joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45c990
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47f288
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4be5b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
add ebx, 0x30
mov eax, dword [ebx]
mov ecx, dword [eax - 0x10]
lea esi, [eax - 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [esi + 0xc], 0
mov ecx, eax
lea eax, [esi + 0xc]
jl 0x45c9e2
cmp ecx, dword [esi]
jne 0x45c9e2
lock inc dword [eax]
jmp 0x45ca10
mov eax, dword [ecx]
lea edi, [esi + 4]
push 2
push dword [edi]
call dword [eax]
mov esi, eax
test esi, esi
je 0x45cb70
mov eax, dword [edi]
mov dword [esi + 4], eax
mov eax, dword [edi]
inc eax
push eax
push dword [ebp - 0x10]
push eax
lea eax, [esi + 0x10]
push eax
call fcn.0041ab30
add esp, 0x10
add esi, 0x10
mov dword [ebp - 0x18], esi
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], 0
test ecx, ecx
je 0x45caf6
mov edi, ecx
lea edx, [edi + 2]
nop dword [eax]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x45ca30
sub edi, edx
sar edi, 1
je 0x45caf6
mov edx, dword [ebx]
mov eax, dword [edx - 0xc]
mov dword [ebp - 0x14], eax
mov eax, ecx
sub eax, edx
sar eax, 1
mov dword [ebp - 0x10], eax
test edi, edi
js 0x45cb75
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, edi
or eax, ecx
jge 0x45ca79
push edi
mov ecx, ebx
call fcn.00410500
mov edx, dword [ebx]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
ja 0x45cace
lea ecx, [edi + edi]
lea eax, [edx + eax*2]
mov dword [ebp + 0xc], eax
test ecx, ecx
je 0x45cade
test eax, eax
jne 0x45caa4
call fcn.00434795
mov dword [eax], 0x16
call fcn.0043462e
jmp 0x45cade
mov eax, dword [edx - 8]
add eax, eax
cmp eax, ecx
jae 0x45cabf
call fcn.00434795
mov dword [eax], 0x22
call fcn.0043462e
jmp 0x45cade
push ecx
push dword [ebp + 0xc]
push edx
call fcn.004326c0
add esp, 0xc
jmp 0x45cade
push edi
push dword [ebp + 0xc]
push dword [edx - 8]
push edx
call fcn.0041ab30
add esp, 0x10
mov eax, dword [ebx]
cmp edi, dword [eax - 8]
jg 0x45cb75
mov dword [eax - 0xc], edi
xor ecx, ecx
mov eax, dword [ebx]
mov word [eax + edi*2], cx
jmp 0x45cafd
mov ecx, ebx
call fcn.00409920
mov eax, dword [ebx]
test eax, eax
je 0x45cb7f
mov ecx, esi
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x45cb2b
test dx, dx
je 0x45cb27
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x45cb2b
add ecx, 4
add eax, 4
test dx, dx
jne 0x45cb05
xor eax, eax
jmp 0x45cb30
sbb eax, eax
or eax, 1
test eax, eax
je 0x45cb3d
mov ecx, dword [ebp + 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x45cb5c
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.00416f00
push 0x80070057
call fcn.004068b0
push 0x80004005
call fcn.004068b0
int3
Function at 0x45f200
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x4be5b4]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x40
lea eax, [ebp - 0x44]
push 0
push eax
call fcn.00432c40
add esp, 0xc
mov dword [ebp - 0x44], 0x40
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp + 0x10]
jb 0x45f258
ja 0x45f243
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp + 0xc]
jb 0x45f258
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042c75e
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.0042c75e
mov esp, ebp
pop ebp
ret 0xc

Function at 0x45f590
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4be5b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x45f641
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00432c40
add esp, 0xc
mov dword [ebp - 0x214], 1
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0x104
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push str.Setup_Path
push str.SOFTWARELDSGameMaster
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x45f641
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45f641
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0x10]
push esi
call fcn.0044310e
add esp, 0xc
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042c75e
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.0042c75e
mov esp, ebp
pop ebp
ret 0xc
Function at 0x45fcd0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47f5a6
mov eax, dword fs:[0]
push eax
sub esp, 0x818
mov eax, dword [0x4be5b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x824]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x818], eax
call fcn.00477b40
push esi
push edi
push ebx
lea ecx, [ebp - 0x824]
mov dword [ebp - 4], 0
call fcn.00477ea0
test eax, eax
jne 0x45fd3b
xor edi, edi
jmp 0x45fe1f
call fcn.0040b4c0
mov ecx, eax
test ecx, ecx
je 0x45fe4a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x814], eax
push 0
lea eax, [ebp - 0x814]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x824]
call fcn.00478130
test eax, eax
jne 0x45fd7b
xor edi, edi
jmp 0x45fdfd
push 0x800
lea eax, [ebp - 0x810]
push 0
push eax
call fcn.00432c40
add esp, 0xc
lea eax, [ebp - 0x810]
push 0x493d94
push dword [ebp - 0x814]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x810]
push eax
call fcn.00471180
mov ecx, dword [ebp - 0x818]
lea edx, [ebp - 0x810]
add esp, 4
lea esi, [edx + 2]
mov edi, eax
lea ecx, [ecx + 0x9c]
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x45fdd0
sub edx, esi
lea eax, [ebp - 0x810]
sar edx, 1
push edx
push eax
call fcn.00416a50
push 4
push 0
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov esi, dword [ebp - 0x814]
or eax, 0xffffffff
mov byte [ebp - 4], 0
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x45fe1f
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
lea ecx, [ebp - 0x824]
call fcn.00477b60
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042c75e
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.004068b0
int3
Function at 0x460670
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47f6b0
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x4be5b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov ecx, dword [ebx + 0x14]
test ecx, ecx
je 0x4606bc
mov eax, dword [ecx]
push 1
push ecx
call dword [eax + 0x10]
mov ecx, dword [ebx + 0x14]
test ecx, ecx
je 0x4606b5
mov eax, dword [ecx]
push 1
call dword [eax + 0x1c]
mov dword [ebx + 0x14], 0
mov ecx, dword [ebx + 0x98]
test ecx, ecx
je 0x46077b
cmp dword [ebp + 0xc], 1
jne 0x460760
call fcn.00476370
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.00407840
lea edi, [eax + 0x10]
mov dword [ebp + 0xc], edi
mov eax, dword [ebx + 4]
sub eax, 0x10
mov dword [ebp - 4], 0
push eax
call fcn.00407840
add eax, 0x10
add esp, 8
mov dword [ebp + 8], eax
push 0xd
push str.FileList.xml
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call fcn.00405f70
mov esi, dword [ebp + 8]
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea edx, [esi - 0x10]
mov byte [ebp - 4], 0
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x460744
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], esi
dec esi
test esi, esi
jg 0x460760
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebx + 0x98]
test ecx, ecx
je 0x460771
mov eax, dword [ecx]
push 1
call dword [eax + 0x48]
mov dword [ebx + 0x98], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x460ca0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x38], 1
mov dword [esi + 0x3c], 1
mov dword [esi + 0x40], 1
mov dword [esi + 0x44], 1
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 1
mov dword [esi + 0x50], 1
mov dword [esi + 0x54], 1
mov dword [esi + 0x58], 1
mov dword [esi + 0x5c], 1
mov dword [esi + 0x60], 1
mov dword [esi + 0x64], 1
mov dword [esi + 0x68], 2
mov dword [esi + 0x74], 1
mov dword [esi + 0x78], 1
mov dword [esi + 0x70], 1
mov dword [esi + 0x7c], 0
mov ebx, dword [esi + 0x9c]
mov edi, dword [esi + 0x98]
cmp edi, ebx
je 0x460d91
nop dword [eax]
mov edx, dword [edi]
or eax, 0xffffffff
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x460d7a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 4
cmp edi, ebx
jne 0x460d60
mov eax, dword [esi + 0x98]
pop edi
mov dword [esi + 0x9c], eax
pop esi
pop ebx
ret
mov dword [esi + 0x9c], edi
pop edi
pop esi
pop ebx
ret
Function at 0x460da0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47f7a0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4be5b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x460e8f
push esi
lea ecx, [ebp + 0xc]
call fcn.00403f50
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
or edi, 0xffffffff
test eax, eax
je 0x460e4e
mov eax, dword [ebp + 8]
add eax, 4
push 0x483fd8
push eax
lea eax, [ebp + 8]
push eax
call fcn.00404d40
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.00404c60
mov edx, dword [ebp + 8]
mov eax, edi
mov byte [ebp - 4], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x460e30
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x460e35
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp + 0xc]
call fcn.00405f70
push dword [ebp + 0xc]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x460e70
push 0xffffffffffffffff
push 0
push 0
push 0
push 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0045c2f0
mov edx, dword [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x460e8f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x460eb0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
cmp dword [edx], 0
je 0x460f1a
push esi
mov esi, dword [edx + 4]
test esi, esi
je 0x460f19
mov eax, esi
push ebx
lea ebx, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x460ed0
sub eax, ebx
sar eax, 1
je 0x460f18
mov ebx, dword [edx + 0xc]
mov ecx, ebx
lea eax, [ecx + 2]
mov dword [ebp + 0xc], eax
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x460ef0
sub ecx, dword [ebp + 0xc]
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push ebx
push dword [edx + 0x10]
push dword [edx + 8]
push esi
push dword [edx]
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
pop ebx
pop esi
pop ebp
ret 8
Function at 0x461650
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47f83b
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x4be5b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00432c40
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push dword [0x4c021c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call esi
call fcn.0040e640
test eax, eax
mov edx, str.GameMemoryOpt.dll
mov ecx, str.GameMemoryOpt_x64.dll
lea eax, [ebp - 0x218]
cmove ecx, edx
push ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x46181f
mov eax, dword [0x4c24a8]
test al, 1
jne 0x461738
or eax, 1
mov dword [0x4c24a8], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x481600
mov dword [0x4c249c], 0x482874
mov dword [0x4c24a0], eax
mov byte [0x4c24a4], 0
call fcn.0042c749
mov eax, dword [0x4c24a8]
add esp, 4
test al, 2
jne 0x461794
or eax, 2
mov dword [0x4c24ac], 0x483b00
mov dword [0x4c24a8], eax
xor eax, eax
push 0x481630
mov dword [0x4c24b0], 0x4c249c
mov dword [0x4c24c0], 2
mov dword [0x4c24b8], 0
mov dword [0x4c24bc], 0
mov dword [0x4c24c4], eax
mov dword [0x4c24b4], 0x4c24ac
call fcn.0042c749
add esp, 4
mov eax, dword [0x4c24ac]
mov ecx, 0x4c24ac
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
cmp dword [ebp + 8], 0
lea eax, [ebp - 0x218]
push eax
mov ecx, str._u__s___s_
mov dword [ebp - 4], 0
mov eax, 0x494020
cmove eax, ecx
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.00409e30
mov esi, dword [ebp - 0x21c]
push 0
push 0
push 0
push 0x1388
push 1
push 0
push esi
push str.regsvr32.exe
push 0
call fcn.00468820
add esp, 0x30
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x46181a
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042c75e
mov esp, ebp
pop ebp
ret 4
Function at 0x461840
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47f87b
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x4be5b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
push 0
push esi
push 0x461220
push 0
push 0
call fcn.00440a9e
add esp, 0x18
mov ecx, esi
mov ebx, eax
push 0
call fcn.004613b0
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xc8
call edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 1
mov ecx, esi
call fcn.00461650
call fcn.00461590
test eax, eax
je 0x46195e
mov dword [ebp - 0x21c], 0
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], 0
push eax
push 0x494074
push 0x17
push 0
push 0x4af7b4
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x461945
mov eax, dword [ebp - 0x21c]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
test eax, eax
js 0x461945
mov eax, dword [ebp - 0x21c]
push 0x4c0220
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
test eax, eax
js 0x46191d
cmp eax, 1
jne 0x461945
mov esi, 2
sub esi, 1
js 0x461945
mov eax, dword [ebp - 0x21c]
push 0x4c0220
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
test eax, eax
jns 0x461945
push 0x3e8
call edi
jmp 0x461922
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x46199f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x46199f
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0x4c0220
call dword [sym.imp.ole32.dll_StringFromGUID2]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomW]
test ax, ax
jne 0x461994
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
push 0x4c0220
call dword [sym.imp.SHELL32.dll_SHLoadInProc]
push 0x3a98
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042c75e
mov esp, ebp
pop ebp
ret 4
Function at 0x4632e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4b9250
push 0x431fe0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4be5b4]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
xor esi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 4], esi
push esi
push 0x80
push 2
push esi
push 1
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x20], edi
cmp edi, 0xffffffff
je 0x4633bb
push 0x4ac110
mov esi, dword [ebp + 0xc]
push esi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
call ebx
test eax, eax
jne 0x46335e
mov esi, 0x4ac120
jmp 0x463388
push str.UTF16BE
push esi
call ebx
test eax, eax
jne 0x463371
mov esi, 0x4ac134
jmp 0x463388
push str.UTF8
push esi
call ebx
mov esi, str...
