joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44d6ac
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x44d7e0
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x44d7ca
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
je 0x44d709
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 8]
jne 0x44d7ca
cmp dword [ebp - 0x10], 0
jne 0x44d71e
mov eax, dword [ebp - 8]
call fcn.00403ab8
mov bl, 1
jmp 0x44d7ca
cmp dword [ebp - 0x10], 0x70000000
jb 0x44d72c
call fcn.0040c3e8
mov esi, dword [ebp - 0x10]
shr esi, 0
lea eax, [ebp - 0x14]
mov ecx, esi
xor edx, edx
call fcn.00403ba0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
call fcn.00403f08
push eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExA_1
cmp eax, 0xea
je 0x44d6d2
test eax, eax
jne 0x44d7ca
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
je 0x44d77a
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 8]
jne 0x44d7ca
mov esi, dword [ebp - 0x10]
shr esi, 0
jmp 0x44d783
dec esi
test esi, esi
je 0x44d791
mov eax, dword [ebp - 0x14]
cmp byte [eax + esi - 1], 0
je 0x44d782
cmp dword [ebp - 0xc], 7
jne 0x44d79c
test esi, esi
je 0x44d79c
inc esi
lea eax, [ebp - 0x14]
mov edx, esi
call fcn.0040406c
cmp dword [ebp - 0xc], 7
jne 0x44d7bd
test esi, esi
je 0x44d7bd
lea eax, [ebp - 0x14]
call fcn.00403f08
mov byte [eax + esi - 1], 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
call fcn.00403b0c
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44d7e7
lea eax, [ebp - 0x14]
call fcn.00403ab8
ret

Function at 0x44d80c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov esi, edx
mov edi, eax
push 0
push 0
push 0
push 0
push esi
push edi
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
sete bl
test bl, bl
je 0x44d882
test esi, esi
je 0x44d837
cmp byte [esi], 0
jne 0x44d882
mov eax, dword [0x4bec00]
cmp dword [eax], 2
je 0x44d882
xor ebx, ebx
xor esi, esi
mov dword [esp + 4], 2
push 0
push 0
push 0
push 0
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
push esi
push edi
call sub.advapi32.dll_RegEnumValueA
test eax, eax
je 0x44d871
cmp eax, 0xea
jne 0x44d882
test eax, eax
jne 0x44d87f
cmp byte [esp], 0
jne 0x44d87f
mov bl, 1
jmp 0x44d882
inc esi
jmp 0x44d845
mov eax, ebx
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x44d8ec
Capabilities:
Delete registry key

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, edx
cmp al, 2
je 0x44d900
push esi
push ebx
call sub.advapi32.dll_RegDeleteKeyA
pop esi
pop ebx
ret
cmp dword [0x4bf818], 0
jne 0x44d923
push 0x44d948
push 0x44d958
call sub.kernel32.dll_GetModuleHandleA_2
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4bf818], eax
cmp dword [0x4bf818], 0
je 0x44d93d
push 0
push pe_nt_image_headers32
push esi
push ebx
call dword [0x4bf818]
jmp 0x44d942
mov eax, 0x7f
pop esi
pop ebx
ret

