joyce8/EMBER2024-capa huggingface dataset:
Function at 0x452964
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00452900
xor edx, edx
push ebp
push 0x452a33
push dword fs:[edx]
mov dword fs:[edx], esp
push ebx
push 2
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x452a05
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
xor edx, edx
push ebp
push 0x4529f4
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, eax
mov eax, edi
mov ecx, ebx
call fcn.00402748
mov eax, dword [ebp - 4]
call fcn.004528b0
mov eax, dword [ebp - 8]
push eax
movzx eax, si
push eax
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4529fb
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret

Function at 0x452a44
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov eax, esi
call fcn.00452900
push 1
call sub.user32.dll_GetClipboardData
mov ebx, eax
test ebx, ebx
jne 0x452a6a
xor edi, edi
jmp 0x452a8a
push ebx
call sub.kernel32.dll_GlobalLock
mov edx, eax
mov ecx, dword [ebp - 4]
dec ecx
mov eax, edi
call fcn.004064b0
call fcn.004063f4
mov edi, eax
push ebx
call sub.kernel32.dll_GlobalUnlock
mov eax, esi
call fcn.004528d0
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x452aec
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00452900
xor edx, edx
push ebp
push 0x452b8d
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
call sub.user32.dll_EnumClipboardFormats
mov ebx, eax
test bx, bx
je 0x452b61
mov edx, ebx
mov eax, 0x41a820
call fcn.0041d9b8
test al, al
je 0x452b51
movzx eax, bx
push eax
call sub.user32.dll_GetClipboardData
mov esi, eax
push 9
call sub.user32.dll_GetClipboardData
push eax
mov ecx, esi
mov edx, ebx
mov eax, edi
call fcn.0041d8f4
call fcn.004031dc
jmp 0x452b94
movzx eax, bx
push eax
call sub.user32.dll_EnumClipboardFormats
mov ebx, eax
test bx, bx
jne 0x452b1c
mov ecx, 0xf0b0
mov dl, 1
mov eax, 0x405674
call fcn.00407d38
call fcn.0040313c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452b94
mov eax, dword [ebp - 4]
call fcn.004528d0
ret
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x452b9c
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00452900
xor edx, edx
push ebp
push 0x452bf1
push dword fs:[edx]
mov dword fs:[edx], esp
push 2
call sub.user32.dll_GetClipboardData
mov ebx, eax
push 9
call sub.user32.dll_GetClipboardData
push eax
mov ecx, ebx
mov dx, 2
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452bf8
mov eax, dword [ebp - 4]
call fcn.004528d0
ret
Function at 0x452c00
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00452900
xor edx, edx
push ebp
push 0x452c55
push dword fs:[edx]
mov dword fs:[edx], esp
push 3
call sub.user32.dll_GetClipboardData
mov ebx, eax
push 9
call sub.user32.dll_GetClipboardData
push eax
mov ecx, ebx
mov dx, 3
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452c5c
mov eax, dword [ebp - 4]
call fcn.004528d0
ret

Function at 0x452ccc
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00452900
xor eax, eax
push ebp
push 0x452d41
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004528b0
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
call fcn.0041d998
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.user32.dll_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x452d2b
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452d48
mov eax, dword [ebp - 4]
call fcn.004528d0
ret

Function at 0x452d50
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00452900
xor eax, eax
push ebp
push 0x452dc5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004528b0
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x48]
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.user32.dll_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x452daf
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452dcc
mov eax, dword [ebp - 4]
call fcn.004528d0
ret
Function at 0x45578c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x4558c6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00455644
mov edi, eax
mov ebx, dword [esi + 0x3ac]
add ebx, edi
dec ebx
mov eax, dword [0x479890]
mov eax, dword [eax + 0x30]
mov edx, ebx
call fcn.00475390
mov eax, dword [eax + 4]
mov edx, dword [0x47989c]
mov dword [edx + 4], eax
mov eax, dword [0x479890]
mov eax, dword [eax + 0x30]
mov edx, ebx
call fcn.00475390
mov ax, word [eax + 8]
mov edx, dword [0x47989c]
mov word [edx + 8], ax
mov eax, dword [0x479890]
mov eax, dword [eax + 0x30]
mov edx, ebx
call fcn.00475390
mov ax, word [eax + 0xa]
mov edx, dword [0x47989c]
mov word [edx + 0xa], ax
lea edx, [ebp - 4]
mov eax, edi
add eax, eax
mov eax, dword [esi + eax*8 + 0x2d8]
call fcn.00414c8c
mov edx, dword [ebp - 4]
mov eax, dword [0x47989c]
add eax, 0xc
call fcn.004034d8
mov eax, dword [0x479890]
mov eax, dword [eax + 0x30]
mov edx, ebx
call fcn.00475390
mov eax, dword [eax + 0x10]
mov edx, dword [0x47989c]
mov dword [edx + 0x10], eax
mov eax, dword [0x479890]
mov eax, dword [eax + 0x30]
mov edx, ebx
call fcn.00475390
mov edx, dword [eax + 0x14]
mov eax, dword [0x47989c]
add eax, 0x14
call fcn.004034d8
mov eax, dword [0x479844]
call fcn.00425008
dec eax
jne 0x4558b0
mov eax, dword [0x479890]
mov eax, dword [eax + 0x30]
mov edx, ebx
call fcn.00475390
mov edx, dword [0x47989c]
mov edx, dword [edx + 0x10]
mov dword [eax + 0x10], edx
mov eax, dword [0x479890]
mov eax, dword [eax + 0x30]
mov edx, ebx
call fcn.00475390
add eax, 0x14
mov edx, dword [0x47989c]
mov edx, dword [edx + 0x14]
call fcn.004034d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4558cd
lea eax, [ebp - 4]
call fcn.00403488
ret
Function at 0x45d024
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov edi, eax
xor eax, eax
push ebp
push 0x45d23a
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, 0x409698
call fcn.00402b50
mov esi, eax
lea ecx, [ebp - 8]
mov edx, 8
mov eax, dword [edi + 0xc]
call fcn.00405f80
mov byte [ebp - 1], 0
mov ebx, 1
mov eax, dword [ebp - 8]
cmp byte [eax + ebx - 1], 0x30
je 0x45d078
mov byte [ebp - 1], 1
jmp 0x45d08a
lea eax, [ebp - 8]
mov ecx, 1
mov edx, 1
call fcn.00403840
cmp byte [ebp - 1], 0
je 0x45d068
mov edx, 0x45d254
lea eax, [ebp - 0x10]
call fcn.0040351c
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00403604
lea eax, [ebp - 0x10]
mov edx, 0x45d260
call fcn.00403604
mov edx, dword [ebp - 0x10]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, 0x45d26c
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, dword [edi + 0x20]
mov eax, dword [0x479894]
call fcn.00474394
test eax, eax
je 0x45d10d
mov edx, 0x45d280
lea eax, [ebp - 0x10]
call fcn.0040351c
mov edx, dword [edi + 0x20]
mov eax, dword [0x479894]
call fcn.00474394
mov edx, dword [eax + 0xc]
lea eax, [ebp - 0x10]
call fcn.00403604
mov edx, dword [ebp - 0x10]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x2c]
jmp 0x45d119
mov edx, 0x45d290
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, 0x45d2a8
lea eax, [ebp - 0x10]
call fcn.0040351c
lea eax, [ebp - 0x10]
mov edx, dword [edi + 0x28]
call fcn.00403604
mov edx, dword [ebp - 0x10]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, 0x45d2b8
lea eax, [ebp - 0x10]
call fcn.0040351c
lea edx, [ebp - 0x14]
movzx eax, word [edi + 0x1c]
call fcn.00405f50
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
call fcn.00403604
mov edx, dword [ebp - 0x10]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x2c]
movzx eax, word [edi + 0x1c]
test eax, eax
jle 0x45d1b8
mov dword [ebp - 0xc], eax
mov ebx, 1
lea edx, [ebp - 0x10]
mov eax, ebx
dec eax
call fcn.00405f50
lea eax, [ebp - 0x10]
mov edx, 0x45d2cc
call fcn.00403604
lea eax, [ebp - 0x10]
push eax
mov edx, ebx
mov eax, dword [edi + 0x30]
call fcn.00475390
mov edx, dword [eax + 0xc]
pop eax
call fcn.00403604
mov edx, dword [ebp - 0x10]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x2c]
inc ebx
dec dword [ebp - 0xc]
jne 0x45d179
mov edx, 0x45d2d8
lea eax, [ebp - 0x10]
call fcn.0040351c
lea eax, [ebp - 0x10]
mov edx, dword [edi + 0x30]
mov edx, dword [edx + 8]
mov edx, dword [edx + 0xc]
call fcn.00403604
mov edx, dword [ebp - 0x10]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, 0x45d2e8
lea eax, [ebp - 0x10]
call fcn.0040351c
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 8]
call fcn.00474b30
lea edx, [ebp - 0x14]
call fcn.00405f50
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
call fcn.00403604
mov edx, dword [ebp - 0x10]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov ebx, esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45d241
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004034a8
lea eax, [ebp - 8]
call fcn.00403488
ret
Function at 0x45d8cc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004037c0
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x45d8e8
test al, 0x10
jne 0x45d8ed
xor eax, eax
pop ebx
pop ebp
ret
mov al, 1
pop ebx
pop ebp
ret

Function at 0x45e758
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffecc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x134], edx
mov esi, eax
xor eax, eax
push ebp
push 0x45e8e5
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
push ebp
push 0x45e8c5
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov eax, dword [esi + 0x2c]
push eax
call sub.user32.dll_IsWindow
test eax, eax
je 0x45e79f
mov eax, dword [esi + 0x2c]
mov dword [ebp - 0x28], eax
jmp 0x45e7ce
mov ebx, dword [esi + 4]
mov eax, ebx
mov edx, 0x412fc0
call fcn.00402bc0
test al, al
je 0x45e7be
mov eax, ebx
call fcn.00418318
mov dword [ebp - 0x28], eax
jmp 0x45e7ce
mov eax, dword [0x47962c]
mov eax, dword [eax + 0x28]
call fcn.00418318
mov dword [ebp - 0x28], eax
mov al, byte [esi + 0x42]
cmp al, 1
jne 0x45e7dc
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x45e7f9
lea edx, [ebp - 0x24]
push edx
and eax, 0x7f
mov eax, dword [eax*4 + 0x478b00]
push eax
mov eax, dword [0x47962c]
mov eax, dword [eax + 0x20]
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
mov eax, dword [esi + 0x30]
call fcn.004037c0
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0x28]
call fcn.004037c0
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov edx, eax
mov ecx, edx
cmp cl, 7
ja 0x45e826
and ecx, 0x7f
bt dword [esi + 0x40], ecx
jae 0x45e835
and edx, 0x7f
mov edx, dword [edx*4 + 0x478ae8]
or dword [ebp - 0x18], edx
inc eax
cmp eax, 6
jne 0x45e816
mov eax, 0x45e444
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], esi
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x28]
push eax
call sub.shell32.dll_SHBrowseForFolder
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
setne byte [ebp - 1]
cmp byte [ebp - 1], 0
je 0x45e8a5
lea eax, [ebp - 0x12d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDList
lea edx, [ebp - 0x134]
lea eax, [ebp - 0x12d]
call fcn.00406610
mov edx, dword [ebp - 0x134]
lea eax, [esi + 0x38]
call fcn.004034d8
lea eax, [esi + 0x3c]
mov edx, dword [esi + 0x38]
call fcn.004034d8
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x34], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45e8cc
mov eax, dword [ebp - 8]
push eax
call sub.ole32.dll_CoTaskMemFree
mov eax, dword [ebp - 0x24]
push eax
call sub.ole32.dll_CoTaskMemFree
ret
Function at 0x45f714
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004037b0
xor eax, eax
push ebp
push 0x45f859
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, 0x45f870
call fcn.0040370c
je 0x45f7b5
mov eax, dword [ebp - 4]
mov edx, 0x45f880
call fcn.0040370c
je 0x45f7b5
mov eax, dword [ebp - 4]
mov edx, 0x45f894
call fcn.0040370c
je 0x45f7b5
mov eax, dword [ebp - 4]
mov edx, 0x45f8a4
call fcn.0040370c
je 0x45f7b5
mov eax, dword [ebp - 4]
mov edx, 0x45f8b4
call fcn.0040370c
je 0x45f7b5
mov eax, dword [ebp - 4]
mov edx, 0x45f8c4
call fcn.0040370c
je 0x45f7b5
mov eax, dword [ebp - 4]
mov edx, 0x45f8d4
call fcn.0040370c
je 0x45f7b5
mov eax, dword [ebp - 4]
mov edx, 0x45f8e4
call fcn.0040370c
jne 0x45f7cd
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00405d08
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.0040351c
jmp 0x45f834
mov eax, dword [ebp - 4]
mov edx, 0x45f8f8
call fcn.0040370c
jne 0x45f7eb
lea eax, [ebp - 4]
mov edx, 0x45f90c
call fcn.0040351c
jmp 0x45f834
mov eax, dword [ebp - 4]
mov edx, 0x45f91c
call fcn.0040370c
jne 0x45f809
lea eax, [ebp - 4]
mov edx, 0x45f92c
call fcn.0040351c
jmp 0x45f834
mov eax, dword [ebp - 4]
mov edx, 0x45f93c
call fcn.0040370c
jne 0x45f827
lea eax, [ebp - 4]
mov edx, 0x45f94c
call fcn.0040351c
jmp 0x45f834
lea eax, [ebp - 4]
mov edx, 0x45f94c
call fcn.0040351c
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040351c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f860
lea eax, [ebp - 8]
mov edx, 2
call fcn.004034a8
ret
Function at 0x41c07f
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10067cfb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
push ebx
push esi
push edi
lea edi, [ebp - 0x5c]
mov ecx, 0x14
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
push 0x34
call fcn.00448edf
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0
je 0x41c0d3
mov ecx, dword [ebp - 0x18]
call fcn.004047a8
mov dword [ebp - 0x1c], eax
jmp 0x41c0da
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
mov dword [edx + 0x2c], ecx
mov esi, esp
push 0xfffffffffffffffc
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
push eax
call dword [0x100a79b4]
cmp esi, esp
call fcn.00448e9f
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x30], eax
mov esi, esp
push 0x10001b4f
push 0xfffffffffffffffc
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
push eax
call dword [0x100a79b8]
cmp esi, esp
call fcn.00448e9f
mov esi, esp
mov ecx, dword [ebp - 0x10]
push ecx
push 0x10099040
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
push eax
call dword [0x100a79bc]
cmp esi, esp
call fcn.00448e9f
mov esi, esp
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x30]
push edx
push 0x10099030
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
push ecx
call dword [0x100a79bc]
cmp esi, esp
call fcn.00448e9f
mov esi, esp
push 0x10001b4f
push 0x10099020
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
push eax
call dword [0x100a79bc]
cmp esi, esp
call fcn.00448e9f
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
push ecx
mov ecx, 0x100a34b8
call fcn.00404244
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x5c
cmp ebp, esp
call fcn.00448e9f
mov esp, ebp
pop ebp
ret
Function at 0x46280f
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009b178
push 0x1004d448
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffd0
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
cmp dword [ebp + 8], 0
jne 0x46284c
push 0
call dword [0x100a77a8]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov dx, word [ecx]
cmp edx, 0x5a4d
je 0x462884
push 0xc1
call dword [0x100a76c8]
mov dword [ebp - 0x34], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x34]
jmp 0x4629e8
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
cmp dword [edx], 0x4550
je 0x4628bc
push 0xbf
call dword [0x100a76c8]
mov dword [ebp - 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x38]
jmp 0x4629e8
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov cx, word [eax + 0x14]
test ecx, ecx
jne 0x4628ea
push 0xc0
call dword [0x100a76c8]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x3c]
jmp 0x4629e8
mov edx, dword [ebp - 0x24]
xor eax, eax
mov ax, word [edx + 0x14]
mov ecx, dword [ebp - 0x24]
lea edx, [ecx + eax + 0x18]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x28], 0
jmp 0x46290f
mov eax, dword [ebp - 0x28]
add eax, 1
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x24]
xor edx, edx
mov dx, word [ecx + 6]
cmp dword [ebp - 0x28], edx
jae 0x4629c2
push 0x100a2838
mov eax, dword [ebp - 0x28]
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x20]
add ecx, eax
push ecx
call fcn.0044e91f
add esp, 8
test eax, eax
jne 0x4629bd
mov edx, dword [ebp - 0x28]
imul edx, edx, 0x28
mov eax, dword [ebp - 0x20]
cmp dword [eax + edx + 0xc], 0
je 0x46295e
mov ecx, dword [ebp - 0x28]
imul ecx, ecx, 0x28
mov edx, dword [ebp - 0x20]
cmp dword [edx + ecx + 0x10], 0
jne 0x462960
jmp 0x4629c2
mov eax, dword [ebp - 0x28]
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
add edx, dword [ecx + eax + 0xc]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
cmp dword [ecx], 0x30
jb 0x46298d
mov edx, dword [ebp - 0x30]
cmp dword [edx + 4], 0x727444
je 0x46298f
jmp 0x4629c2
mov eax, dword [ebp - 0x30]
cmp dword [eax + 8], 0
jne 0x4629a3
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x30]
mov eax, dword [edx]
mov dword [ecx + 8], eax
push 0
call dword [0x100a76c8]
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x40], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x40]
jmp 0x4629e8
jmp 0x462906
mov dword [ebp - 4], 0xffffffff
jmp 0x4629db
push 0xc0
call dword [0x100a76c8]
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4065d0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x46407b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00458ec0
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x406652
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00456c77
mov eax, dword [eax]
push 0x52c1c0
push eax
call fcn.00449b74
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0045914b
test bl, bl
je 0x406652
push 0x52c1c0
lea ecx, [esp + 0xc]
call fcn.004594db
push 0x52fd18
lea ecx, [esp + 0xc]
call fcn.004594db
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40668e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0045914b
jmp 0x406759
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x406712
lea edx, [esp + 0x7c]
push 0x52fd14
push edx
call fcn.00449b74
add esp, 8
test eax, eax
je 0x406712
lea eax, [esp + 0x7c]
push 0x52fd10
push eax
call fcn.00449b74
add esp, 8
test eax, eax
je 0x406712
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4066a2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0045914b
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x406f50
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x406fb2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc