joyce8/EMBER2024-capa huggingface dataset:
Function at 0x460400
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, eax
xor eax, eax
push edi
xor edi, edi
cmp dword [ebp + 8], eax
mov dword [ebp - 4], eax
je 0x4604c0
cmp esi, 1
jbe 0x4604c0
push ebx
push esi
call fcn.0050828d
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x460490
lea eax, [esi*4 + 1]
push eax
call fcn.0050828d
mov edi, eax
add esp, 4
test edi, edi
je 0x460490
push 0xf0000040
push 1
push 0
push 0
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x460490
mov ecx, dword [ebp - 8]
push ebx
push esi
push ecx
mov dword [ebp - 4], 1
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x460490
lea eax, [esi*4 + 1]
push eax
push edi
push esi
push ebx
call fcn.00411230
add esp, 0x10
cmp eax, esi
jae 0x4604c6
xor esi, esi
cmp dword [ebp - 4], esi
je 0x4604a3
mov edx, dword [ebp - 8]
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test ebx, ebx
je 0x4604b0
push ebx
call fcn.00507b54
add esp, 4
test edi, edi
pop ebx
je 0x4604be
push edi
call fcn.00507b54
add esp, 4
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
lea edx, [esi - 1]
push edx
push edi
push eax
call fcn.0050bdb0
mov ecx, dword [ebp + 8]
mov byte [ecx + esi - 1], 0
add esp, 0xc
mov esi, 1
jmp 0x460497
Function at 0x460e20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
cmp ebx, esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
jne 0x460e44
cmp dword [ebp + 0x10], esi
jne 0x460e44
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push 0x100
call fcn.0050828d
mov edi, eax
add esp, 4
cmp edi, esi
je 0x460f12
mov eax, dword [ebp + 0x14]
cmp eax, esi
je 0x460e70
mov ecx, dword [eax]
cmp ecx, esi
je 0x460e70
mov eax, dword [eax + 4]
cmp eax, esi
jne 0x460e7a
mov eax, str.SOFTWAREMcAfeeGTI
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
lea edx, [ebp - 0xc]
push edx
push 0x20019
push esi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x460f12
mov edx, dword [ebp - 0xc]
lea eax, [ebp + 8]
push eax
push edi
lea ecx, [ebp - 0x10]
push ecx
push 0
push str.pipename
mov esi, 1
push edx
mov dword [ebp - 8], esi
mov dword [ebp + 8], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x460f12
cmp dword [ebp - 0x10], esi
jne 0x460f12
cmp byte [edi], al
je 0x460f12
mov eax, edi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x460ed0
mov ecx, dword [ebp + 8]
sub eax, edx
add eax, 1
cmp eax, ecx
jne 0x460f12
xor eax, eax
add ecx, 0xffffffff
je 0x460efc
lea esp, [esp]
test byte [eax + edi], 0x80
jne 0x460f12
add eax, esi
cmp eax, ecx
jb 0x460ef0
mov ecx, dword [ebp + 0xc]
push edi
lea eax, [ebp - 4]
push eax
push ecx
push ebx
call fcn.004604f0
add esp, 0x10
test eax, eax
jne 0x460f14
xor esi, esi
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x460f20
mov edx, dword [ebp - 4]
mov dword [eax], edx
test edi, edi
je 0x460f2d
push edi
call fcn.00507b54
add esp, 4
cmp dword [ebp - 8], 0
pop edi
je 0x460f3e
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x460f50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x460fa2
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x460f66
cmp eax, 1
jne 0x460fa2
mov edx, dword [ebp + 0xc]
xor eax, eax
cmp edx, 4
push esi
mov esi, 0xa5a5a5a5
jb 0x460f87
push edi
xor dword [eax + ecx], esi
add eax, 4
mov edi, edx
sub edi, eax
cmp edi, 4
jae 0x460f77
pop edi
cmp eax, edx
pop esi
jae 0x460f9b
lea esp, [esp]
xor byte [eax + ecx], 0xa5
add eax, 1
cmp eax, edx
jb 0x460f90
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x461800
Capabilities:
Write file on windows

Disassembly:
push esi
push edi
mov edi, ecx
test edi, edi
mov esi, eax
jne 0x46180f
pop edi
xor eax, eax
pop esi
ret
test ebx, ebx
je 0x46180a
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 4]
push 0
push eax
push ecx
call fcn.00460f50
add esp, 0xc
test eax, eax
je 0x46180a
mov eax, dword [ebx]
mov ecx, dword [ebx + 8]
lea edx, [eax + 0x68]
mov eax, dword [eax + 4]
push edx
mov edx, dword [ebx + 4]
push 0
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x461863
mov ecx, dword [ebx]
mov edx, dword [ebx + 8]
mov dword [ecx + 0x60], edx
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [eax + 0x5c], ecx
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx]
mov dword [edx + 0x64], eax
xor eax, eax
jmp 0x4618b6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x461886
cmp eax, 0x3e5
jne 0x4618b1
mov ecx, dword [ebx]
pop edi
mov dword [ecx + 0x58], 1
mov eax, 1
pop esi
ret
push esi
mov esi, dword [ebx]
push 1
mov eax, 1
call fcn.00460a90
add esp, 8
test eax, eax
jne 0x46180a
mov edx, dword [ebx]
pop edi
mov dword [edx + 8], 3
mov eax, 1
pop esi
ret
call fcn.004606a0
push esi
mov esi, dword [ebx]
push eax
call fcn.00461790
add esp, 8
test eax, eax
jne 0x46180a
mov eax, dword [ebx]
mov ecx, dword [eax + 0x78]
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
test eax, eax
je 0x46180a
mov edx, dword [ebx]
mov eax, dword [edx + 0x5c]
push eax
call fcn.00507b54
mov ecx, dword [ebx]
add esp, 4
pop edi
mov dword [ecx + 0x5c], 0
mov eax, 1
pop esi
ret

Function at 0x461e40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
xor ebx, ebx
push edi
mov edi, ecx
cmp edi, ebx
mov esi, eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
jne 0x461e5d
xor edi, edi
jmp 0x461edb
cmp esi, ebx
jne 0x461e65
xor edi, edi
jmp 0x461edb
call fcn.00460780
test eax, eax
jne 0x461e72
xor edi, edi
jmp 0x461edb
cmp dword [esi + 8], 2
mov dword [ebp - 8], 1
jne 0x461e9e
push 1
lea ebx, [ebp - 4]
mov eax, esi
mov ecx, edi
call fcn.00461c40
add esp, 4
test eax, eax
jne 0x461e98
xor edi, edi
jmp 0x461edb
cmp dword [ebp - 4], 0
jne 0x461ed6
mov edx, dword [esi + 0x3c]
lea eax, [esi + 0x44]
push eax
mov eax, dword [esi + 4]
lea ecx, [esi + 0x40]
push ecx
push 0x1000
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x461f17
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x461ef5
cmp eax, 0x3e5
jne 0x461f1b
mov dword [esi + 8], 2
mov edi, 1
test byte [ebp - 8], 1
je 0x461f33
push esi
call fcn.00460fb0
add esp, 4
test eax, eax
jne 0x461f33
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 1
push 1
mov eax, 1
call fcn.00460a90
add esp, 8
test eax, eax
je 0x461f0e
xor edi, edi
jmp 0x461edb
mov dword [esi + 8], 3
jmp 0x461ed6
xor eax, eax
jmp 0x461f20
call fcn.004606a0
push 1
push eax
call fcn.00461720
add esp, 8
test eax, eax
je 0x461ed6
xor edi, edi
jmp 0x461edb
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46a3a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 8]
cmp edi, esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
je 0x46a4d7
cmp dword [edi], 0x43415348
jne 0x46a4d7
mov eax, dword [ebp + 0xc]
push 0x577528
push eax
call fcn.0050b8d0
add esp, 8
cmp eax, esi
mov dword [ebp - 0x28], eax
je 0x46a4d7
push ebx
lea ebx, [edi + 0xc]
push ebx
call fcn.00410be0
lea ecx, [ebp - 8]
push esi
push ecx
call fcn.00453900
lea esi, [ebp - 0x18]
call fcn.00469720
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], eax
call fcn.0047aca0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [edi + 0x30]
mov dword [ebp - 0x48], eax
mov eax, dword [edi + 0x44]
mov dword [ebp - 0x50], ecx
mov ecx, dword [edi + 0x34]
mov dword [ebp - 0x4c], edx
mov edx, dword [edi + 0x40]
mov dword [ebp - 0x3c], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0x44], ecx
mov ecx, dword [edi + 0x48]
mov dword [ebp - 0x40], edx
mov edx, dword [edi + 0x4c]
push eax
mov dword [ebp - 0x58], 0x43415348
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], edx
call fcn.00462af0
mov ecx, dword [ebp - 0x28]
push ecx
push 1
lea edx, [ebp - 0x58]
push 0x30
push edx
mov dword [ebp - 0x30], eax
call fcn.00509e91
mov eax, dword [ebp - 0x10]
push eax
lea ecx, [ebp - 0x50]
push 0x28
push ecx
call fcn.00470ea0
lea edx, [ebp - 0x28]
push edx
mov dword [ebp - 0x10], eax
mov eax, dword [edi + 4]
push 0x469c70
push eax
call fcn.00462d30
mov ecx, dword [ebp - 0x10]
push ecx
mov esi, eax
call fcn.00470ee0
mov edx, dword [ebp - 0x28]
push 0
push 4
push edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x54], eax
call fcn.0050bd2a
mov eax, dword [ebp - 0x28]
add esp, 0x48
push eax
push 1
lea ecx, [ebp - 0x54]
push 4
push ecx
call fcn.00509e91
mov edx, dword [ebp - 0x28]
push edx
call fcn.00509f7f
push ebx
call fcn.00410c00
add esp, 0x18
pop ebx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x470e60
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
or eax, 0xffffffff
test ecx, ecx
je 0x470e91
push esi
mov esi, dword [ebp + 8]
movzx edx, byte [esi]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x595470]
sub ecx, 1
add esi, 1
test ecx, ecx
jne 0x470e71
pop esi
not eax
pop ebp
ret

Function at 0x470ea0
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
test ecx, ecx
mov eax, dword [ebp + 0x10]
je 0x470ed1
push esi
mov esi, dword [ebp + 8]
movzx edx, byte [esi]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x595470]
sub ecx, 1
add esi, 1
test ecx, ecx
jne 0x470eb1
pop esi
pop ebp
ret
Function at 0x4733f0
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x590f90
push 0x510cb0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x596c60]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov edi, ecx
xor esi, esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], esi
lea eax, [ebp - 0x20]
push eax
push esi
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptGenKey]
cmp eax, esi
je 0x473580
mov dword [ebp - 0x1c], 4
push esi
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x30]
push ecx
push 9
mov edx, dword [ebp - 0x20]
push edx
mov ebx, dword [sym.imp.ADVAPI32.dll_CryptGetKeyParam]
call ebx
test eax, eax
je 0x473580
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov dword [ebp - 0x20], esi
lea ecx, [edi*8]
cmp ecx, dword [ebp - 0x30]
jne 0x473580
mov dword [ebp - 0x1c], 4
push esi
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x38]
push eax
push 7
mov ecx, dword [ebp + 0xc]
push ecx
call ebx
test eax, eax
je 0x473580
mov dword [ebp - 0x1c], 4
push esi
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x34]
push eax
push 9
mov ecx, dword [ebp + 0xc]
push ecx
call ebx
test eax, eax
je 0x473580
mov ebx, dword [ebp - 0x34]
shr ebx, 3
add ebx, 0xc
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
mov dword [ebp - 0x28], esi
test esi, esi
je 0x473580
mov byte [esi], 1
mov byte [esi + 1], 2
xor eax, eax
mov word [esi + 2], ax
mov edx, dword [ebp + 0x10]
mov dword [esi + 4], edx
lea ecx, [esi + 8]
mov edx, dword [ebp - 0x38]
mov dword [ecx], edx
add ecx, 4
mov dword [ebp - 0x24], eax
cmp eax, edi
jae 0x473523
mov edx, dword [ebp + 0x14]
sub edx, eax
mov dl, byte [edx + edi - 1]
mov byte [eax + ecx], dl
add eax, 1
jmp 0x47350b
mov eax, ebx
sub eax, edi
sub eax, 0xf
mov dword [ebp - 0x1c], eax
lea edi, [ecx + edi + 1]
push edi
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x473580
xor eax, eax
mov dword [ebp - 0x24], eax
cmp eax, dword [ebp - 0x1c]
jae 0x47355a
cmp byte [eax + edi], 0
jne 0x473555
mov byte [eax + edi], 1
add eax, 1
jmp 0x473543
mov byte [ebx + esi - 2], 2
mov ecx, dword [ebp + 0x18]
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
push ebx
push esi
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x473580
mov dword [ebp - 0x2c], 1
mov dword [ebp - 4], 0xfffffffe
call fcn.004735ad
xor eax, eax
cmp dword [ebp - 0x2c], eax
setne al
lea eax, [eax + eax - 1]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x473b60
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
mov dword [ebp - 4], 0xffffffff
je 0x473c08
cmp word [ebx + 0x18], 0
je 0x473c08
cmp word [ebx + 0x14], 0
je 0x473c08
cmp word [ebx + 0x16], 0
je 0x473c08
cmp dword [ebp + 0xc], 0
je 0x473c08
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x473c07
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x473c07
cmp dword [ebp + 0x18], 0
je 0x473c07
push esi
lea ecx, [edi + 1]
push ecx
push eax
call fcn.00443ce0
mov esi, eax
add esp, 8
test esi, esi
je 0x473c06
mov edx, dword [ebp + 0xc]
push edi
push edx
push esi
mov dword [ebp + 8], edi
call fcn.0050bdb0
mov ecx, dword [ebx + 0xc]
add esp, 0xc
lea eax, [ebp + 8]
push eax
push esi
push 0
push 1
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x473bf3
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x473c06
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x18]
mov dword [edx], eax
mov dword [ebp - 4], 1
mov byte [eax + esi], 0
pop esi
pop edi
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4774c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5403aa
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x596c60]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
push 0
call fcn.005290d9
mov dword [esp + 0x20], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [esp + 0x20], 6
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x477569
lea eax, [esp + 0x28]
mov dword [esp + 0x28], str.bad_locale_name
push eax
lea ecx, [esp + 0x10]
call fcn.00507343
push 0x592a54
lea eax, [esp + 0x10]
mov dword [esp + 0x10], vtable.std::runtime_error.0
push eax
call fcn.0053eadf
push eax
push esi
call fcn.00528ddb
add esp, 8
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x1c
ret 4
Function at 0x482320
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x596c60]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push esi
push edi
mov edi, dword [ebp + 8]
cmp word [edi], 0x5c
jne 0x4823ec
cmp word [edi + 2], 0x5c
jne 0x4823ec
lea eax, [edi + 4]
push 0x5c
push eax
call fcn.0050811b
add esp, 8
test eax, eax
je 0x482491
add eax, 2
push 0x5c
push eax
call fcn.0050811b
mov esi, eax
add esp, 8
test esi, esi
je 0x482491
lea ecx, [esi + 2]
mov dword [esp + 0x20], 7
sub ecx, edi
mov dword [esp + 0x1c], 0
sar ecx, 1
xor eax, eax
push ecx
push edi
lea ecx, [esp + 0x14]
mov word [esp + 0x14], ax
call fcn.0047c4b0
cmp dword [esp + 0x20], 8
mov eax, dword [esp + 0xc]
jae 0x4823bb
lea eax, [esp + 0xc]
push eax
call ebx
test eax, eax
sete bl
cmp dword [esp + 0x20], 8
jb 0x4823db
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4823db
push eax
call fcn.00507b54
add esp, 4
test bl, bl
jne 0x482491
mov ebx, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea edi, [esi + 2]
cmp word [edi], 0
je 0x48247b
push 0x5c
push edi
call fcn.0050811b
mov esi, eax
add esp, 8
test esi, esi
je 0x482491
xor eax, eax
mov dword [esp + 0x20], 7
mov word [esp + 0xc], ax
lea ecx, [esp + 0xc]
lea eax, [esi + 2]
mov dword [esp + 0x1c], 0
sub eax, edi
sar eax, 1
push eax
push edi
call fcn.0047c4b0
cmp dword [esp + 0x20], 8
mov eax, dword [esp + 0xc]
jae 0x482443
lea eax, [esp + 0xc]
push eax
call ebx
test eax, eax
sete bl
cmp dword [esp + 0x20], 8
jb 0x482463
mov eax, dword [esp + 0xc]
test eax, eax
je 0x482463
push eax
call fcn.00507b54
add esp, 4
test bl, bl
jne 0x482491
cmp word [esi + 2], 0
lea edi, [esi + 2]
mov ebx, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
jne 0x4823f6
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.005072fd
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esp + 0x24]
xor al, al
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005072fd
mov esp, ebp
pop ebp
ret 4

Function at 0x483e90
Capabilities:
Get file attributes

Disassembly:
sub esp, 8
push esi
push 0x104
push ecx
lea ecx, [esp + 0xc]
call fcn.00483c80
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
mov eax, dword [esp + 8]
test eax, eax
je 0x483ebe
push eax
call fcn.00507b54
add esp, 4
mov eax, esi
pop esi
add esp, 8
ret

Function at 0x483ed0
Capabilities:
Move file

Disassembly:
sub esp, 0x10
push esi
push edi
push 0x104
mov esi, ecx
lea ecx, [esp + 0x14]
push edx
call fcn.00483c80
push 0x104
push esi
lea ecx, [esp + 0x10]
mov edi, dword [eax]
call fcn.00483c80
push dword [esp + 0x1c]
push edi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov esi, eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x483f17
push eax
call fcn.00507b54
add esp, 4
mov eax, dword [esp + 0x14]
test eax, eax
je 0x483f28
push eax
call fcn.00507b54
add esp, 4
pop edi
mov eax, esi
pop esi
add esp, 0x10
ret
Function at 0x485990
Capabilities:
Access peb ldr_data
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5416d8
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x596c60]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebx
push esi
mov eax, dword [0x596c60]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], 0
mov word [esp + 0x30], ax
mov dword [esp + 0x58], eax
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov ax, word [esp + 0xc]
lea ecx, [esp + 0x30]
cmp ax, 9
jne 0x485a0b
push 3
push 0x56c4b4
call fcn.0047c4b0
jmp 0x485a35
test ax, ax
jne 0x485a1e
push 3
push 0x56c4bc
call fcn.0047c4b0
jmp 0x485a35
cmp ax, 6
jne 0x485a2b
push str.ia64
jmp 0x485a30
push str.Unknown_architecture
call fcn.0047c5b0
add esi, 4
mov ecx, esi
push 3
push 0x56c4b4
push dword [ecx + 0x10]
push ecx
call fcn.00485920
test eax, eax
jne 0x485a84
push 3
push 0x56c4bc
push dword [esp + 0x48]
push ecx
lea ecx, [esp + 0x40]
call fcn.00485920
test eax, eax
je 0x485aff
push 4
push str.ia64
push dword [esp + 0x48]
push ecx
lea ecx, [esp + 0x40]
call fcn.00485920
test eax, eax
je 0x485aff
push 3
push 0x56c4bc
push dword [esi + 0x10]
push ecx
mov ecx, esi
call fcn.00485920
test eax, eax
jne 0x485ac5
push 3
push 0x56c4b4
push dword [esp + 0x48]
push ecx
lea ecx, [esp + 0x40]
call fcn.00485920
test eax, eax
je 0x485aff
mov edx, str.ia64
lea ecx, [esp + 0x30]
call fcn.00485880
test al, al
jne 0x485aff
push 4
push str.ia64
push dword [esi + 0x10]
push ecx
mov ecx, esi
call fcn.00485920
test eax, eax
jne 0x485b03
mov edx, 0x56c4b4
lea ecx, [esp + 0x30]
call fcn.00485880
test al, al
jne 0x485aff
mov edx, 0x56c4bc
lea ecx, [esp + 0x30]
call fcn.00485880
test al, al
je 0x485b03
xor bl, bl
jmp 0x485b05
mov bl, 1
cmp dword [esp + 0x44], 8
jb 0x485b1d
mov eax, dword [esp + 0x30]
test eax, eax
je 0x485b1d
push eax
call fcn.00507b54
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.005072fd
mov esp, ebp
pop ebp
ret

Function at 0x485b40
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x54170b
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x596c60]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], 0x56b67c
xor eax, eax
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], 0
mov word [esi + 4], ax
mov dword [esp + 0x18], eax
call fcn.00493c80
call fcn.00493f60
call fcn.004945a0
mov ecx, esi
call fcn.00493c10
mov dword [esi], 0x571f4c
xor eax, eax
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x48], 7
mov dword [esi + 0x44], 0
mov word [esi + 0x34], ax
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret
Function at 0x488e30
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x20c
mov eax, dword [0x596c60]
xor eax, esp
mov dword [esp + 0x208], eax
mov eax, dword [esp + 0x210]
push esi
mov esi, dword [esp + 0x218]
cmp dword [eax + 0x14], 8
jb 0x488e5b
mov eax, dword [eax]
push eax
push 0x104
lea eax, [esp + 0xc]
push eax
push 0
push str.CatalogFile
push str.Version
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x488eea
cmp word [esp + 4], 0
jne 0x488ead
xor ecx, ecx
lea eax, [esp + 4]
push ecx
push eax
mov ecx, esi
call fcn.0047c4b0
xor eax, eax
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.005072fd
add esp, 0x20c
ret 8
lea ecx, [esp + 4]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x488eb4
sub ecx, edx
lea eax, [esp + 4]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.0047c4b0
xor eax, eax
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.005072fd
add esp, 0x20c
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x20c]
pop esi
xor ecx, esp
call fcn.005072fd
add esp, 0x20c
ret 8