Function at 0x44d968
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x44daaa
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
je 0x44d999
mov eax, dword [ebp - 0xc]
cmp byte [eax], 0
jne 0x44d9a3
mov ebx, 0x57
jmp 0x44da94
mov eax, dword [0x4bec00]
cmp dword [eax], 2
jne 0x44da84
push 0
push 8
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov al, byte [ebp - 1]
call fcn.0044d8c4
test eax, eax
jne 0x44da84
xor edx, edx
push ebp
push 0x44da7d
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x14]
mov ecx, pe_nt_image_headers32
xor edx, edx
call fcn.00403ba0
xor ebx, ebx
mov eax, dword [ebp - 0x14]
call fcn.00403d38
mov dword [ebp - 0x18], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
call fcn.00403f08
push eax
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegEnumKeyExA
cmp eax, 0xea
jne 0x44da46
mov eax, dword [ebp - 0x14]
call fcn.00403d38
cmp eax, 0x10000
jge 0x44da66
mov eax, dword [ebp - 0x14]
call fcn.00403d38
mov ecx, eax
add ecx, ecx
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.00403ba0
jmp 0x44d9ee
test eax, eax
jne 0x44da66
mov eax, dword [ebp - 0x14]
call fcn.00403efc
mov ecx, eax
mov edx, dword [ebp - 0x10]
mov al, byte [ebp - 1]
call fcn.0044d968
test eax, eax
je 0x44d9ee
inc ebx
jmp 0x44d9ee
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44da84
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov al, byte [ebp - 1]
call fcn.0044d8ec
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44dab1
lea eax, [ebp - 0x14]
call fcn.00403ab8
ret
Function at 0x44dab8
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebp, ecx
mov edi, edx
mov ebx, eax
push 0
push 1
lea eax, [esp + 8]
push eax
mov ecx, ebp
mov edx, edi
mov eax, ebx
call fcn.0044d8c4
mov esi, eax
test esi, esi
jne 0x44db36
push 0
push 0
push 0
push 0
lea eax, [esp + 0x18]
push eax
push 0
push 0
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
mov eax, dword [esp + 0x2c]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
mov esi, eax
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
test esi, esi
jne 0x44db36
cmp dword [esp + 4], 0
jne 0x44db31
cmp dword [esp + 8], 0
jne 0x44db31
mov ecx, ebp
mov edx, edi
mov eax, ebx
call fcn.0044d8ec
mov esi, eax
jmp 0x44db36
mov esi, 0x91
mov eax, esi
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x44db40
Capabilities:
Check os version
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
mov ebx, eax
mov eax, dword [0x4bec00]
cmp dword [eax], 2
je 0x44db5d
mov byte [ebp - 1], 1
jmp 0x44dd2d
mov byte [ebp - 1], 0
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push 0x20
push 2
push 0x4bdb18
call sub.advapi32.dll_AllocateAndInitializeSid
test eax, eax
je 0x44dd2d
xor eax, eax
push ebp
push 0x44dd26
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetVersion
and eax, 0xff
cmp ax, 5
jb 0x44dbbf
push 0x44dd38
push 0x44dd50
call sub.kernel32.dll_GetModuleHandleA_2
push eax
call sub.kernel32.dll_GetProcAddress_1
mov ebx, eax
test ebx, ebx
je 0x44dbe8
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
call ebx
test eax, eax
je 0x44dd0f
mov eax, dword [ebp - 0xc]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 1], al
jmp 0x44dd0f
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
test eax, eax
jne 0x44dc39
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x3f0
je 0x44dc1a
call fcn.00403628
jmp 0x44dd2d
lea eax, [ebp - 0x10]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x44dc39
call fcn.00403628
jmp 0x44dd2d
xor eax, eax
push ebp
push 0x44dd08
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x44dc7c
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x7a
je 0x44dc7c
call fcn.00403628
call fcn.00403628
jmp 0x44dd2d
mov eax, dword [ebp - 0x14]
call fcn.0040271c
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x44dcae
call fcn.00403628
call fcn.00403628
jmp 0x44dd2d
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
dec esi
test esi, esi
jl 0x44dce9
inc esi
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x44dce5
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 8]
and eax, 0x14
cmp eax, 4
jne 0x44dce5
mov byte [ebp - 1], 1
jmp 0x44dce9
inc ebx
dec esi
jne 0x44dcbb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44dd0f
mov eax, dword [ebp - 0x18]
call fcn.00402734
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44dd2d
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_FreeSid
ret
mov al, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44e5b8
Capabilities:
Check if file exists
Move file

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x44e655
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4bec00]
cmp dword [eax], 2
jne 0x44e5fb
push 1
mov eax, esi
call fcn.00403efc
push eax
mov eax, edi
call fcn.00403efc
push eax
call sub.kernel32.dll_MoveFileExA
neg eax
sbb ebx, ebx
neg ebx
jmp 0x44e63f
mov eax, esi
call fcn.00403efc
mov edx, eax
lea eax, [ebp - 4]
call fcn.00403c70
mov eax, dword [ebp - 4]
call fcn.00409e00
mov ebx, eax
test bl, bl
jne 0x44e624
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
jne 0x44e63f
mov eax, esi
call fcn.00403efc
push eax
mov eax, edi
call fcn.00403efc
push eax
call sub.kernel32.dll_MoveFileA
neg eax
sbb ebx, ebx
neg ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44e65c
lea eax, [ebp - 4]
call fcn.00403ab8
ret

Function at 0x450f98
Capabilities:
Hash data using sha1

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
xor edx, edx
mov dword [eax + 0x14], edx
xor edx, edx
mov dword [eax + 0x18], edx
ret
Function at 0x456bec
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
lea edi, [ebp - 0xd]
mov bl, 1
mov eax, dword [ebp + 8]
mov esi, dword [eax - 0x18]
dec esi
test esi, esi
jl 0x456d9a
inc esi
mov eax, dword [ebp + 8]
push eax
mov eax, edi
mov edx, 5
call fcn.00455a18
pop ecx
test al, al
jne 0x456c33
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 0xd
call fcn.00456ecc
xor ebx, ebx
jmp 0x456d9a
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x20]
cmp eax, dword [edi]
ja 0x456c51
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 2
call fcn.00456ecc
xor ebx, ebx
jmp 0x456d9a
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x34]
mov eax, dword [eax + 4]
mov edx, dword [edi]
mov edx, dword [eax + edx*4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x3c]
call fcn.0046888c
test eax, eax
jne 0x456c88
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 2
call fcn.00456ecc
xor ebx, ebx
jmp 0x456d9a
test byte [edi + 4], 1
je 0x456d93
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 4]
mov edx, 4
call fcn.00455a18
pop ecx
test al, al
jne 0x456cbc
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 0xd
call fcn.00456ecc
xor ebx, ebx
jmp 0x456d9a
mov edx, dword [0x453950]
mov eax, 0xc
call fcn.00404748
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x456d65
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.0040406c
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 8]
call fcn.00403f08
mov edx, dword [ebp - 4]
call fcn.00455a18
pop ecx
test al, al
jne 0x456d28
mov edx, dword [0x453950]
mov eax, dword [ebp - 8]
call fcn.0040475c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 0xd
call fcn.00456ecc
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x456d9a
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00451850
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x3c]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 8]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x30]
mov edx, dword [ebp - 8]
call fcn.00451af0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x456d93
dec esi
jne 0x456c0a
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46cff8
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push ebx
xor ebx, ebx
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x46d044
cmp dword [ebp - 0x84], 2
jne 0x46d044
cmp dword [ebp - 0x90], 5
ja 0x46d042
cmp dword [ebp - 0x90], 5
jne 0x46d044
cmp dword [ebp - 0x8c], 1
jb 0x46d044
mov bl, 1
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x471178
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov byte [0x4bf9b4], 0
mov eax, dword [0x4bec00]
cmp dword [eax], 2
jne 0x4711ac
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x4711ac
cmp dword [esp + 4], 5
setae byte [0x4bf9b4]
add esp, 0x94
ret

Function at 0x472b24
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x4bfaa0
mov eax, esi
mov edx, 8
test al, 1
je 0x472b40
shr eax, 1
xor eax, 0xedb88320
jmp 0x472b42
shr eax, 1
dec edx
jne 0x472b33
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x472b2c
pop esi
ret

Function at 0x472b58
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x4bfa9c], 0
jne 0x472b7b
call fcn.00472b24
push 1
push 0x4bfa9c
call sub.kernel32.dll_InterlockedExchange
mov eax, edi
test esi, esi
je 0x472ba7
mov edx, ebx
and edx, 0xff
xor ecx, ecx
mov cl, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x4bfaa0]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x472b81
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x4735e8
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
ret
Function at 0x4742fc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
mov byte [ebp - 5], 0
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.00403efc
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jle 0x47439e
mov eax, ebx
call fcn.0040271c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x474397
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
push edi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x474381
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x4743c0
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x474381
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4743b5
mov eax, dword [ebp - 0x10]
call fcn.00402734
ret
mov eax, dword [0x4bec00]
cmp dword [eax], 1
je 0x4743b5
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00474120
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4745dc
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00474590
test al, al
jne 0x4745fd
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x47464b
xor eax, eax
push ebp
push 0x47463b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, esi
call fcn.00403efc
push eax
call sub.kernel32.dll_CreateDirectoryA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474642
lea eax, [ebp - 0xc]
call fcn.004745cc
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x474654
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00474590
test al, al
jne 0x474678
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4746de
xor eax, eax
push ebp
push 0x4746ce
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x1c]
push eax
mov eax, dword [ebp + 0x20]
push eax
mov eax, dword [ebp + 0x24]
push eax
push edi
push esi
call sub.kernel32.dll_CreateProcessA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4746d5
lea eax, [ebp - 0xc]
call fcn.004745cc
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
Function at 0x4746ec
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00474590
test al, al
jne 0x474710
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x474768
xor eax, eax
push ebp
push 0x474758
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov eax, edi
call fcn.00403efc
push eax
mov eax, esi
call fcn.00403efc
push eax
call sub.kernel32.dll_CopyFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47475f
lea eax, [ebp - 0xc]
call fcn.004745cc
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x474774
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00474590
test al, al
jne 0x474795
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4747e1
xor eax, eax
push ebp
push 0x4747d1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403efc
push eax
call sub.kernel32.dll_DeleteFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4747d8
lea eax, [ebp - 0xc]
call fcn.004745cc
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x47494c
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00474590
test al, al
jne 0x47496f
mov dword [ebp - 4], 0xffffffff
jmp 0x4749bb
xor eax, eax
push ebp
push 0x4749ab
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403efc
push eax
call sub.kernel32.dll_GetFileAttributesA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4749b2
lea eax, [ebp - 0xc]
call fcn.004745cc
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x474aec
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00474590
test al, al
jne 0x474b10
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x474b64
xor eax, eax
push ebp
push 0x474b54
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00403efc
push eax
mov eax, esi
call fcn.00403efc
push eax
call sub.kernel32.dll_MoveFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474b5b
lea eax, [ebp - 0xc]
call fcn.004745cc
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x474b70
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 8]
test edi, edi
jne 0x474b93
test esi, 4
je 0x474b93
xor edi, edi
jmp 0x474b9c
mov eax, edi
call fcn.00403efc
mov edi, eax
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.00474590
test al, al
jne 0x474bb1
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x474c00
xor eax, eax
push ebp
push 0x474bf0
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
push edi
mov eax, dword [ebp - 4]
call fcn.00403efc
push eax
call sub.kernel32.dll_MoveFileExA
mov dword [ebp - 8], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x14], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474bf7
lea eax, [ebp - 0x10]
call fcn.004745cc
ret
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x474c7c
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00474590
test al, al
jne 0x474c9d
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x474ce9
xor eax, eax
push ebp
push 0x474cd9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403efc
push eax
call sub.kernel32.dll_RemoveDirectoryA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474ce0
lea eax, [ebp - 0xc]
call fcn.004745cc
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x474cf4
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00474590
test al, al
jne 0x474d18
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x474d65
xor eax, eax
push ebp
push 0x474d55
push dword fs:[eax]
mov dword fs:[eax], esp
push edi
mov eax, esi
call fcn.00403efc
push eax
call sub.kernel32.dll_SetFileAttributesA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474d5c
lea eax, [ebp - 0xc]
call fcn.004745cc
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret