push dword [ebp + 0x20]
push 0
mov ebp, dword [0x47356c]
push dword [ebp + 4]
call fcn.0040da17
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], 0
je 0x4124a6
push 0
push dword [esp + 0x14]
push 0x53
push 0x64
push 0x1b
push 0x1e
push 0xffffffff
call fcn.0041251a
push 0x3ed
push 0x1b
push 5
call fcn.004584f9
push 5
lea eax, [0x41e215]
push eax
call fcn.00458b82
call fcn.0045872d
push eax
mov ebx, 0x332d
cmp ebx, dword [esp]
jne 0x4124f1
call fcn.0045ccea
mov ebx, eax
cmp ebx, 0x3ed
jne 0x4124ef
add esp, 4
jmp 0x412503
jmp 0x412500
mov ebx, 0x333c
cmp ebx, dword [esp]
jne 0x412500
add esp, 4
jmp 0x412503
pop eax
jmp 0x4124cb
push 1
push 5
call fcn.004587e7
xor eax, eax
add esp, 0x18
pop ebx
pop ebp
ret
Function at 0x412e18
Capabilities:
Get disk information

Disassembly:
xor eax, eax
push eax
push eax
push eax
call fcn.0045e790
push dword [esp + 0x14]
call fcn.0044e2f0
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push 0x19
push 0xffffffff
push dword [esp + 0x20]
call fcn.0045ac80
mov edx, 0x4622e0
push edx
call fcn.0045e6f0
call fcn.0045e850
lea eax, [esp + 4]
push eax
call fcn.0045e660
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push 0x104
call fcn.0044f2b0
lea eax, [esp + 8]
push eax
call fcn.0045e660
lea eax, [esp + 8]
push eax
push 0x104
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push eax
call sub.kernel32.dll_GetVolumePathNamesForVolumeNameW
and eax, eax
je 0x412eef
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push 2
push dword [esp + 0x10]
call fcn.0044f540
lea eax, [esp + 8]
push eax
call fcn.0045e660
mov edx, dword [esp + 4]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
pop eax
push eax
call fcn.0044e2c0
pop edx
add eax, edx
jmp 0x412ef9
call fcn.0045e820
mov word [eax], 0
push dword [esp + 4]
call fcn.0045e7f0
push dword [esp]
call fcn.0045e7f0
add esp, 0xc
ret 4

Function at 0x4130d4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov edx, 0x1a
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4130da
call fcn.0045e790
mov edx, dword [esp + 0x70]
lea ecx, [esp]
call fcn.0044e000
mov edx, dword [esp + 0x74]
lea ecx, [esp + 4]
call fcn.0044e000
push 0
lea eax, [esp + 0xc]
push eax
push 1
push 0x20000
push 2
call sub.advapi32.dll_SaferCreateLevel
and eax, eax
je 0x4131af
push 0
push 0
lea eax, [esp + 0x14]
push eax
push 0
push dword [esp + 0x18]
call sub.advapi32.dll_SaferComputeTokenFromLevel
and eax, eax
je 0x4131a6
lea ebp, [esp + 0x10]
mov dword [ebp], 0x44
mov dword [ebp + 0x2c], 1
push dword [esp + 0x78]
pop eax
mov word [ebp + 0x30], ax
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x20]
push eax
push 0
push dword [esp + 0x34]
call sub.advapi32.dll_CreateProcessAsUserW
mov dword [esp + 0x64], eax
push dword [esp + 8]
call sub.advapi32.dll_SaferCloseLevel
mov eax, dword [esp + 0x64]
jmp 0x4131b7
push dword [esp]
call fcn.0045e7f0
push dword [esp + 4]
call fcn.0045e7f0
add esp, 0x68
pop ebp
ret 0xc
Function at 0x414cea
Capabilities:
Set registry value

Disassembly:
push ebp
push ebx
mov edx, 7
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x414cf1
call fcn.0045e790
mov edx, dword [esp + 0x2c]
lea ecx, [esp]
call fcn.0044e000
mov edx, dword [esp + 0x30]
lea ecx, [esp + 4]
call fcn.0044e000
mov ebx, dword [esp + 0x28]
and ebx, ebx
jne 0x414d2b
xor eax, eax
jmp 0x414f27
push dword [esp]
mov edx, 0x46105e
pop ecx
call fcn.0044e300
je 0x414d46
push dword [esp + 0x28]
pop eax
mov dword [esp + 8], eax
jmp 0x414d58
lea eax, [esp + 8]
push eax
push dword [esp + 4]
push dword [esp + 0x30]
call sub.advapi32.dll_RegCreateKeyW
mov ebx, dword [esp + 8]
and ebx, ebx
je 0x414d6a
mov ebx, dword [esp + 0x38]
and ebx, ebx
je 0x414d6a
jmp 0x414d71
mov eax, 1
jmp 0x414d73
xor eax, eax
and eax, eax
je 0x414d7e
xor eax, eax
jmp 0x414f27
push dword [esp + 0x34]
mov ebx, 1
cmp ebx, dword [esp]
je 0x414d96
mov ebx, 2
cmp ebx, dword [esp]
jne 0x414df5
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push 0x19
push 0xffffffff
push dword [esp + 0x4c]
call fcn.0045ac80
lea eax, [esp + 0x14]
push eax
call fcn.0045e660
push dword [esp + 0x10]
call fcn.0044f9d0
mov ebx, eax
add ebx, ebx
add ebx, 2
push ebx
mov eax, dword [esp + 0x14]
push eax
push dword [esp + 0x40]
push 0
mov eax, dword [esp + 0x18]
push eax
push dword [esp + 0x20]
call sub.advapi32.dll_RegSetValueExW
jmp 0x414f11
mov ebx, 3
cmp ebx, dword [esp]
jne 0x414e38
mov ebx, dword [esp + 0x40]
and ebx, ebx
jne 0x414e14
push dword [esp + 0x3c]
call fcn.0045ac60
mov dword [esp + 0x40], eax
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x40]
push 0
mov eax, dword [esp + 0x18]
push eax
push dword [esp + 0x20]
call sub.advapi32.dll_RegSetValueExW
jmp 0x414f11
mov ebx, 4
cmp ebx, dword [esp]
jne 0x414e74
push dword [esp + 0x3c]
pop eax
mov dword [esp + 0x18], eax
push 4
lea eax, [esp + 0x18]
push eax
mov ebp, dword [esp + 0x20]
push dword [ebp]
push 0
mov eax, dword [esp + 0x18]
push eax
push dword [esp + 0x20]
call sub.advapi32.dll_RegSetValueExW
jmp 0x414f11
mov ebx, 7
cmp ebx, dword [esp]
jne 0x414eda
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push 0x19
push 0xffffffff
push dword [esp + 0x4c]
call fcn.0045ac80
lea eax, [esp + 0x14]
push eax
call fcn.0045e660
push dword [esp + 0x10]
call fcn.0044f9d0
mov ebx, eax
add ebx, ebx
add ebx, 2
push ebx
mov eax, dword [esp + 0x14]
push eax
push dword [esp + 0x40]
push 0
mov eax, dword [esp + 0x18]
push eax
push dword [esp + 0x20]
call sub.advapi32.dll_RegSetValueExW
jmp 0x414f11
mov ebx, 0xb
cmp ebx, dword [esp]
jne 0x414f11
push dword [esp + 0x3c]
pop eax
mov dword [esp + 0x1c], eax
push 8
mov ebp, dword [esp + 0x20]
mov eax, dword [ebp]
push eax
push dword [esp + 0x40]
push 0
mov eax, dword [esp + 0x18]
push eax
push dword [esp + 0x20]
call sub.advapi32.dll_RegSetValueExW
pop eax
mov ebx, dword [esp + 8]
cmp ebx, dword [esp + 0x28]
je 0x414f25
push dword [esp + 8]
call sub.advapi32.dll_RegCloseKey
xor eax, eax
push dword [esp + 4]
call fcn.0045e7f0
push dword [esp]
call fcn.0045e7f0
push dword [esp + 0xc]
call fcn.0045e7f0
add esp, 0x1c
pop ebx
pop ebp
ret 0x18
Function at 0x415330
Capabilities:
Query registry key via offline registry library

Disassembly:
push ebp
push ebx
mov edx, 9
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x415337
call fcn.0045e790
push dword [esp + 0x3c]
call fcn.0044e2f0
mov edx, dword [esp + 0x34]
lea ecx, [esp]
call fcn.0044e000
mov edx, dword [esp + 0x38]
lea ecx, [esp + 4]
call fcn.0044e000
mov ebx, dword [esp + 0x30]
and ebx, ebx
jne 0x415395
mov edx, 0x46105e
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
pop eax
push eax
call fcn.0044e2c0
pop edx
add eax, edx
jmp 0x41556b
lea eax, [esp + 0xc]
push eax
push 0
push 0
mov eax, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push eax
push dword [esp + 0x44]
call sub.Toolsx86offreg.dll_ORGetValue
mov ebx, eax
and ebx, ebx
jne 0x4153cb
cmp dword [esp + 0xc], 0
je 0x4153cb
mov eax, 1
jmp 0x4153cd
xor eax, eax
and eax, eax
je 0x415543
push dword [esp + 0xc]
call fcn.0045ac20
mov dword [esp + 0x14], eax
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x18]
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push eax
push dword [esp + 0x44]
call sub.Toolsx86offreg.dll_ORGetValue
mov ebx, eax
and ebx, ebx
jne 0x415541
push dword [esp + 8]
mov ebx, 1
cmp ebx, dword [esp]
je 0x415425
mov ebx, 2
cmp ebx, dword [esp]
jne 0x415457
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push 0x19
push 0xffffffff
push dword [esp + 0x28]
call fcn.0045ac80
lea eax, [esp + 0x28]
push eax
call fcn.0045e660
jmp 0x41553e
mov ebx, 3
cmp ebx, dword [esp]
jne 0x415493
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push 0x19
push 0xffffffff
push dword [esp + 0x28]
call fcn.0045ac80
lea eax, [esp + 0x28]
push eax
call fcn.0045e660
jmp 0x41553e
mov ebx, 4
cmp ebx, dword [esp]
jne 0x4154d1
push dword [esp + 0x18]
pop eax
mov dword [esp + 0x1c], eax
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
mov ebp, dword [esp + 0x24]
mov eax, dword [ebp]
cdq
push edx
push eax
call fcn.0044f300
lea eax, [esp + 0x28]
push eax
call fcn.0045e660
jmp 0x41553e
mov ebx, 0xb
cmp ebx, dword [esp]
jne 0x415511
push dword [esp + 0x18]
pop eax
mov dword [esp + 0x20], eax
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
mov ebp, dword [esp + 0x28]
lea eax, [ebp]
push dword [eax + 4]
push dword [eax]
call fcn.0044f300
lea eax, [esp + 0x28]
push eax
call fcn.0045e660
jmp 0x41553e
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push 0x19
push 0xffffffff
push dword [esp + 0x28]
call fcn.0045ac80
lea eax, [esp + 0x28]
push eax
call fcn.0045e660
pop eax
jmp 0x415541
jmp 0x415543
mov edx, dword [esp + 0x20]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
pop eax
push eax
call fcn.0044e2c0
pop edx
add eax, edx
jmp 0x41556b
push dword [esp + 0x20]
call fcn.0045e7f0
push dword [esp + 0x10]
call fcn.0045e7f0
push dword [esp]
call fcn.0045e7f0
push dword [esp + 4]
call fcn.0045e7f0
add esp, 0x24
pop ebx
pop ebp
ret 0xc
Function at 0x415596
Capabilities:
Set registry value

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
call fcn.0045e790
mov edx, dword [esp + 0x1c]
lea ecx, [esp]
call fcn.0044e000
mov edx, dword [esp + 0x20]
lea ecx, [esp + 4]
call fcn.0044e000
mov ebx, dword [esp + 0x18]
and ebx, ebx
jne 0x4155ca
xor eax, eax
jmp 0x41565e
push dword [esp]
mov edx, 0x46105e
pop ecx
call fcn.0044e300
je 0x4155e5
push dword [esp + 0x18]
pop eax
mov dword [esp + 8], eax
jmp 0x4155f7
lea eax, [esp + 8]
push eax
push dword [esp + 4]
push dword [esp + 0x20]
call sub.advapi32.dll_RegCreateKeyW
mov ebx, dword [esp + 8]
and ebx, ebx
jne 0x415603
xor eax, eax
jmp 0x41565e
push 4
lea eax, [esp + 0x28]
push eax
push 4
push 0
mov eax, dword [esp + 0x14]
push eax
push dword [esp + 0x1c]
call sub.advapi32.dll_RegSetValueExW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x41563b
mov dword [esp + 0xc], 1
jmp 0x415643
mov dword [esp + 0xc], 0
mov ebx, dword [esp + 8]
cmp ebx, dword [esp + 0x18]
je 0x415656
push dword [esp + 8]
call sub.advapi32.dll_RegCloseKey
mov eax, dword [esp + 0xc]
jmp 0x41565e
push dword [esp + 4]
call fcn.0045e7f0
push dword [esp]
call fcn.0045e7f0
add esp, 0x10
pop ebx
ret 0x10
Function at 0x415d6a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
xor eax, eax
push eax
push eax
call fcn.0045e790
mov edx, dword [esp + 0x10]
lea ecx, [esp]
call fcn.0044e000
push dword [esp]
call sub.kernel32.dll_GetFileAttributesW
mov dword [esp + 4], eax
mov ebx, dword [esp + 4]
cmp ebx, 0xffffffff
jne 0x415d99
xor eax, eax
jmp 0x415d9e
mov eax, 1
and eax, eax
je 0x415da9
mov eax, 1
jmp 0x415dab
xor eax, eax
push dword [esp]
call fcn.0045e7f0
add esp, 8
pop ebx
ret 4

Function at 0x415f18
Capabilities:
Get disk information

Disassembly:
push ebx
xor eax, eax
push eax
push eax
call fcn.0045e790
push dword [esp + 0x14]
call fcn.0044e2f0
mov edx, dword [esp + 0x10]
lea ecx, [esp]
call fcn.0044e000
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push 0x104
call fcn.0044f2b0
call fcn.0045e850
lea eax, [esp + 8]
push eax
call fcn.0045e660
push dword [esp]
call fcn.0044f9d0
mov ebx, eax
cmp ebx, 2
jne 0x415f95
mov edx, dword [esp]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov edx, 0x4622e0
push edx
call fcn.0045e6f0
lea eax, [esp + 4]
push eax
call fcn.0045e660
push 0
push 0
push 0
push 0
push 0
push 0x104
mov eax, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x1c]
push eax
call sub.kernel32.dll_GetVolumeInformationW
and eax, eax
je 0x415fe6
mov edx, dword [esp + 4]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
pop eax
push eax
call fcn.0044e2c0
pop edx
add eax, edx
jmp 0x41600f
mov edx, 0x46105e
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
pop eax
push eax
call fcn.0044e2c0
pop edx
add eax, edx
jmp 0x41600f
push dword [esp]
call fcn.0045e7f0
push dword [esp + 4]
call fcn.0045e7f0
add esp, 8
pop ebx
ret 4
Function at 0x417918
Capabilities:
Set environment variable

Disassembly:
push ebp
push ebx
call fcn.0045e790
mov eax, str.ImDisk
push eax
call fcn.0041e0a4
and eax, eax
je 0x41794e
mov ebp, dword [0x473558]
mov dword [ebp + 0xdc], 1
mov eax, str.Found_ImDisk
push eax
call fcn.004280d3
jmp 0x417b85
mov ebp, dword [0x47356c]
mov ebx, dword [ebp + 0x20]
cmp ebx, 0x1f40
jge 0x417b85
push edx
call fcn.0045e620
pop edx
push eax
mov ebp, dword [0x47356c]
mov edx, dword [ebp + 8]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov edx, str.ToolsImdisk_sys_amd64imdisk.sys
push edx
call fcn.0045e6f0
call fcn.0044e2d2
add dword [esp], edx
call fcn.00417bc9
call fcn.0044e2f0
and eax, eax
je 0x4179ea
push edx
call fcn.0045e620
pop edx
push eax
mov ebp, dword [0x47356c]
mov edx, dword [ebp + 8]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov edx, 0x461aac
push edx
call fcn.0045e6f0
call fcn.0044e2d2
add dword [esp], edx
call fcn.00417bc9
call fcn.0044e2f0
and eax, eax
je 0x4179ea
mov eax, 1
jmp 0x4179ec
xor eax, eax
and eax, eax
je 0x417b3e
mov eax, str.Installing_ImDisk_...
push eax
call fcn.004280d3
push edx
call fcn.0045e620
pop edx
push eax
mov ebp, dword [0x47356c]
mov edx, dword [ebp + 8]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov edx, str.ToolsImdisk_sys
push edx
call fcn.0045e6f0
call fcn.0044e2d2
add dword [esp], edx
call fcn.00436a10
call fcn.0044e2f0
push eax
mov ebp, dword [0x473558]
pop eax
mov dword [ebp + 0xdc], eax
mov ebp, dword [0x473558]
cmp dword [ebp + 0xdc], 0
je 0x417a5c
xor eax, eax
jmp 0x417a61
mov eax, 1
and eax, eax
je 0x417a75
mov eax, str.Error_Installing_ImDisk_
push eax
call fcn.004280d3
jmp 0x417b3c
mov eax, str.Succesfully_installed_ImDisk_
push eax
call fcn.004280d3
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
mov eax, str.PATH
push eax
call fcn.00418478
mov edx, 0x461d0e
push edx
call fcn.0045e6f0
mov ebp, dword [0x47356c]
mov edx, dword [ebp + 8]
push edx
call fcn.0045e6f0
mov edx, str.ToolsImdiskclii386
push edx
call fcn.0045e6f0
call fcn.0045e850
mov eax, str.PATH
push eax
call fcn.0044e2d2
add dword [esp + 4], edx
call sub.kernel32.dll_SetEnvironmentVariableW
call fcn.0044e2f0
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
mov eax, str.PATH
push eax
call fcn.00418478
mov edx, 0x461d0e
push edx
call fcn.0045e6f0
mov ebp, dword [0x47356c]
mov edx, dword [ebp + 8]
push edx
call fcn.0045e6f0
mov edx, 0x461df8
push edx
call fcn.0045e6f0
call fcn.0045e850
mov eax, str.PATH
push eax
call fcn.0044e2d2
add dword [esp + 4], edx
call sub.kernel32.dll_SetEnvironmentVariableW
call fcn.0044e2f0
jmp 0x417b85
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
mov edx, str.Missing_:
push edx
call fcn.0045e6f0
mov ebp, dword [0x47356c]
mov edx, dword [ebp + 8]
push edx
call fcn.0045e6f0
mov edx, str.ToolsImdisk_sys
push edx
call fcn.0045e6f0
call fcn.0044e2d2
add dword [esp], edx
call fcn.004280d3
call fcn.0044e2f0
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x417bc9
Capabilities:
Check if file exists
Enumerate files on windows
Get file attributes

Disassembly:
push ebp
push ebx
mov edx, 0x9b
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x417bd0
call fcn.0045e790
mov edx, dword [esp + 0x278]
lea ecx, [esp]
call fcn.0044e000
push dword [esp]
mov edx, 0x46105e
pop ecx
call fcn.0044e300
je 0x417c08
xor eax, eax
jmp 0x417d44
mov eax, dword [esp]
push eax
pop eax
mov dword [esp + 0x258], eax
mov ebp, dword [esp + 0x258]
cmp word [ebp], 0
je 0x417c66
mov ebp, dword [esp + 0x258]
movzx ebx, word [ebp]
push ebx
mov ebx, 0x3f
cmp ebx, dword [esp]
je 0x417c42
mov ebx, 0x2a
cmp ebx, dword [esp]
jne 0x417c52
mov dword [esp + 0x258], 1
add esp, 4
jmp 0x417c66
pop eax
mov ebx, dword [esp + 0x258]
add ebx, 2
mov dword [esp + 0x258], ebx
jmp 0x417c14
cmp dword [esp + 0x254], 0
je 0x417cde
lea eax, [esp + 4]
push eax
push dword [esp + 4]
call sub.kernel32.dll_FindFirstFileW
mov dword [esp + 0x254], eax
mov ebx, dword [esp + 0x254]
cmp ebx, 0xffffffff
je 0x417cdc
lea ebp, [esp + 4]
mov ebx, dword [ebp]
and ebx, 0x10
and ebx, ebx
je 0x417ca3
xor eax, eax
jmp 0x417ca8
mov eax, 1
and eax, eax
je 0x417cb9
mov dword [esp + 0x268], 1
jmp 0x417cd0
lea eax, [esp + 4]
push eax
push dword [esp + 0x258]
call sub.kernel32.dll_FindNextFileW
mov ebx, eax
and ebx, ebx
jne 0x417c91
push dword [esp + 0x254]
call sub.kernel32.dll_FindClose
jmp 0x417d39
push dword [esp]
call sub.kernel32.dll_GetFileAttributesW
mov dword [esp + 0x264], eax
mov ebx, dword [esp + 0x264]
cmp ebx, 0xffffffff
jne 0x417cfd
xor eax, eax
jmp 0x417d02
mov eax, 1
and eax, eax
je 0x417d28
mov ebx, dword [esp + 0x264]
and ebx, 0x10
and ebx, ebx
je 0x417d18
xor eax, eax
jmp 0x417d1d
mov eax, 1
and eax, eax
je 0x417d28
mov eax, 1
jmp 0x417d2a
xor eax, eax
and eax, eax
je 0x417d39
mov dword [esp + 0x268], 1
mov eax, dword [esp + 0x268]
jmp 0x417d44
push dword [esp]
call fcn.0045e7f0
add esp, 0x26c
pop ebx
pop ebp
ret 4
Function at 0x417d57
Capabilities:
Query registry key via offline registry library

Disassembly:
push ebp
push ebx
mov edx, 7
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x417d5e
call fcn.0045e790
mov edx, dword [esp + 0x2c]
lea ecx, [esp]
call fcn.0044e000
mov edx, dword [esp + 0x30]
lea ecx, [esp + 4]
call fcn.0044e000
mov ebx, dword [esp + 0x28]
and ebx, ebx
jne 0x417d98
xor eax, eax
jmp 0x417e80
lea eax, [esp + 0xc]
push eax
push 0
push 0
mov eax, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push eax
push dword [esp + 0x3c]
call sub.Toolsx86offreg.dll_ORGetValue
mov ebx, eax
and ebx, ebx
jne 0x417e78
push dword [esp + 0xc]
call fcn.0045ac20
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], 0
je 0x417e76
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x18]
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push eax
push dword [esp + 0x3c]
call sub.Toolsx86offreg.dll_ORGetValue
mov ebx, eax
and ebx, ebx
jne 0x417e6d
push dword [esp + 8]
mov ebx, 1
cmp ebx, dword [esp]
je 0x417e1b
mov ebx, 2
cmp ebx, dword [esp]
jne 0x417e5e
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push 0x19
push 0xffffffff
push dword [esp + 0x2c]
call fcn.0045ac80
call fcn.0044e2d2
add dword [esp], edx
call fcn.0044f890
call fcn.0044e2f0
mov dword [esp + 0x1c], eax
jmp 0x417e6a
mov ebp, dword [esp + 0x18]
push dword [ebp]
pop eax
mov dword [esp + 0x1c], eax
pop eax
jmp 0x417e6d
push dword [esp + 0x14]
call fcn.0045ac40
jmp 0x417e78
mov eax, dword [esp + 0x18]
jmp 0x417e80
push dword [esp + 0x10]
call fcn.0045e7f0
push dword [esp]
call fcn.0045e7f0
push dword [esp + 4]
call fcn.0045e7f0
add esp, 0x1c
pop ebx
pop ebp
ret 0xc
Function at 0x417f1e
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
xor eax, eax
push eax
call fcn.0045e790
mov edx, dword [esp + 0xc]
lea ecx, [esp]
call fcn.0044e000
push dword [esp]
call sub.kernel32.dll_LoadLibraryW
mov dword [0x4734b8], eax
cmp dword [0x4734b8], 0
je 0x4180a0
mov ebp, str.WIMCreateFile
push ebp
push dword [0x4734b8]
call sub.kernel32.dll_GetProcAddress
mov dword [0x473504], eax
mov ebp, str.WIMCloseHandle
push ebp
push dword [0x4734b8]
call sub.kernel32.dll_GetProcAddress
mov dword [0x47350c], eax
mov ebp, str.WIMSetTemporaryPath
push ebp
push dword [0x4734b8]
call sub.kernel32.dll_GetProcAddress
mov dword [0x473520], eax
mov ebp, str.WIMSetReferenceFile
push ebp
push dword [0x4734b8]
call sub.kernel32.dll_GetProcAddress
mov dword [0x4734d8], eax
mov ebp, str.WIMGetImageCount
push ebp
push dword [0x4734b8]
call sub.kernel32.dll_GetProcAddress
mov dword [0x4734a4], eax
mov ebp, str.WIMGetAttributes
push ebp
push dword [0x4734b8]
call sub.kernel32.dll_GetProcAddress
mov dword [0x47351c], eax
mov ebp, str.WIMLoadImage
push ebp
push dword [0x4734b8]
call sub.kernel32.dll_GetProcAddress
mov dword [0x4734d0], eax
mov ebp, str.WIMApplyImage
push ebp
push dword [0x4734b8]
call sub.kernel32.dll_GetProcAddress
mov dword [0x473518], eax
mov ebp, str.WIMGetImageInformation
push ebp
push dword [0x4734b8]
call sub.kernel32.dll_GetProcAddress
mov dword [0x4734bc], eax
mov ebp, str.WIMRegisterMessageCallback
push ebp
push dword [0x4734b8]
call sub.kernel32.dll_GetProcAddress
mov dword [0x473510], eax
mov ebp, str.WIMUnregisterMessageCallback
push ebp
push dword [0x4734b8]
call sub.kernel32.dll_GetProcAddress
mov dword [0x4734d4], eax
mov ebp, str.WIMFindFirstImageFile
push ebp
push dword [0x4734b8]
call sub.kernel32.dll_GetProcAddress
mov dword [0x473528], eax
mov ebp, str.WIMFindNextImageFile
push ebp
push dword [0x4734b8]
call sub.kernel32.dll_GetProcAddress
mov dword [0x4734ec], eax
mov ebp, str.WIMCreateImageFile
push ebp
push dword [0x4734b8]
call sub.kernel32.dll_GetProcAddress
mov dword [0x4734b4], eax
mov ebp, str.WIMReadImageFile
push ebp
push dword [0x4734b8]
call sub.kernel32.dll_GetProcAddress
mov dword [0x4734e4], eax
mov eax, 1
jmp 0x4180a6
xor eax, eax
jmp 0x4180a6
push dword [esp]
call fcn.0045e7f0
add esp, 4
pop ebp
ret 4