joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44b064
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
je 0x44b1e4
mov byte [ebp - 0x11], 1
mov eax, dword [ebp - 8]
call fcn.004039d0
mov dword [ebp - 0x10], eax
call fcn.00449818
call fcn.004491b0
xor eax, eax
push ebp
push 0x44b1dd
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.user32.dll_EmptyClipboard
mov esi, dword [ebp - 0x10]
inc esi
push esi
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x44b11d
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
xor eax, eax
push ebp
push 0x44b116
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x44b0ff
mov eax, dword [ebp - 8]
call fcn.00403b94
mov ecx, esi
mov edx, ebx
call fcn.0040275c
mov eax, dword [ebp - 0xc]
push eax
push 1
call sub.user32.dll_SetClipboardData
test eax, eax
sete byte [ebp - 0x11]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44b11d
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
cmp byte [ebp - 0x11], 0
jne 0x44b1a9
mov esi, dword [ebp - 0x10]
inc esi
mov eax, esi
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
xor eax, eax
push ebp
push 0x44b1a2
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x44b18b
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x1e8]
mov byte [ebx], al
inc ebx
mov eax, dword [ebp - 8]
call fcn.00403b94
mov ecx, esi
mov edx, ebx
call fcn.0040275c
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x4819f4]
push eax
call sub.user32.dll_SetClipboardData
test eax, eax
sete byte [ebp - 0x11]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44b1a9
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44b1e4
call fcn.00449818
call fcn.00449184
cmp byte [ebp - 0x11], 0
je 0x44b1dc
mov ecx, 0x44b1f4
mov dl, 1
mov eax, dword [0x449934]
call fcn.0040956c
call fcn.00403214
ret
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x466fa8
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push ebx
xor ebx, ebx
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x466ff4
cmp dword [ebp - 0x84], 2
jne 0x466ff4
cmp dword [ebp - 0x90], 5
jg 0x466ff2
cmp dword [ebp - 0x90], 5
jne 0x466ff4
cmp dword [ebp - 0x8c], 1
jl 0x466ff4
mov bl, 1
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x467828
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x46786e
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0042f45c
mov eax, dword [ebp - 4]
call fcn.00403b94
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467875
lea eax, [ebp - 4]
call fcn.00403754
ret

Function at 0x46787c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00403b94
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x467895
test al, 0x10
je 0x467899
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x4678b4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00403b94
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4678d2
test al, 0x10
je 0x4678d2
test ah, 4
je 0x4678d6
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x467a04
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x467a91
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x467a4e
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA_2
mov ecx, eax
lea edx, [ebp - 0x108]
mov eax, esi
call fcn.00403838
jmp 0x467a7b
call sub.kernel32.dll_GetCommandLineA_1
cmp byte [eax], 0
jne 0x467a62
lea eax, [ebp - 4]
call fcn.00403754
jmp 0x467a71
lea edx, [ebp - 4]
call fcn.00467924
test ebx, ebx
je 0x467a71
dec ebx
jmp 0x467a53
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.004037ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467a98
lea eax, [ebp - 4]
call fcn.00403754
ret

Function at 0x467b18
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.004075a4
add esp, 0x104
pop ebx
ret

Function at 0x467b44
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov edx, ebx
mov eax, esp
call fcn.004075a4
add esp, 0x104
pop ebx
ret
Function at 0x467c30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x467d51
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push edi
push esi
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x467d3b
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
je 0x467c89
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x467d3b
cmp dword [ebp - 0xc], 0
jne 0x467c9e
mov eax, dword [ebp - 4]
call fcn.00403754
mov bl, 1
jmp 0x467d3b
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
xor edx, edx
call fcn.00403838
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
call fcn.00403ba0
push eax
lea eax, [ebp - 8]
push eax
push 0
push edi
push esi
call sub.advapi32.dll_RegQueryValueExA_1
cmp eax, 0xea
je 0x467c55
test eax, eax
jne 0x467d3b
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
je 0x467ce5
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x467d3b
jmp 0x467ce5
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0
je 0x467cf8
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
cmp byte [eax + edx - 1], 0
je 0x467ce2
cmp dword [ebp - 8], 7
jne 0x467d07
cmp dword [ebp - 0xc], 0
je 0x467d07
inc dword [ebp - 0xc]
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00403d00
cmp dword [ebp - 8], 7
jne 0x467d2e
cmp dword [ebp - 0xc], 0
je 0x467d2e
lea eax, [ebp - 0x10]
call fcn.00403ba0
mov edx, dword [ebp - 0xc]
mov byte [eax + edx - 1], 0
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
call fcn.004037a8
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467d58
lea eax, [ebp - 0x10]
call fcn.00403754
ret

Function at 0x467dd0
Capabilities:
Delete registry key

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, edx
cmp al, 2
je 0x467de4
push esi
push ebx
call sub.advapi32.dll_RegDeleteKeyA
pop esi
pop ebx
ret
cmp dword [0x4824fc], 0
jne 0x467e07
push 0x467e2c
push 0x467e3c
call sub.kernel32.dll_GetModuleHandleA_1
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x4824fc], eax
cmp dword [0x4824fc], 0
je 0x467e21
push 0
push pe_nt_image_headers32
push esi
push ebx
call dword [0x4824fc]
jmp 0x467e26
mov eax, 0x7f
pop esi
pop ebx
ret
Function at 0x467e4c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x467f76
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x480358]
cmp dword [eax], 2
jne 0x467f50
push 0
push 8
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov al, byte [ebp - 1]
call fcn.00467da8
test eax, eax
jne 0x467f50
xor edx, edx
push ebp
push 0x467f49
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x14]
mov ecx, pe_nt_image_headers32
xor edx, edx
call fcn.00403838
xor ebx, ebx
mov eax, dword [ebp - 0x14]
call fcn.004039d0
mov dword [ebp - 0x18], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
call fcn.00403ba0
push eax
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegEnumKeyExA
cmp eax, 0xea
jne 0x467f12
mov eax, dword [ebp - 0x14]
call fcn.004039d0
cmp eax, 0x10000
jge 0x467f32
mov eax, dword [ebp - 0x14]
call fcn.004039d0
mov ecx, eax
add ecx, ecx
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.00403838
jmp 0x467eba
test eax, eax
jne 0x467f32
mov eax, dword [ebp - 0x14]
call fcn.00403b94
mov ecx, eax
mov edx, dword [ebp - 0x10]
mov al, byte [ebp - 1]
call fcn.00467e4c
test eax, eax
je 0x467eba
inc ebx
jmp 0x467eba
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467f50
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov al, byte [ebp - 1]
call fcn.00467dd0
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467f7d
lea eax, [ebp - 0x14]
call fcn.00403754
ret

Function at 0x467f84
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebp, ecx
mov edi, edx
mov ebx, eax
push 0
push 1
lea eax, [esp + 8]
push eax
mov ecx, ebp
mov edx, edi
mov eax, ebx
call fcn.00467da8
mov esi, eax
test esi, esi
jne 0x468002
push 0
push 0
push 0
push 0
lea eax, [esp + 0x18]
push eax
push 0
push 0
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
mov eax, dword [esp + 0x2c]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
mov esi, eax
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
test esi, esi
jne 0x468002
cmp dword [esp + 4], 0
jne 0x467ffd
cmp dword [esp + 8], 0
jne 0x467ffd
mov ecx, ebp
mov edx, edi
mov eax, ebx
call fcn.00467dd0
mov esi, eax
jmp 0x468002
mov esi, 0x91
mov eax, esi
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x46800c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4680b3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00403754
lea eax, [ebp - 8]
push eax
call sub.shell32.dll_SHGetMalloc
call fcn.0040af24
test al, al
je 0x46804f
lea eax, [ebp - 8]
call fcn.004049ec
lea eax, [ebp - 4]
push eax
push esi
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
call fcn.0040af1c
test al, al
je 0x46809d
lea eax, [ebp - 0x10c]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
test eax, eax
je 0x46808a
mov eax, ebx
lea edx, [ebp - 0x10c]
mov ecx, 0x104
call fcn.00403980
cmp dword [ebp - 8], 0
je 0x46809d
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4680ba
lea eax, [ebp - 8]
call fcn.004049ec
ret
Function at 0x46832c
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
xor edx, edx
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4684ec
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x4684b2
mov edx, dword [ebp - 4]
mov eax, 0x468504
call fcn.00403cb8
test eax, eax
jne 0x4684b2
mov eax, dword [ebp - 4]
call fcn.004678b4
test al, al
je 0x4684b2
lea eax, [ebp - 0x14c]
push eax
lea edx, [ebp - 0x150]
mov eax, dword [ebp - 4]
call fcn.0042efc0
lea eax, [ebp - 0x150]
mov edx, 0x468510
call fcn.004039d8
mov eax, dword [ebp - 0x150]
call fcn.00403b94
push eax
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x4684b2
xor eax, eax
push ebp
push 0x4684ab
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x468514
lea eax, [ebp - 0x120]
call fcn.0040745c
test eax, eax
je 0x46847c
mov edx, 0x468518
lea eax, [ebp - 0x120]
call fcn.0040745c
test eax, eax
je 0x46847c
lea edx, [ebp - 0x150]
mov eax, dword [ebp - 4]
call fcn.0042efc0
mov eax, dword [ebp - 0x150]
push eax
lea eax, [ebp - 0x154]
lea edx, [ebp - 0x120]
mov ecx, 0x104
call fcn.00403980
mov ecx, dword [ebp - 0x154]
lea eax, [ebp - 0xc]
pop edx
call fcn.00403a1c
mov ebx, dword [ebp - 0x14c]
test bl, 1
je 0x46845b
and ebx, 0xfffffffe
push ebx
mov eax, dword [ebp - 0xc]
call fcn.00403b94
push eax
call sub.kernel32.dll_SetFileAttributesA
test byte [ebp - 0x14c], 0x10
jne 0x468474
mov eax, dword [ebp - 0xc]
call fcn.00403b94
push eax
call sub.kernel32.dll_DeleteFileA
jmp 0x46847c
mov eax, dword [ebp - 0xc]
call fcn.0046832c
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x4683d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4684b2
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindClose
ret
mov eax, dword [ebp - 4]
call fcn.00403b94
push eax
call sub.kernel32.dll_RemoveDirectoryA
neg eax
sbb ebx, ebx
neg ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4684f3
lea eax, [ebp - 0x154]
mov edx, 2
call fcn.00403778
lea eax, [ebp - 0xc]
call fcn.00403754
ret

Function at 0x46a258
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
push 0
push 0
push 0
push 2
push 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
mov ecx, esi
mov edx, 0x80000000
xor eax, eax
call fcn.00467d70
call fcn.0046a1a8
xor eax, eax
push ebp
push 0x46a2d5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004039d0
inc eax
push eax
mov eax, ebx
call fcn.00403b94
push eax
push 1
push 0
push edi
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
call fcn.0046a1a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a2dc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
Function at 0x46a6d0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor ebx, ebx
push 0
push 1
lea eax, [ebp - 8]
push eax
mov ecx, esi
mov edx, 0x80000000
xor eax, eax
call fcn.00467da8
test eax, eax
jne 0x46a72a
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
push eax
push 0
push 0
push edi
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x46a734
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
mov ebx, eax
push 0
push 2
lea eax, [ebp - 4]
push eax
mov ecx, ebx
mov edx, 0x80000000
xor eax, eax
call fcn.00467da8
test eax, eax
jne 0x46a76b
push esi
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x46a770
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46a96a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x46a978
call fcn.0046a698
test al, al
jne 0x46a7ac
mov eax, 0x46a98c
call fcn.0046a698
test al, al
je 0x46a94c
lea edx, [ebp - 4]
xor eax, eax
call fcn.00467a04
lea eax, [ebp - 0x10]
mov ecx, 0x46a99c
mov edx, dword [ebp - 4]
call fcn.00403a1c
mov edx, dword [ebp - 0x10]
mov eax, 0x46a9a0
call fcn.0046a60c
test al, al
je 0x46a7e8
mov ecx, 0x46a9a0
mov edx, 0x80000000
xor eax, eax
call fcn.00467e4c
push 0x46a9c8
push dword [ebp - 4]
push 0x46a9d4
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00403a90
mov edx, dword [ebp - 0x10]
mov eax, 0x46a9dc
call fcn.0046a60c
test al, al
je 0x46a824
mov ecx, 0x46aa04
mov edx, 0x80000000
xor eax, eax
call fcn.00467e4c
push 0x46a9c8
push dword [ebp - 4]
push 0x46a9d4
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00403a90
mov edx, dword [ebp - 0x10]
mov eax, 0x46aa24
call fcn.0046a60c
test al, al
je 0x46a860
mov ecx, 0x46aa58
mov edx, 0x80000000
xor eax, eax
call fcn.00467e4c
push 0x46a9c8
push dword [ebp - 4]
push 0x46aa8c
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00403a90
mov edx, dword [ebp - 0x10]
mov eax, 0x46aa98
call fcn.0046a60c
test al, al
je 0x46a89c
mov ecx, 0x46aac4
mov edx, 0x80000000
xor eax, eax
call fcn.00467e4c
mov ecx, 0x46aae8
mov edx, 0x80000000
xor eax, eax
call fcn.00467f84
mov eax, 0x46a978
mov edx, 0x46ab0c
call fcn.0046a60c
test al, al
je 0x46a8ef
lea ecx, [ebp - 0xc]
lea edx, [ebp - 8]
mov eax, 0x46a978
call fcn.0046a6d0
test al, al
je 0x46a8ef
cmp dword [ebp - 8], 0
jne 0x46a8ef
cmp dword [ebp - 0xc], 1
jg 0x46a8ef
push 0x46a978
push 0x80000000
call sub.advapi32.dll_RegDeleteKeyA
mov eax, 0x46a978
call fcn.0046a698
test al, al
jne 0x46a92b
mov eax, 0x46a98c
mov edx, 0x46ab28
call fcn.0046a60c
test al, al
je 0x46a92b
mov eax, 0x46a98c
xor edx, edx
call fcn.0046a734
mov edx, 0x46ab3c
mov eax, 0x46a98c
call fcn.0046a734
mov ecx, 0x46a98c
mov edx, 0x80000000
xor eax, eax
call fcn.00467f84
push 0
push 0
push 0
push 0x8000000
call sub.shell32.dll_SHChangeNotify
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a971
lea eax, [ebp - 0x10]
call fcn.00403754
lea eax, [ebp - 4]
call fcn.00403754
ret
Function at 0x46f7c4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
mov byte [ebp - 5], 0
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.00403b94
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jle 0x46f866
mov eax, ebx
call fcn.00402668
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x46f85f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
push edi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x46f849
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x46f888
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x46f849
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46f87d
mov eax, dword [ebp - 0x10]
call fcn.00402680
ret
mov eax, dword [0x480358]
cmp dword [eax], 1
je 0x46f87d
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0046f5e8
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x475ae8
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push esi
push edi
test dl, dl
je 0x475af7
add esp, 0xfffffff0
call fcn.00402ea0
mov ebx, edx
mov edi, eax
mov ecx, 0x475b4c
xor edx, edx
mov eax, edi
call fcn.00445d10
push 0x475b70
push 0
push 0
call sub.kernel32.dll_CreateMutexA
mov esi, eax
mov dword [edi + 0x1c], esi
test esi, esi
je 0x475b2f
push 0xffffffffffffffff
push esi
call sub.kernel32.dll_WaitForSingleObject
inc eax
je 0x475b2f
mov byte [edi + 0x20], 1
test bl, bl
je 0x475b3d
pop dword fs:[0]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x476fcc
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffffec
push ebx
xor edx, edx
mov dword [ebp - 0x100c], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4771c8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1008]
push eax
push 0
push 0x4771d4
lea edx, [ebp - 0x100c]
mov eax, ebx
call fcn.0042f308
mov eax, dword [ebp - 0x100c]
call fcn.00403b94
push eax
call sub.kernel32.dll_GetTempFileNameA
test eax, eax
jne 0x477059
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x1014], eax
mov byte [ebp - 0x1010], 0
lea eax, [ebp - 0x1014]
push eax
push 0
mov ecx, 0x4771e0
mov dl, 1
mov eax, dword [0x406078]
call fcn.004095a0
call fcn.00403214
lea eax, [ebp - 4]
lea edx, [ebp - 0x1008]
mov ecx, 0x1000
call fcn.00403980
xor eax, eax
push ebp
push 0x477139
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x290]
mov eax, dword [eax + 0x14c]
mov edx, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
cmp byte [eax + 0x3ea], 0
je 0x4770e9
mov eax, ebx
call fcn.0046787c
test al, al
je 0x4770e9
lea ecx, [ebp - 8]
mov edx, 0x47721c
mov eax, ebx
call fcn.0042f034
mov eax, dword [ebp - 8]
call fcn.004071d4
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004071ec
test al, al
jne 0x4770e9
mov ecx, 0x47722c
mov dl, 1
mov eax, dword [0x406078]
call fcn.0040956c
call fcn.00403214
mov eax, ebx
call fcn.004071d4
test al, al
jne 0x47712f
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
je 0x47712f
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x1014], eax
mov byte [ebp - 0x1010], 0
lea eax, [ebp - 0x1014]
push eax
push 0
mov ecx, 0x477264
mov dl, 1
mov eax, dword [0x406078]
call fcn.004095a0
call fcn.00403214
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x477150
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004071ec
test al, al
jne 0x47718f
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x1014], eax
mov byte [ebp - 0x1010], 0
lea eax, [ebp - 0x1014]
push eax
push 0
mov ecx, 0x4772a8
mov dl, 1
mov eax, dword [0x406078]
call fcn.004095a0
call fcn.00403214
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
lea edx, [eax + 0x3b4]
mov eax, ebx
call fcn.00475984
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4771cf
lea eax, [ebp - 0x100c]
call fcn.00403754
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403778
ret