test eax, eax
mov eax, 0x48461f
cmovne esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
mov dword [ebp + 8], 0
push 0
lea eax, [ebp + 8]
push eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x4633bb
xor eax, eax
cmp dword [ebp + 8], ebx
cmovne esi, eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0xfffffffe
call fcn.004633e3
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x464b70
Capabilities:
Get session user name
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47fd5b
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x4be5b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x464bbe
mov eax, 1
jmp 0x464cf3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x464bd0
xor eax, eax
jmp 0x464cf3
lea ecx, [ebp - 0x220]
call fcn.00468a90
push 0x1a
lea ecx, [ebp - 0x220]
mov dword [ebp - 4], 0
call fcn.00468bc0
mov dword [ebp - 0x224], eax
test eax, eax
je 0x464c20
push 0xf003f
push eax
push str.SYSTEMCurrentControlSetControlSession_Manager
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x220]
call fcn.00468c40
push dword [ebp - 0x224]
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 0x228]
mov dword [ebp - 0x228], 0x105
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x220]
call fcn.00468ae0
mov dword [ebp - 0x224], eax
test eax, eax
je 0x464c81
push 0xf003f
push eax
push str.SYSTEMCurrentControlSetControlSession_Manager
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x220]
call fcn.00468c40
push dword [ebp - 0x224]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x464c95
mov esi, 1
jmp 0x464ce6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x464ca4
xor esi, esi
jmp 0x464ce6
push 1
lea ecx, [ebp - 0x220]
call fcn.00468bc0
mov esi, eax
test esi, esi
je 0x464cd9
push 0xf003f
push esi
push str.SYSTEMCurrentControlSetControlSession_Manager
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x220]
call fcn.00468c40
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp + 0x10]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov esi, eax
lea ecx, [ebp - 0x220]
call fcn.00468aa0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042c75e
mov esp, ebp
pop ebp
ret 0xc
Function at 0x465a30
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x67c
mov eax, dword [0x4be5b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x465bdb
test ebx, ebx
je 0x465bdb
mov ecx, 0x81
cmp dword [ebp + 0x10], ecx
push edi
cmovle ecx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x67c], ecx
cmp edi, ecx
jge 0x465bc6
push 0x210
lea eax, [ebp - 0x424]
push 0
push eax
call fcn.00432c40
add esp, 0xc
lea eax, [ebp - 0x424]
push 0x48451c
push ebx
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0x250
lea eax, [ebp - 0x674]
push 0
push eax
call fcn.00432c40
add esp, 0xc
lea eax, [ebp - 0x674]
push eax
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x678], eax
cmp eax, 0xffffffff
je 0x465bc6
nop dword [eax + eax]
push 0x210
lea eax, [ebp - 0x214]
push 0
push eax
call fcn.00432c40
add esp, 0xc
lea eax, [ebp - 0x648]
push eax
push ebx
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test dword [ebp - 0x674], 0x10
jne 0x465b3f
lea eax, [edi + 1]
cmp eax, dword [esi]
jl 0x465b7c
push 0x80
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x465b7c
cmp word [ebp - 0x648], 0x2e
jne 0x465b65
mov ax, word [ebp - 0x646]
test ax, ax
je 0x465b7c
cmp ax, 0x2e
jne 0x465b65
cmp word [ebp - 0x644], 0
je 0x465b7c
lea eax, [edi + 1]
push eax
push dword [ebp - 0x67c]
lea eax, [ebp - 0x214]
push eax
push esi
call fcn.00465a30
lea eax, [ebp - 0x674]
push eax
push dword [ebp - 0x678]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x465ae0
push dword [ebp - 0x678]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp edi, dword [esi]
jl 0x465bae
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042c75e
mov esp, ebp
pop ebp
ret 0x10
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042c75e
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.0042c75e
mov esp, ebp
pop ebp
ret 0x10
Function at 0x466050
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
xorps xmm0, xmm0
mov dword [ebp - 0x54], 0x44
lea eax, [ebp - 0x54]
movlpd qword [ebp - 0x50], xmm0
push eax
movlpd qword [ebp - 0x48], xmm0
movlpd qword [ebp - 0x40], xmm0
movlpd qword [ebp - 0x38], xmm0
movlpd qword [ebp - 0x30], xmm0
movlpd qword [ebp - 0x28], xmm0
movlpd qword [ebp - 0x20], xmm0
movlpd qword [ebp - 0x18], xmm0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor eax, eax
mov dword [ebp - 0x28], 1
mov word [ebp - 0x24], ax
xorps xmm0, xmm0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp + 8]
movups xmmword [ebp - 0x10], xmm0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4660f5
push 0x1388
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret