joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4536c4
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 9], 0
cmp dword [0x4880e0], 2
jne 0x4538e9
call sub.kernel32.dll_GetVersion
and ax, 0xff
cmp ax, 5
jb 0x4538e9
push 0x4538f8
call sub.kernel32.dll_GetModuleHandleA_1
mov edi, eax
push 0x453908
push edi
call sub.kernel32.dll_GetProcAddress
mov ebx, eax
push 0x453920
push edi
call sub.kernel32.dll_GetProcAddress
mov dword [ebp - 0x10], eax
push 0x453938
push edi
call sub.kernel32.dll_GetProcAddress
mov dword [ebp - 0x14], eax
test ebx, ebx
je 0x4538e9
cmp dword [ebp - 0x10], 0
je 0x4538e9
cmp dword [ebp - 0x14], 0
je 0x4538e9
xor eax, eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 4
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
call fcn.00403880
push eax
call ebx
test eax, eax
jne 0x4538e9
xor edx, edx
push ebp
push 0x4538de
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp + 0xc]
shl eax, 5
call fcn.00406a0c
mov dword [ebp - 0x24], eax
mov edi, dword [ebp + 0xc]
dec edi
test edi, edi
jl 0x453813
inc edi
xor ebx, ebx
lea eax, [ebp - 0x28]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi + 8]
push eax
mov al, byte [esi + 6]
push eax
push esi
call sub.advapi32.dll_AllocateAndInitializeSid
test eax, eax
jne 0x4537cd
call fcn.00403304
jmp 0x4538e9
mov eax, ebx
shl eax, 2
mov edx, dword [ebp - 0x24]
mov ecx, dword [esi + 0x10]
mov dword [edx + eax*8], ecx
mov edx, dword [ebp - 0x24]
mov dword [edx + eax*8 + 4], 1
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp + 8]
mov dword [edx + eax*8 + 8], ecx
mov edx, dword [ebp - 0x24]
xor ecx, ecx
mov dword [edx + eax*8 + 0x14], ecx
mov edx, dword [ebp - 0x24]
xor ecx, ecx
mov dword [edx + eax*8 + 0x18], ecx
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov dword [edx + eax*8 + 0x1c], ecx
add esi, 0x14
inc ebx
dec edi
jne 0x45379d
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [ebp + 0xc]
push eax
call dword [ebp - 0x14]
test eax, eax
je 0x453834
call fcn.00403304
jmp 0x4538e9
xor eax, eax
push ebp
push 0x453885
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0x20]
push eax
push 0
push 0
push 4
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
call fcn.00403880
push eax
call dword [ebp - 0x10]
test eax, eax
je 0x45386e
call fcn.00403304
call fcn.00403304
jmp 0x4538e9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45388c
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_LocalFree_1
ret
mov al, byte [ebp - 9]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x45394c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, ebx
call fcn.00403880
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x45396b
xor eax, eax
jmp 0x453988
test al, 0x10
je 0x453976
mov eax, 3
jmp 0x453978
xor eax, eax
push edi
push eax
mov ecx, esi
mov edx, ebx
mov eax, 1
call fcn.004536c4
pop edi
pop esi
pop ebx
ret

Function at 0x455194
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp], ecx
mov edi, edx
mov esi, eax
mov eax, esi
call fcn.00403880
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4552f8
test bl, 0x10
je 0x4552f8
mov dword [esp + 4], esi
mov byte [esp + 8], 0xb
lea edx, [esp + 4]
xor ecx, ecx
mov eax, 0x45530c
call fcn.00454fa4
test bl, 1
je 0x455223
mov eax, esi
call fcn.004519c0
test al, al
je 0x455219
and ebx, 0xfffffffe
push ebx
mov eax, esi
call fcn.00403880
push eax
call sub.kernel32.dll_SetFileAttributesA
test eax, eax
je 0x45520d
mov eax, 0x45532c
call fcn.00454db4
jmp 0x455223
mov eax, 0x455354
call fcn.00454db4
jmp 0x455223
mov eax, 0x455384
call fcn.00454db4
mov eax, esi
call fcn.00403880
push eax
call sub.kernel32.dll_RemoveDirectoryA
mov ebx, eax
neg ebx
sbb ebx, ebx
neg ebx
test bl, bl
jne 0x4552fa
call sub.kernel32.dll_GetLastError_1
mov ebp, eax
test edi, edi
je 0x455272
mov dword [esp + 4], ebp
mov byte [esp + 8], 0
lea edx, [esp + 4]
xor ecx, ecx
mov eax, 0x4553e4
call fcn.00454fa4
mov edx, esi
mov eax, edi
call fcn.00453b28
jmp 0x4552fa
cmp dword [esp], 0
je 0x4552dd
mov edx, esi
mov eax, dword [esp]
call fcn.004550bc
test al, al
je 0x4552dd
cmp dword [0x4880e0], 2
jne 0x4552dd
mov dword [esp + 4], ebp
mov byte [esp + 8], 0
lea edx, [esp + 4]
xor ecx, ecx
mov eax, 0x455420
call fcn.00454fa4
push 4
push 0
mov eax, esi
call fcn.00403880
push eax
call sub.kernel32.dll_MoveFileExA
test eax, eax
jne 0x4552fa
call sub.kernel32.dll_GetLastError_1
mov dword [esp + 4], eax
mov byte [esp + 8], 0
lea edx, [esp + 4]
xor ecx, ecx
mov eax, 0x45546c
call fcn.00454fa4
jmp 0x4552fa
mov dword [esp + 4], ebp
mov byte [esp + 8], 0
lea edx, [esp + 4]
xor ecx, ecx
mov eax, 0x45548c
call fcn.00454fa4
jmp 0x4552fa
mov bl, 1
mov eax, ebx
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4554b0
Capabilities:
Read .ini file

Disassembly:
add esp, 0xffffff00
mov byte [esp], 0
cmp byte [edx], 0
je 0x4554d9
push edx
push pe_nt_image_headers32
lea edx, [esp + 8]
push edx
push 0x455500
push 0
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
jmp 0x4554f0
push pe_nt_image_headers32
lea edx, [esp + 4]
push edx
push 0x455500
push 0
push eax
call sub.kernel32.dll_GetProfileStringA
cmp byte [esp], 0
sete al
add esp, 0x100
ret
Function at 0x4559b0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x14], ebx
mov byte [ebp - 2], cl
mov byte [ebp - 1], dl
mov esi, eax
xor eax, eax
push ebp
push 0x455bea
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
lea edx, [ebp - 8]
mov eax, esi
call fcn.0042c984
mov eax, dword [ebp - 8]
mov edx, 0x455c04
call fcn.00406af4
test eax, eax
jne 0x455a22
lea ecx, [ebp - 8]
mov edx, 0x455c14
mov eax, esi
call fcn.0042c654
mov eax, dword [ebp - 8]
call fcn.00407030
lea ecx, [ebp - 8]
mov edx, 0x455c24
mov eax, esi
call fcn.0042c654
mov eax, dword [ebp - 8]
call fcn.00407030
mov eax, esi
call fcn.0042cdb0
test al, al
je 0x455bcc
mov dword [ebp - 0x10], esi
mov byte [ebp - 0xc], 0xb
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x455c34
call fcn.00454fa4
cmp byte [ebp + 8], 0
je 0x455a94
mov eax, esi
call fcn.00403880
push eax
call sub.kernel32.dll_GetFileAttributesA
mov edi, eax
cmp edi, 0xffffffff
je 0x455a94
test edi, 1
je 0x455a94
and edi, 0xfffffffe
push edi
mov eax, esi
call fcn.00403880
push eax
call sub.kernel32.dll_SetFileAttributesA
test eax, eax
je 0x455a8a
mov eax, 0x455c50
call fcn.00454db4
jmp 0x455a94
mov eax, 0x455c78
call fcn.00454db4
mov eax, esi
call fcn.00407030
test al, al
jne 0x455b9b
call sub.kernel32.dll_GetLastError_1
mov edi, eax
cmp byte [ebp - 2], 0
je 0x455b81
mov eax, dword [ebp + 0xc]
cmp byte [eax - 1], 0
je 0x455b81
cmp edi, 5
je 0x455acf
cmp edi, 0x20
jne 0x455b81
mov eax, esi
call fcn.00403880
push eax
call sub.kernel32.dll_GetFileAttributesA
test al, 1
jne 0x455b81
mov dword [ebp - 0x10], edi
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x455ca8
call fcn.00454fa4
xor eax, eax
push ebp
push 0x455b4b
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, esi
call fcn.0045139c
mov eax, dword [ebp + 0xc]
mov eax, dword [eax - 8]
mov byte [eax + 0x18], 1
lea edx, [ebp - 0x14]
mov eax, esi
call fcn.0042c88c
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 8]
call fcn.0042c92c
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax - 0xc]
call fcn.00453b28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x455bcc
mov dword [ebp - 0x10], edi
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x455d0c
call fcn.00454fa4
xor ebx, ebx
jmp 0x455bcc
cmp byte [ebp - 1], 0
je 0x455bcc
push 0
mov eax, esi
call fcn.00403880
push eax
push 1
push 4
call fcn.0042cd50
lea edx, [ebp - 8]
mov eax, esi
call fcn.0042c92c
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax - 0x10]
call fcn.00453b28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x455bf1
lea eax, [ebp - 0x14]
call fcn.00403548
lea eax, [ebp - 8]
call fcn.00403548
ret
Function at 0x45a61c
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x14c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45a6f0
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea eax, [ebp - 0x148]
push eax
lea edx, [ebp - 0x14c]
mov eax, ebx
call int.0042c5e0
lea eax, [ebp - 0x14c]
mov edx, 0x45a70c
call fcn.004036c4
mov eax, dword [ebp - 0x14c]
call fcn.00403880
push eax
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x45a6d7
xor eax, eax
push ebp
