joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4650c4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x50f393
call fcn.0050df3c
sub esp, 0x418
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
call dword [0x558fdc]
xor esi, esi
mov dword [ebp - 0x20], esi
mov eax, dword [ebp + 8]
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x424], esi
push 2
push esi
push dword [ebp + 0xc]
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, eax
cmp ebx, esi
mov dword [ebp - 0x14], ebx
jne 0x46511c
call fcn.00464deb
mov esi, eax
jmp 0x46521d
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, esi
jne 0x465139
call fcn.00464deb
jmp 0x465212
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, esi
mov dword [ebp + 0xc], eax
je 0x46512f
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
cmp eax, edi
mov dword [ebp + 8], edi
jae 0x46517f
lea eax, [ebp - 0x420]
cmp dword [ebp - 0x424], eax
je 0x465175
lea eax, [ebp - 0x424]
call fcn.0046618f
mov eax, 0x8007000e
jmp 0x465238
push 2
push eax
mov byte [ebp - 4], 2
call fcn.00465249
cmp eax, 0x400
pop ecx
pop ecx
jbe 0x4651a3
push eax
lea eax, [ebp - 0x424]
push eax
call fcn.00466198
jmp 0x4651af
lea eax, [ebp - 0x420]
mov dword [ebp - 0x424], eax
mov dword [ebp - 4], 1
jmp 0x4651ca
mov ebx, dword [ebp - 0x424]
cmp ebx, esi
jne 0x4651db
mov esi, 0x8007000e
jmp 0x465214
call dword [0x558fdc]
push edi
push ebx
push edi
push dword [ebp + 0xc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, esi
je 0x46512f
mov ecx, dword [ebp - 0x424]
push dword [ebp + 0x18]
mov word [ecx + eax*2], si
mov ecx, dword [ebp - 0x424]
lea edx, [ebp - 0x1c]
call fcn.0046526e
mov esi, eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x420]
cmp dword [ebp - 0x424], eax
je 0x465236
lea eax, [ebp - 0x424]
call fcn.0046618f
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0x14
Function at 0x466138
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
jne 0x46614b
push 0x80004005
call fcn.00405a99
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x466152
mov eax, dword [ebp + 8]
push edi
push dword [ebp + 0x10]
push 7
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x46622e
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [ecx]
push ebx
push esi
push edi
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0xc]
push ecx
push 0x2001f
xor esi, esi
push esi
push dword [ebp + 8]
mov dword [ebp - 8], esi
push eax
mov dword [ebp - 0xc], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, eax
cmp edi, esi
jne 0x4662f5
xor eax, eax
cmp dword [ebp - 8], esi
je 0x466277
push dword [ebp - 8]
call ebx
cmp eax, esi
mov ecx, dword [ebp - 0xc]
mov edi, eax
mov dword [ebp - 8], ecx
jne 0x4662f5
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [ebp - 0x1c]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x21c]
push eax
push esi
push ecx
jmp 0x4662cb
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 8]
call fcn.0046622e
cmp eax, esi
mov dword [ebp - 0xc], eax
jne 0x466308
lea eax, [ebp - 0x1c]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x21c]
push eax
push esi
push dword [ebp - 8]
mov dword [ebp - 0x10], 0x100
call edi
test eax, eax
je 0x46629f
cmp dword [ebp - 8], esi
je 0x4662e5
push dword [ebp - 8]
call ebx
mov dword [ebp - 8], esi
push dword [ebp + 8]
mov eax, dword [ebp - 0x14]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, eax
cmp dword [ebp - 8], esi
je 0x4662ff
push dword [ebp - 8]
call ebx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4
cmp dword [ebp - 8], esi
je 0x466312
push dword [ebp - 8]
call ebx
mov eax, dword [ebp - 0xc]
jmp 0x466301
Function at 0x467d3f
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
mov eax, 0x50f322
call fcn.0050df3c
sub esp, 0x78
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x14], edi
push edi
push 0x80
push 3
push edi
push 7
push SysReAllocString
push dword [ebp + 8]
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x467d7c
call fcn.00464deb
jmp 0x467d81
mov dword [ebp - 0x14], eax
xor eax, eax
cmp eax, edi
jge 0x467d9a
cmp dword [ebp - 0x14], edi
je 0x467d93
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x467ea0
mov ebx, 0x1000
push ebx
call fcn.004ed1bb
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x84], 0x67452301
mov dword [ebp - 0x80], 0xefcdab89
mov dword [ebp - 0x7c], 0x98badcfe
mov dword [ebp - 0x78], 0x10325476
mov esi, dword [ebp - 0x14]
pop ecx
push edi
lea eax, [ebp - 0x1c]
push eax
push ebx
push dword [ebp - 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x467def
call fcn.00464deb
jmp 0x467df1
xor eax, eax
cmp eax, edi
jl 0x467e0c
mov eax, dword [ebp - 0x1c]
cmp eax, edi
je 0x467e23
push dword [ebp - 0x18]
lea esi, [ebp - 0x84]
call fcn.0042dfab
jmp 0x467dd0
push dword [ebp - 0x18]
call fcn.004f0535
cmp esi, edi
pop ecx
je 0x467d93
push esi
jmp 0x467d8d
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x84]
call fcn.0042e041
movzx eax, byte [ebp - 0x1d]
push eax
movzx eax, byte [ebp - 0x1e]
push eax
movzx eax, byte [ebp - 0x1f]
push eax
movzx eax, byte [ebp - 0x20]
push eax
movzx eax, byte [ebp - 0x21]
push eax
movzx eax, byte [ebp - 0x22]
push eax
movzx eax, byte [ebp - 0x23]
push eax
movzx eax, byte [ebp - 0x24]
push eax
movzx eax, byte [ebp - 0x25]
push eax
movzx eax, byte [ebp - 0x26]
push eax
movzx eax, byte [ebp - 0x27]
push eax
movzx eax, byte [ebp - 0x28]
push eax
movzx eax, byte [ebp - 0x29]
push eax
movzx eax, byte [ebp - 0x2a]
push eax
movzx eax, byte [ebp - 0x2b]
push eax
movzx eax, byte [ebp - 0x2c]
push eax
mov eax, dword [ebp + 0xc]
push 0x544a90
call fcn.00406455
add esp, 0x48
cmp esi, edi
je 0x467e9d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x469798
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push 2
xor esi, esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp eax, esi
mov dword [ebp - 4], eax
jne 0x4697ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
leave
ret
push edi
push esi
push esi
push esi
push esi
push dword [ebp + 0x18]
push dword [ebp + 8]
push 1
push 2
push 0x10
push 0x32
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov edi, eax
cmp edi, esi
jne 0x46983b
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0x431
je 0x469801
call edi
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
pop edi
jmp 0x4697b7
push 2
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
cmp edi, esi
jne 0x46981d
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4697f1
push dword [ebp + 0x14]
push esi
push esi
push esi
push esi
push dword [ebp + 0x18]
push dword [ebp + 8]
push 1
push 2
push 0x10
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
je 0x469815
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x4697f3

Function at 0x469857
Capabilities:
Delete service

Disassembly:
push edi
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x469871
pop edi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
push esi
push 0x10000
push dword [esp + 0x14]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
jne 0x4698a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push edi
call ebx
mov eax, esi
pop esi
pop ebx
pop edi
ret
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x4698c3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, eax
call edi
push esi
call edi
mov eax, ebx
jmp 0x46989c
push esi
call ebx
xor esi, esi
jmp 0x469897
Function at 0x4698ca
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push edi
push 0x40000000
xor edi, edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp eax, edi
mov dword [ebp - 4], eax
jne 0x4698ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x46993c
push ebx
push esi
push 0x14
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, eax
cmp ebx, edi
jne 0x469916
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push dword [ebp - 4]
jmp 0x469962
push 6
mov dword [ebp - 0x20], edi
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x46993f
cmp dword [ebp - 0x1c], 4
jne 0x46993f
xor eax, eax
pop esi
pop ebx
pop edi
leave
ret
xor edi, edi
push edi
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x469968
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
call esi
push ebx
call esi
mov eax, edi
jmp 0x46993a
push ebx
call esi
jmp 0x469911

Function at 0x46996d
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push esi
push 0x40000000
xor esi, esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp eax, esi
mov dword [ebp - 4], eax
jne 0x469992
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4699bb
push ebx
push edi
push 0x24
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
cmp ebx, esi
jne 0x4699be
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
pop edi
pop ebx
pop esi
leave
ret
push 6
pop ecx
xor eax, eax
mov dword [ebp - 0x40], esi
lea edi, [ebp - 0x3c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x40]
push eax
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x4699f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
call esi
push ebx
call esi
mov eax, edi
jmp 0x4699b9
push 6
mov dword [ebp - 0x24], esi
pop ecx
xor eax, eax
lea edi, [ebp - 0x20]
mov dword [ebp - 8], esi
mov esi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
rep stosd dword es:[edi], eax
jmp 0x469a1c
cmp dword [ebp - 0x20], 1
je 0x469a30
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x24]
push eax
push ebx
call esi
test eax, eax
jne 0x469a0e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [ebp - 8]
jmp 0x4699ae
Function at 0x46a2bb
Capabilities:
Get common file path

Disassembly:
mov eax, 0x50f2a8
call fcn.0050df3c
sub esp, 0x214
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
push esi
mov dword [ebp - 0x18], ebx
mov esi, dword [ebp + 8]
mov ecx, 0x55fb0c
call fcn.00405c33
xor esi, esi
mov dword [ebp - 4], ebx
inc esi
push ebx
mov dword [ebp - 0x18], esi
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x14]
push eax
push 0x1a
push ebx
mov dword [ebp - 0x14], ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
push 0x206
lea eax, [ebp - 0x21e]
push ebx
push eax
mov word [ebp - 0x220], bx
call fcn.004f0540
add esp, 0xc
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea eax, [ebp - 0x220]
push eax
call fcn.004f0eb4
test eax, eax
pop ecx
je 0x46a35b
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp - 0x220]
push eax
push dword [ebp + 8]
call fcn.00405e0b
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 4], esi
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jl 0x46a37b
mov eax, dword [ebp - 0x10]
push dword [ebp - 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x10]
pop esi
cmp eax, ebx
pop ebx
je 0x46a393
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov dword fs:[0], ecx
leave
ret

Function at 0x46a3a2
Capabilities:
Get common file path

Disassembly:
mov eax, 0x51165f
call fcn.0050df3c
sub esp, 0x210
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 4], edi
mov ecx, 0x55fb0c
mov dword [ebp - 0x10], edi
call fcn.00405c33
push 0x208
lea eax, [ebp - 0x21a]
mov dword [ebp - 4], edi
push edi
push eax
mov dword [ebp - 0x10], 1
mov word [ebp - 0x21c], di
call fcn.004f0540
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x46a430
lea eax, [ebp - 0x21c]
push eax
call fcn.004f0eb4
test eax, eax
pop ecx
je 0x46a430
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp - 0x21c]
push eax
push esi
call fcn.00405e0b
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x46a440
Capabilities:
Create shortcut via ishelllink

Disassembly:
mov eax, 0x50e8e7
call fcn.0050df3c
push ecx
push ecx
push ebx
push edi
xor ebx, ebx
push ebx
xor edi, edi
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x10]
push eax
push 0x53a9bc
push 1
push ebx
push 0x53a9dc
mov byte [ebp - 4], 1
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
jl 0x46a4f0
mov eax, dword [esi + 8]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x50]
mov eax, dword [esi + 0xc]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x24]
mov eax, dword [esi + 0x10]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x2c]
mov eax, dword [esi + 4]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x1c]
push dword [esi + 0x18]
mov eax, dword [esi + 0x14]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x44]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
lea edx, [ebp - 0x14]
push edx
push 0x53aa1c
push eax
call dword [ecx]
cmp eax, ebx
jl 0x46a4f0
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
push 1
push eax
push ecx
call dword [edx + 0x18]
cmp eax, ebx
jl 0x46a4f0
inc edi
call dword [sym.imp.ole32.dll_CoUninitialize]
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x46a506
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x46a517
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x46ae1d
Capabilities:
Check if file exists
Delete file

Disassembly:
mov eax, 0x510e27
call fcn.0050df3c
sub esp, 0x10
push ebx
push esi
mov esi, ecx
xor ebx, ebx
call fcn.00407e80
cmp eax, 0xc
jne 0x46af02
lea eax, [ebp - 0x14]
push edi
push eax
call fcn.0046a2bb
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x14]
mov dword [esp], str.MicrosoftInternet_ExplorerQuick_LaunchUser_PinnedTaskBar_
push eax
call fcn.004061c6
mov eax, dword [0x55fb0c]
mov ecx, 0x55fb0c
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 1
push dword [esi]
lea eax, [ebp - 0x18]
push dword [ebp - 0x14]
push str._s_s.lnk
call fcn.00406455
add esp, 0xc
lea edi, [esi + 0x1c]
lea eax, [ebp - 0x18]
call fcn.00404ec2
mov edi, dword [ebp - 0x18]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x10]
push eax
call fcn.0046a3a2
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], 2
call fcn.0046a440
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
je 0x46aee3
push dword [esi]
lea ecx, [ebp - 0x10]
push str._s.lnk
call fcn.00428361
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x10]
call fcn.0046ade3
add esp, 0x10
push dword [ebp - 0x10]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00405980
lea eax, [edi - 0x10]
call fcn.00405980
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00405980
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x46b0fe
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push esi
mov esi, eax
mov ecx, dword [esi]
xor eax, eax
cmp dword [ecx - 0xc], eax
je 0x46b280
push ebx
push edi
push 0x208
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.004f0540
add esp, 0xc
mov edi, str._ALLUSERSPROFILE_
push edi
xor ecx, ecx
call fcn.0040833e
or ebx, 0xffffffff
cmp eax, ebx
jne 0x46b248
mov edi, str._APPDATA_
push edi
xor ecx, ecx
call fcn.0040833e
cmp eax, ebx
jne 0x46b248
mov edi, str._TEMP_
push edi
xor ecx, ecx
call fcn.0040833e
cmp eax, ebx
jne 0x46b248
mov edi, str._SYSTEM_
push edi
xor ecx, ecx
call fcn.0040833e
cmp eax, ebx
je 0x46b1c1
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jbe 0x46b25f
lea eax, [ebp - 0x20c]
push eax
push edi
push esi
call fcn.00407231
mov eax, esi
call fcn.004061e9
mov edi, 0x53fd2c
jmp 0x46b26f
mov edi, str._WINDOWS_
push edi
xor ecx, ecx
call fcn.0040833e
cmp eax, ebx
je 0x46b1e6
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x46b19a
mov edi, str._CUR_DIR_
push edi
xor ecx, ecx
call fcn.0040833e
cmp eax, ebx
je 0x46b233
push 0x20a
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004f0540
add esp, 0xc
push 0x105
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
jmp 0x46b1a2
mov edi, 0x544e18
push edi
xor ecx, ecx
call fcn.0040833e
cmp eax, ebx
je 0x46b1b0
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.0042901f
test eax, eax
pop ecx
pop ecx
jne 0x46b1a2
xor eax, eax
jmp 0x46b27e
push 0x53e99c
push edi
push esi
call fcn.00407231
push edi
xor ecx, ecx
call fcn.0040833e
cmp eax, ebx
jne 0x46b263
xor eax, eax
inc eax
pop edi
pop ebx
pop esi
leave
ret

Function at 0x46b283
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x46b327
push edi
push 1
push esi
call fcn.004f178a
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x46b324
push edi
push esi
push dword [ebp - 8]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x46b31d
and dword [ebp - 4], 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x46b31d
cmp dword [ebp - 4], 0
je 0x46b31d
push 0x10
call fcn.004152d5
mov esi, eax
test esi, esi
pop ecx
je 0x46b324
mov eax, dword [ebp - 4]
movzx ecx, word [eax + 2]
movzx eax, word [eax]
mov dword [esi + 8], ecx
lea ecx, [ebp - 0x10]
push ecx
mov dword [esi + 4], eax
lea eax, [esi + 0xc]
and dword [eax], 0
push eax
push 0x53e99c
push edi
mov dword [esi], edi
call sub.VERSION.dll_VerQueryValueW
mov eax, esi
jmp 0x46b326
push edi
call fcn.004f01f0
pop ecx
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x46b344
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push ebx
push esi
mov esi, eax
mov ax, word [esi + 4]
mov word [ebp - 0x14], ax
mov ax, word [esi + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov word [ebp - 0x12], ax
call edi
mov word [ebp - 0x10], ax
mov ax, word [esi + 8]
mov word [ebp - 0xe], ax
mov ax, word [esi + 4]
mov word [ebp - 0xc], ax
mov word [ebp - 0xa], 0x4e4
call edi
mov word [ebp - 8], ax
mov word [ebp - 6], 0x4e4
xor edi, edi
mov ebx, 0x104
movzx eax, word [ebp + edi*2 - 0x14]
movzx ecx, word [ebp + edi*2 - 0x12]
inc edi
push 0x544e68
movzx ecx, cx
push ecx
movzx eax, ax
push eax
push str.StringFileInfo_04x_04x_ls
push ebx
lea eax, [ebp - 0x220]
push ebx
push eax
inc edi
call fcn.004f3e31
and dword [ebp - 4], 0
add esp, 0x1c
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x220]
push eax
push dword [esi]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x46b3ea
cmp dword [ebp - 4], 0
jne 0x46b3f8
cmp edi, 8
jb 0x46b397
xor al, al
pop edi
pop esi
pop ebx
leave
ret 4
mov esi, dword [ebp - 4]
push esi
call fcn.004f0eb4
pop ecx
mov ecx, esi
mov esi, dword [ebp + 8]
call fcn.00407871
mov al, 1
jmp 0x46b3f1

Function at 0x46b504
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
push edi
xor edi, edi
push 0x206
lea eax, [ebp - 0x222]
push edi
push eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 8], edi
mov word [ebp - 0x224], di
call fcn.004f0540
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push 0x20019
push edi
push str.SYSTEMCurrentControlSetEnumPCI
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], 0x104
mov dword [ebp - 0x10], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x46b618
mov eax, dword [ebp - 0x10]
push ebx
mov dword [ebp - 0xc], eax
push esi
lea eax, [ebp - 0x1c]
push eax
push edi
push edi
push edi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc dword [ebp - 8]
test eax, eax
jne 0x46b608
mov ebx, dword [ebp + 8]
xor esi, esi
inc esi
add ebx, 0x48
cmp word [ebp - 0x224], di
je 0x46b5c8
cmp word [ebx], di
je 0x46b5c8
push ebx
call fcn.004f0eb4
cmp eax, 1
pop ecx
jb 0x46b5c8
cmp dword [ebp - 4], eax
jbe 0x46b5c8
push eax
lea eax, [ebp - 0x224]
push ebx
push eax
call fcn.004f1903
add esp, 0xc
test eax, eax
je 0x46b5f2
inc esi
add ebx, 0x40
cmp esi, 3
jb 0x46b594
push 0x208
lea eax, [ebp - 0x224]
push edi
push eax
call fcn.004f0540
add esp, 0xc
mov dword [ebp - 4], 0x104
jmp 0x46b566
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
shl esi, 6
mov eax, dword [esi + eax + 4]
mov dword [ecx], eax
mov dword [ebp - 0x14], 1
cmp dword [ebp - 0xc], edi
pop esi
pop ebx
je 0x46b618
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x14]
pop edi
leave
ret 8