push 0x45a6d0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x148]
call fcn.0045a5d0
test al, al
je 0x45a6a5
mov byte [ebp - 1], 1
jmp 0x45a6b9
lea eax, [ebp - 0x148]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x45a690
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a6d7
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindClose
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a6f7
lea eax, [ebp - 0x14c]
call fcn.00403548
ret

Function at 0x45b684
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45b715
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetLogicalDrives
mov esi, eax
mov bl, 0x41
test esi, 1
je 0x45b6f7
push 0
push 0
push 1
lea eax, [ebp - 8]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 8]
lea eax, [ebp - 0xc]
call fcn.004029a8
mov edx, 0x45b724
lea eax, [ebp - 0xc]
mov cl, 2
call fcn.00402978
lea edx, [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.00403668
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
xor edx, edx
call fcn.0045b230
shr esi, 1
inc ebx
cmp bl, 0x5b
jne 0x45b6a9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b71c
lea eax, [ebp - 4]
call fcn.00403548
ret
Function at 0x45b728
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14c], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45b859
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45b839
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x148]
push eax
lea edx, [ebp - 0x14c]
mov eax, esi
call int.0042c5e0
lea eax, [ebp - 0x14c]
mov edx, 0x45b870
call fcn.004036c4
mov eax, dword [ebp - 0x14c]
call fcn.00403880
push eax
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x45b822
xor eax, eax
push ebp
push 0x45b81b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x148]
call fcn.0045a5d0
test al, al
je 0x45b7f0
push 0
push 0
push 0
lea eax, [ebp - 0x14c]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.004036a4
mov ecx, dword [ebp - 0x14c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, ebx
call fcn.0045b230
lea eax, [ebp - 0x148]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x45b7b2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b822
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindClose
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b840
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x45babc
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x154], ebx
mov dword [ebp - 0x158], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
mov ebx, ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x45bc70
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x45bb2f
lea edx, [ebp - 0x154]
mov eax, ebx
call fcn.0042c9dc
mov eax, dword [ebp - 0x154]
push eax
lea edx, [ebp - 0x158]
mov eax, edi
call int.0042c5e0
mov eax, dword [ebp - 0x158]
pop edx
call fcn.0042c6d8
test eax, eax
jne 0x45bb2f
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0042c9b4
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x45bc3b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x150]
push eax
lea edx, [ebp - 0x154]
mov eax, edi
call int.0042c5e0
lea eax, [ebp - 0x154]
mov edx, 0x45bc88
call fcn.004036c4
mov eax, dword [ebp - 0x154]
call fcn.00403880
push eax
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x45bc24
xor eax, eax
push ebp
push 0x45bc1d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x150]
call fcn.0045a5d0
test al, al
je 0x45bbf2
lea eax, [ebp - 0x10]
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.004036a4
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.0042c6d8
test eax, eax
je 0x45bbf2
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 0x10]
mov edx, esi
call fcn.0045b328
test eax, eax
jne 0x45bbf2
push 0
push 0
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 0x10]
mov edx, esi
call fcn.0045b230
lea eax, [ebp - 0x150]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x45bb97
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45bc24
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FindClose
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45bc42
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x460460
Capabilities:
Get installed programs

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov esi, eax
xor eax, eax
push ebp
push 0x460690
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, dword [0x48a014]
call fcn.0046ee0c
cmp dword [ebp - 0xc], 0
je 0x460675
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0046c598
mov edi, 2
mov ebx, 0x488a18
lea eax, [ebp - 4]
push eax
push 1
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, 0x4606a8
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0xb
lea edx, [ebp - 0x24]
mov ecx, 1
mov eax, 0x4606e4
call fcn.00407ad4
mov eax, dword [ebp - 0x14]
call fcn.00403880
push eax
mov eax, dword [ebx]
push eax
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x46066b
xor eax, eax
push ebp
push 0x460664
push dword fs:[eax]
mov dword fs:[eax], esp
test byte [0x48a124], 4
je 0x46052a
lea ecx, [esi + 0x300]
mov edx, 0x4606f0
mov eax, dword [ebp - 4]
call fcn.0042dbd0
test byte [0x48a124], 0x10
je 0x46055e
lea ecx, [esi + 0x304]
mov edx, 0x460708
mov eax, dword [ebp - 4]
call fcn.0042dbd0
mov edx, 0x460720
mov eax, dword [ebp - 4]
call fcn.0042dbe8
test al, al
je 0x46055e
mov byte [esi + 0x318], 1
test byte [0x48a124], 0x40
je 0x4605be
lea ecx, [esi + 0x308]
mov edx, 0x460738
mov eax, dword [ebp - 4]
call fcn.0042dbd0
lea ecx, [ebp - 8]
mov edx, 0x460750
mov eax, dword [ebp - 4]
call fcn.0042dbd0
test al, al
je 0x46059c
mov edx, dword [ebp - 8]
mov eax, dword [esi + 0x31c]
call fcn.0040c620
lea ecx, [ebp - 8]
mov edx, 0x460770
mov eax, dword [ebp - 4]
call fcn.0042dbd0
test al, al
je 0x4605be
mov edx, dword [ebp - 8]
mov eax, dword [esi + 0x320]
call fcn.0040c620
test byte [0x48a125], 8
je 0x46060b
lea ecx, [ebp - 8]
mov edx, 0x460794
mov eax, dword [ebp - 4]
call fcn.0042dbd0
test al, al
je 0x4605e9
mov edx, dword [ebp - 8]
mov eax, dword [esi + 0x324]
call fcn.0040c620
lea ecx, [ebp - 8]
mov edx, 0x4607b0
mov eax, dword [ebp - 4]
call fcn.0042dbd0
test al, al
je 0x46060b
mov edx, dword [ebp - 8]
mov eax, dword [esi + 0x328]
call fcn.0040c620
test byte [0x48a126], 2
je 0x46064d
lea ecx, [esi + 0x30c]
mov edx, 0x4607d0
mov eax, dword [ebp - 4]
call fcn.0042dbd0
lea ecx, [esi + 0x310]
mov edx, 0x4607ec
mov eax, dword [ebp - 4]
call fcn.0042dbd0
lea ecx, [esi + 0x314]
mov edx, 0x460810
mov eax, dword [ebp - 4]
call fcn.0042dbd0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460675
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
add ebx, 4
dec edi
jne 0x4604b3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460697
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00403568
ret
Function at 0x464804
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
mov byte [ebp - 5], 0
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.00403880
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jle 0x4648a6
mov eax, ebx
call fcn.00402650
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x46489f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
push edi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x464889
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x464924
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x464889
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464919
mov eax, dword [ebp - 0x10]
call fcn.00402668
ret
cmp dword [0x4880e0], 1
je 0x464919
mov eax, esi
call fcn.0046464c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x464919
xor eax, eax
push ebp
push 0x464912
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x464924
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4648fc
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464919
mov eax, dword [ebp - 0x10]
call fcn.00402668
ret
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x466380
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov ebx, ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4664d6
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x48a1f3], 0
je 0x4663e3
push 0
mov ecx, esi
mov edx, edi
mov eax, 0x4664ec
call fcn.0042d0b4
test al, al
jne 0x466447
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0xc]
xor ecx, ecx
mov eax, 0x4664fc
call fcn.00454fa4
jmp 0x466447
lea eax, [ebp - 4]
push eax
push 2
push 0
push 0x46652c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x46643d
mov eax, esi
call fcn.004036bc
inc eax
push eax
mov eax, esi
call fcn.00403880
push eax
push 1
push 0
mov eax, edi
call fcn.00403880
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x466432
mov eax, 0x466564
call fcn.00454db4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
jmp 0x466447
mov eax, 0x466598
call fcn.00454db4
test bl, bl
je 0x4664bb
xor ebx, ebx
push 0
call sub.kernel32.dll_SetLastError
mov eax, esi
call fcn.00403880
push eax
call sub.gdi32.dll_AddFontResourceA
test eax, eax
je 0x466477
push 0
push 0
push 0x1d
push 0xffff
call sub.user32.dll_SendNotifyMessageA
jmp 0x4664bb
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
mov eax, 0x4665c4
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.00406dd0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
lea edx, [ebp - 0xc]
mov ecx, 1
mov al, 0x32
call fcn.0045093c
mov eax, dword [ebp - 0x10]
mov edx, dword [0x489c1c]
call fcn.00464bf8
test al, al
je 0x46644d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4664dd
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00403568
ret

Function at 0x46670c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
mov esi, eax
cmp ebx, 0xffffffff
je 0x466781
mov eax, esi
call fcn.00403880
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x466781
test al, 0x10
jne 0x466781
mov dword [ebp - 8], esi
mov byte [ebp - 4], 0xb
lea edx, [ebp - 8]
xor ecx, ecx
mov eax, 0x466790
call fcn.00454fa4
mov edx, ebx
mov eax, dword [0x48a170]
call fcn.0040b620
mov ebx, eax
mov eax, dword [ebx]
call fcn.004036bc
mov ecx, 0x14
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebx]
mov edx, eax
mov eax, esi
call fcn.0045394c
test al, al
jne 0x466781
mov eax, 0x4667b8
call fcn.00454db4
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x46a1b0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x148], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46a302
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x144]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call int.0042c5e0
lea eax, [ebp - 0x148]
mov edx, 0x46a318
call fcn.004036c4
mov eax, dword [ebp - 0x148]
call fcn.00403880
push eax
call sub.kernel32.dll_FindFirstFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x46a2e1
lea eax, [ebp - 4]
lea edx, [ebp - 0x118]
mov ecx, 0x104
call fcn.004036a4
mov eax, dword [ebp - 4]
call fcn.004036bc
cmp eax, 9
jl 0x46a2c6
lea eax, [ebp - 0x148]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004038c0
mov eax, dword [ebp - 0x148]
mov edx, 0x46a32c
call fcn.00406af4
test eax, eax
jne 0x46a2c6
mov eax, dword [ebp - 4]
mov al, byte [eax + 5]
add al, 0xd0
sub al, 0xa
jae 0x46a2c6
mov eax, dword [ebp - 4]
mov al, byte [eax + 6]
add al, 0xd0
sub al, 0xa
jae 0x46a2c6
mov eax, dword [ebp - 4]
mov al, byte [eax + 7]
add al, 0xd0
sub al, 0xa
jae 0x46a2c6
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0x2e
jne 0x46a2c6
lea eax, [ebp - 0x148]
push eax
mov ecx, 3
mov edx, 6
mov eax, dword [ebp - 4]
call fcn.004038c0
mov eax, dword [ebp - 0x148]
call fcn.00406e00
mov edx, dword [ebp + 8]
mov byte [edx + eax - 0x3ec], 1
lea eax, [ebp - 0x144]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x46a219
push ebx
call sub.kernel32.dll_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a309
lea eax, [ebp - 0x148]
call fcn.00403548
lea eax, [ebp - 4]
call fcn.00403548
ret

Function at 0x46a734
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, 0x489ff0
mov esi, dword [ebp + 8]
add esi, 0xfffffff8
cmp dword [esi], 0
je 0x46a7a2
jmp 0x46a760
mov edx, 0x46a7b0
mov al, 0x41
call fcn.0046a5e4
test al, al
jne 0x46a760
call fcn.00408d90
mov eax, dword [ebx]
call fcn.00407030
test al, al
je 0x46a74b
jmp 0x46a782
mov edx, 0x46a7c4
mov al, 0x40
call fcn.0046a5e4
test al, al
jne 0x46a782
call fcn.00408d90
mov eax, dword [ebx]
call fcn.00403880
push eax
mov eax, dword [esi]
call fcn.00403880
push eax
call sub.kernel32.dll_MoveFileA
test eax, eax
je 0x46a76d
mov eax, esi
call fcn.00403548
pop esi
pop ebx
pop ebp
ret