joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45e0b0
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff178
mov ebx, eax
cmp dword [0x4afc0c], 0
je 0x45e0cc
mov edx, str.ArcSort
jmp 0x45e0d1
mov edx, str.FileSort
mov eax, 0x498107
xor ecx, ecx
call fcn.00460c28
mov edi, eax
mov eax, edi
and eax, 0x1f
cmp eax, 2
jne 0x45e210
xor esi, esi
mov dword [esp + 8], esi
xor eax, eax
mov dword [esp + 0xc], eax
lea edx, [esp + 4]
mov dword [esp + 4], 4
push edx
push 0
push 0x1005
push dword [ebx]
call sub.USER32.DLL_SendMessageA
test eax, eax
je 0x45e210
mov eax, 0x4bb27c
mov edx, dword [esp + 0x24]
call fcn.004604f4
mov ebp, esi
mov dword [eax + 8], ebp
mov eax, dword [0x4afc0c]
test eax, eax
jne 0x45e20a
mov byte [esp + 0x2c], 0
add eax, 2
lea edx, [esp + 0x2c]
mov dword [esp + 0x84], eax
lea ecx, [esp + 0x7c]
mov dword [esp + 0x94], 0x50
mov dword [esp + 0x90], edx
push ecx
push ebp
push 0x102d
push dword [ebx]
call sub.USER32.DLL_SendMessageA
cmp byte [esp + 0x2c], 0
jne 0x45e20a
lea ecx, [esp + 0xa4]
mov eax, 0x4bb27c
mov edx, dword [esp + 0x24]
call fcn.0046036c
push 0x400
push 0x160
lea eax, [esp + 0xcdc]
push eax
push 0
lea edx, [esp + 0xb4]
push edx
call sub.SHELL32.DLL_SHGetFileInfoA
test eax, eax
je 0x45e20a
cmp byte [esp + 0xde4], 0
jne 0x45e1d7
lea ecx, [esp + 0xde4]
lea edx, [esp + 0xa4]
mov eax, ebx
call fcn.0045dd7c
mov ecx, dword [0x4afc0c]
lea eax, [esp + 0xde4]
add ecx, 2
lea edx, [esp + 0xe34]
mov dword [esp + 0xe3c], ecx
mov dword [esp + 0xe48], eax
push edx
push ebp
push 0x102e
push dword [ebx]
call sub.USER32.DLL_SendMessageA
inc esi
jmp 0x45e0ef
mov edx, 0x49824d
mov eax, 0x498107
mov ecx, 1
call fcn.00460c28
test eax, eax
je 0x45e22b
or edi, 0x40
mov edx, str.FlatView
mov eax, 0x498107
xor ecx, ecx
call fcn.00460c28
test eax, eax
je 0x45e246
or edi, 0x80
push 0x459913
push edi
push 0x1030
push dword [ebx]
call sub.USER32.DLL_SendMessageA
cmp dword [ebx + 4], 0
je 0x45e35b
test edi, 0x20
setne al
and eax, 1
and edi, 0x1f
or ebp, 0xffffffff
mov byte [esp], al
xor eax, eax
mov edx, eax
shl edx, 3
sub edx, eax
cmp edi, dword [edx*4 + 0x497f8c]
jne 0x45e292
mov ebp, dword [edx*4 + 0x497f88]
jmp 0x45e298
inc eax
cmp eax, 7
jl 0x45e279
xor esi, esi
mov dword [esp + 0xe5c], 4
lea eax, [esp + 0xe5c]
push eax
mov edi, esi
push edi
push 0x1203
push dword [ebx + 4]
call sub.USER32.DLL_SendMessageA
test eax, eax
je 0x45e2f4
test byte [esp + 0xe71], 0x20
je 0x45e2ee
and dword [esp + 0xe70], 0xffffdfff
lea eax, [esp + 0xe5c]
push eax
push edi
push 0x1204
push dword [ebx + 4]
call sub.USER32.DLL_SendMessageA
jmp 0x45e2f4
inc esi
cmp esi, 0x10
jl 0x45e29a
mov dword [esp + 0xe5c], 4
test ebp, ebp
jl 0x45e35b
lea edx, [esp + 0xe5c]
push edx
push ebp
push 0x1203
push dword [ebx + 4]
call sub.USER32.DLL_SendMessageA
test eax, eax
je 0x45e35b
or dword [esp + 0xe70], 0x3000
or dword [esp + 0xe5c], 0x10
cmp byte [esp], 0
je 0x45e33b
mov ecx, dword [ebx + 0x14]
jmp 0x45e33e
mov ecx, dword [ebx + 0x10]
mov dword [esp + 0xe68], ecx
lea eax, [esp + 0xe5c]
push eax
push ebp
push 0x1204
push dword [ebx + 4]
call sub.USER32.DLL_SendMessageA
add esp, 0xe88
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x45edf0
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffff800
mov ebx, eax
mov eax, ebx
call fcn.0045f29c
cmp dword [0x4afc0c], 0
je 0x45eea7
push esp
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov eax, esp
call fcn.0040add4
mov esi, eax
cmp esi, 0xffffffff
je 0x45ee6a
call fcn.00462cf8
mov ecx, esi
mov edx, 1
shl edx, cl
and eax, edx
jne 0x45ee6a
lea edx, [esp + 0x400]
mov eax, 0x4adfd0
xor ecx, ecx
call fcn.0045900c
lea eax, [esp + 0x400]
call fcn.0040ae9c
lea edx, [esp + 0x400]
push edx
call fcn.00484424
pop ecx
xor eax, eax
jmp 0x45eea9
mov eax, dword [0x4ad5ac]
test eax, eax
je 0x45ee79
push eax
call sub.USER32.DLL_DestroyWindow
mov eax, ebx
call fcn.0045ed78
xor edx, edx
mov eax, ebx
mov dword [0x4afc0c], edx
call fcn.0045e898
mov eax, ebx
call fcn.0045ef34
mov byte [0x4adb40], 0
mov eax, 0x4adb14
call fcn.00441fd8
mov al, 1
add esp, 0x800
pop esi
pop ebx
ret
Function at 0x45f8df
Capabilities:
Get file system object information

Disassembly:
add esp, 0xfffffea0
push edx
push 0x160
lea edx, [esp + 8]
push edx
push 0
push eax
call sub.SHELL32.DLL_SHGetFileInfoA
mov eax, dword [esp + 4]
add esp, 0x160
ret

Function at 0x45fcdc
Capabilities:
Get disk information
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffaa0
mov esi, eax
mov dword [0x4bbb88], esi
push 0x4001
push 0x160
lea eax, [esp + 8]
push eax
push 0
push 0x498458
call sub.SHELL32.DLL_SHGetFileInfoA
mov ebx, eax
test ebx, ebx
jne 0x45fd3f
lea eax, [esp + 0x160]
push eax
push 0x400
call sub.KERNEL32.DLL_GetLogicalDriveStringsA
push 0x4001
push 0x160
lea edx, [esp + 8]
push edx
push 0
lea ecx, [esp + 0x170]
push ecx
call sub.SHELL32.DLL_SHGetFileInfoA
mov ebx, eax
push ebx
push 0
push 0x1109
push esi
call sub.USER32.DLL_SendMessageA
call fcn.0045f64b
add esp, 0x560
pop esi
pop ebx
ret

Function at 0x460190
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x28], eax
mov eax, 0x4984c4
call fcn.00482ea0
mov word [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
mov edx, 1
add eax, 0xf8
call fcn.004602bc
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
imul edx, dword [eax + 0x104], 0x38
mov esi, dword [ecx + 0xf8]
add esi, edx
cmp word [ebx + 0x400], 0
je 0x4601e7
lea ecx, [ebx + 0x400]
jmp 0x4601e9
xor ecx, ecx
mov edx, ebx
mov eax, dword [ebp - 0x28]
call fcn.0040e1d4
mov word [ebp - 0x14], 0
jmp 0x46022f
mov edx, dword [ebx + 0xc2c]
mov dword [esi + 8], edx
mov ecx, dword [ebx + 0xc00]
mov dword [esi + 0xc], ecx
mov ecx, dword [ebx + 0xc04]
mov dword [esi + 0x10], ecx
mov eax, dword [ebx + 0xc08]
mov dword [esi + 0x14], eax
mov eax, dword [ebx + 0xc0c]
mov dword [esi + 0x18], eax
mov edx, dword [ebx + 0xc10]
mov dword [esi + 0x1c], edx
mov ecx, dword [ebx + 0xc14]
mov dword [esi + 0x20], ecx
mov ecx, dword [ebx + 0xc18]
mov dword [esi + 0x24], ecx
mov eax, dword [ebx + 0xc1c]
mov dword [esi + 0x28], eax
mov edx, dword [ebx + 0xc20]
mov dword [esi + 0x2c], edx
mov ecx, dword [ebx + 0xc24]
mov dword [esi + 0x30], ecx
mov eax, dword [ebx + 0xc28]
mov dword [esi + 0x34], eax
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x104]
inc dword [edx + 0x104]
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x460500
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff664
mov esi, ecx
mov ebp, edx
mov edi, eax
push esp
push 0x20019
push 0
push ebp
push dword [0x4984d8]
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x46052f
xor eax, eax
jmp 0x46069b
mov edx, esi
mov eax, edi
call fcn.004606a6
lea edx, [esp + 8]
push edx
lea ecx, [esp + 8]
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push esi
push dword [0x4984d8]
call sub.ADVAPI32.DLL_RegCreateKeyExA
test eax, eax
je 0x46056e
mov eax, dword [esp]
call fcn.0046081f
xor eax, eax
jmp 0x46069b
xor ebx, ebx
mov dword [esp + 0x10], 0xc8
mov dword [esp + 0x14], 0x3e8
lea eax, [esp + 0x14]
push eax
lea edx, [esp + 0xf0]
push edx
lea ecx, [esp + 0x14]
push ecx
push 0
lea eax, [esp + 0x20]
push eax
lea edx, [esp + 0x38]
push edx
push ebx
push dword [esp + 0x1c]
call sub.ADVAPI32.DLL_RegEnumValueA
test eax, eax
jne 0x4605cf
push dword [esp + 0x14]
lea ecx, [esp + 0xf0]
push ecx
push dword [esp + 0x14]
push 0
lea eax, [esp + 0x34]
push eax
push dword [esp + 0x18]
call sub.ADVAPI32.DLL_RegSetValueExA
inc ebx
jmp 0x460570
xor ebx, ebx
mov dword [esp + 0x18], 0xc8
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push 0
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x4e8]
push ecx
push ebx
push dword [esp + 0x1c]
call sub.ADVAPI32.DLL_RegEnumKeyExA
test eax, eax
jne 0x460688
lea eax, [esp + 0x4d4]
push eax
push ebp
push str._s_s
lea edx, [esp + 0x5a8]
push edx
call fcn.00486578
add esp, 0x10
lea ecx, [esp + 0x4d4]
push ecx
push esi
push str._s_s
lea eax, [esp + 0x7a8]
push eax
call fcn.00486578
add esp, 0x10
lea edx, [esp + 8]
push edx
lea ecx, [esp + 8]
push ecx
push 0
push 0x20006
push 0
push 0
push 0
lea eax, [esp + 0x7b8]
push eax
push dword [0x4984d8]
call sub.ADVAPI32.DLL_RegCreateKeyExA
test eax, eax
jne 0x460688
lea ecx, [esp + 0x79c]
lea edx, [esp + 0x59c]
mov eax, edi
call fcn.00460500
inc ebx
jmp 0x4605d1
mov eax, dword [esp]
call fcn.0046081f
mov eax, dword [esp + 4]
call fcn.0046081f
mov al, 1
add esp, 0x99c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4606dc
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebx
push esi
mov esi, edx
push edi
add esp, 0xfffffd28
mov edi, eax
cmp byte [esi], 0
je 0x460777
push esp
push 0x20019
push 0
push esi
push edi
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x460777
xor ebx, ebx
mov dword [esp + 4], 0xc8
lea eax, [esp + 8]
push eax
push 0
push 0
push 0
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x24]
push ecx
push ebx
push dword [esp + 0x1c]
call sub.ADVAPI32.DLL_RegEnumKeyExA
test eax, eax
jne 0x46075e
lea eax, [esp + 0x10]
push eax
push esi
push str._s_s
lea edx, [esp + 0xe4]
push edx
call fcn.00486578
add esp, 0x10
mov eax, edi
lea edx, [esp + 0xd8]
call fcn.004606dc
inc ebx
jmp 0x460707
mov eax, dword [esp]
call fcn.0046081f
push esi
push edi
call sub.ADVAPI32.DLL_RegDeleteKeyA
test eax, eax
jne 0x460777
inc dword [0x4bbf90]
add esp, 0x2d8
pop edi
pop esi
pop ebx
ret
Function at 0x460900
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff58
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 8]
call fcn.0040e9e0
test eax, eax
je 0x460967
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.00460781
mov ebx, eax
lea edx, [ebp - 0xa8]
mov ecx, 0x10000000
mov eax, dword [ebp - 8]
call fcn.0040ea48
mov eax, esi
call fcn.0040eab0
add eax, eax
lea edx, [ebp - 0xa8]
add eax, 2
push eax
push esi
push 1
push 0
push edx
push ebx
call sub.ADVAPI32.DLL_RegSetValueExW
mov eax, ebx
call fcn.0046081f
jmp 0x46099f
mov eax, esi
call fcn.0040eab0
add eax, eax
add eax, 2
push eax
call fcn.004811dc
pop ecx
mov ebx, eax
mov ecx, 0x10000000
mov edx, ebx
mov eax, esi
call fcn.0040ea34
push ebx
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.004608b8
push ebx
call fcn.00481004
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x460a8c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov edx, dword [ebp - 4]
mov edi, dword [ebp + 0x10]
mov esi, ecx
call fcn.004607d5
mov ebx, eax
lea eax, [ebp + 8]
push eax
push edi
lea edx, [ebp - 8]
push edx
push 0
push esi
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExA
mov esi, eax
mov eax, ebx
call fcn.0046081f
test ebx, ebx
je 0x460aca
test esi, esi
je 0x460ada
push dword [ebp + 0xc]
push edi
call fcn.00482a00
add esp, 8
xor eax, eax
jmp 0x460adc
mov al, 1
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc

Function at 0x460b04
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff54
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edi, dword [ebp + 0x10]
call fcn.0040e9e0
test eax, eax
je 0x460b79
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004607d5
mov ebx, eax
lea edx, [ebp - 0xac]
mov ecx, 0x10000000
mov eax, dword [ebp - 8]
call fcn.0040ea48
lea eax, [ebp + 8]
lea edx, [ebp - 0xc]
push eax
push edi
push edx
lea ecx, [ebp - 0xac]
push 0
push ecx
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExW
mov esi, eax
mov eax, ebx
call fcn.0046081f
test ebx, ebx
je 0x460b6c
test esi, esi
je 0x460b70
xor edx, edx
jmp 0x460b75
mov edx, 1
mov ebx, edx
jmp 0x460bb1
mov ecx, dword [ebp + 8]
inc ecx
push ecx
call fcn.004811dc
pop ecx
mov esi, eax
push esi
push 0x4984dc
push dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00460a8c
mov ebx, eax
mov ecx, dword [ebp + 8]
mov edx, edi
mov eax, esi
call fcn.0040ea48
push esi
call fcn.00481004
pop ecx
test bl, bl
jne 0x460bbf
mov edx, dword [ebp + 0xc]
mov eax, edi
call fcn.0040eac4
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x460bcc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov edx, dword [ebp - 4]
mov edi, dword [ebp + 0xc]
mov esi, ecx
call fcn.004607d5
mov ebx, eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 4
push eax
push edi
lea edx, [ebp - 8]
push edx
push 0
push esi
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExA
mov esi, eax
mov eax, ebx
call fcn.0046081f
test ebx, ebx
je 0x460c11
test esi, esi
je 0x460c1a
mov edx, dword [ebp + 8]
xor eax, eax
mov dword [edi], edx
jmp 0x460c1c
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x460c70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp - 4]
call fcn.004607d5
mov ebx, eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], edi
push eax
push esi
lea edx, [ebp - 0xc]
push edx
push 0
push dword [ebp - 8]
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExA
mov dword [ebp - 0x14], eax
mov eax, ebx
call fcn.0046081f
test ebx, ebx
je 0x460cba
cmp dword [ebp - 0x14], 0
je 0x460cdf
cmp dword [ebp + 0xc], 0
je 0x460ccf
push edi
push dword [ebp + 0xc]
push esi
call fcn.00482810
add esp, 0xc
jmp 0x460cdb
push edi
push 0
push esi
call fcn.00482880
add esp, 0xc
xor eax, eax
jmp 0x460ce2
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x460cfc
Capabilities:
Delete registry key

Disassembly:
push ebx
add esp, 0xffffff00
mov ebx, eax
mov eax, ebx
push 0x100
lea ecx, [esp + 4]
call fcn.00460832
test al, al
je 0x460d20
push esp
push ebx
call sub.ADVAPI32.DLL_RegDeleteKeyA
add esp, 0x100
pop ebx
ret

Function at 0x460d38
Capabilities:
Delete registry value

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, ecx
mov ebx, eax
mov eax, ebx
push 0x100
lea ecx, [esp + 8]
call fcn.00460832
test al, al
je 0x460d81
push esp
push 0x20006
push 0
lea edx, [esp + 0x10]
push edx
push ebx
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x460d81
push esi
push dword [esp + 4]
call sub.ADVAPI32.DLL_RegDeleteValueA
mov eax, dword [esp]
call fcn.0046081f
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x460f54
Capabilities:
Get common file path

Disassembly:
add esp, 0xfffff800
push 0x400
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push str.WinRAR.exe
lea eax, [esp + 4]
call fcn.0040a924
push eax
call fcn.00482a00
add esp, 8
mov ecx, 0x498637
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionApp_PathsWinRAR.exe
mov eax, CreateStatusWindowA
push esp
call fcn.004608b8
lea edx, [esp + 0x400]
push edx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
lea ecx, [esp + 0x400]
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionApp_PathsWinRAR.exe
push ecx
mov ecx, 0x4987b8
mov eax, CreateStatusWindowA
call fcn.004608b8
add esp, 0x800
ret
Function at 0x46255c
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
xor ebx, ebx
lea eax, [ebp - 8]
push eax
push 0x49ac10
push 1
push 0
push 0x49ac40
call sub.OLE32.DLL_CoCreateInstance
test eax, eax
jl 0x462627
push edi
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x50]
test esi, esi
je 0x4625a8
push esi
mov eax, dword [ebp - 8]
push eax
mov edx, dword [eax]
call dword [edx + 0x1c]
cmp dword [ebp + 0xc], 0
je 0x4625bc
push 0
push dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x44]
cmp dword [ebp + 8], 0
je 0x4625ce
push dword [ebp + 8]
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x2c]
lea eax, [ebp - 0xc]
push eax
push 0x49ac70
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx]
test eax, eax
jl 0x46261e
push 0x104
lea eax, [ebp - 0x214]
push eax
push 0xffffffffffffffff
push dword [ebp - 4]
push 0
push 0
call sub.KERNEL32.DLL_MultiByteToWideChar
push 1
lea edx, [ebp - 0x214]
push edx
mov ecx, dword [ebp - 0xc]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x18]
test eax, eax
jl 0x462615
mov bl, 1
mov eax, dword [ebp - 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x462634
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
push esp
call sub.SHELL32.DLL_SHGetMalloc
lea eax, [esp + 4]
push eax
push 0x10
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
push ebx
push dword [esp + 8]
call sub.SHELL32.DLL_SHGetPathFromIDListA
push dword [esp + 4]
mov edx, dword [esp + 4]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x14]
pop ecx
pop edx
pop ebx
ret

Function at 0x46266c
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file

Disassembly:
push ebx
add esp, 0xffffffe0
mov ebx, eax
push ebx
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x462681
xor eax, eax
jmp 0x4626bf
push ebx
call fcn.00482a30
pop ecx
mov byte [ebx + eax + 1], 0
push 0x1e
push 0
lea edx, [esp + 8]
push edx
call fcn.00482880
add esp, 0xc
mov dword [esp + 4], 3
mov word [esp + 0x10], 0x14
mov dword [esp + 8], ebx
push esp
call sub.SHELL32.DLL_SHFileOperationA
test eax, eax
sete al
and eax, 1
add esp, 0x20
pop ebx
ret

Function at 0x4629ac
Capabilities:
Create directory

Disassembly:
push ebx
push esi
add esp, 0xfffffc00
mov esi, edx
mov ebx, eax
mov eax, esp
mov edx, 0x400
call fcn.00462ca0
mov eax, esp
call fcn.0040adfc
push ebx
lea edx, [esp + 4]
push edx
call fcn.00482924
add esp, 8
mov eax, esp
call fcn.00409dd8
test eax, eax
je 0x4629f4
push 0
lea edx, [esp + 4]
push edx
call sub.KERNEL32.DLL_CreateDirectoryA
test eax, eax
jne 0x462a16
push esp
mov eax, 0x1f7
call fcn.00410804
push eax
call fcn.00447a48
add esp, 8
mov eax, 0x49e7d8
call fcn.004277c0
xor eax, eax
jmp 0x462a22
push esp
push esi
call fcn.00482a00
add esp, 8
mov al, 1
add esp, 0x400
pop esi
pop ebx
ret
Function at 0x462ae4
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffac
mov edi, ecx
mov esi, edx
mov ebx, eax
push 0x44
push 0
lea eax, [esp + 8]
push eax
call fcn.00482880
add esp, 0xc
mov dword [esp], 0x44
lea edx, [esp + 0x44]
push edx
lea ecx, [esp + 4]
push ecx
push esi
push 0
push 0
push 0
push 0
push 0
push ebx
push 0
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
je 0x462b4d
test edi, edi
je 0x462b37
push edi
push dword [esp + 0x48]
call sub.KERNEL32.DLL_WaitForSingleObject
push dword [esp + 0x48]
call sub.KERNEL32.DLL_CloseHandle
push dword [esp + 0x44]
call sub.KERNEL32.DLL_CloseHandle
mov al, 1
jmp 0x462b4f
xor eax, eax
add esp, 0x54
pop edi
pop esi
pop ebx
ret

Function at 0x462ca0
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
push 0x498d20
push esi
mov edx, 0x498d38
mov eax, 0x498d32
mov ecx, ebx
call fcn.00460a70
cmp byte [ebx], 0
je 0x462ccd
push ebx
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x462ceb
push ebx
push esi
call sub.KERNEL32.DLL_GetTempPathA
test eax, eax
je 0x462cdd
cmp byte [ebx], 0
jne 0x462ceb
push str._rartemp
push ebx
call fcn.00482a00
add esp, 8
mov eax, ebx
call fcn.0040adfc
pop esi
pop ebx
ret
Function at 0x463128
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x463131
mov eax, dword [ebp - 4]
add esp, 0xffffff14
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x144c], edx
mov edi, eax
mov eax, 0x498e20
call fcn.00482ea0
call fcn.0048e410
mov dword [ebp - 0x1450], eax
xor ebx, ebx
mov word [ebp - 0x1438], 8
push 0
push 0
lea eax, [ebp - 0x1424]
mov ecx, dword [ebp - 0x144c]
mov edx, edi
call fcn.0041135c
inc dword [ebp - 0x142c]
mov word [ebp - 0x1438], 0x14
lea eax, [ebp - 0x14dc]
call fcn.00411d14
lea eax, [ebp - 0x14b8]
call fcn.00411d14
lea eax, [ebp - 0x1494]
call fcn.00411d14
inc dword [0x4afc14]
jmp 0x463255
test bl, bl
jne 0x4631eb
call fcn.0048e410
sub eax, dword [ebp - 0x1450]
cmp eax, 0x3e8
jle 0x4631eb
push 0
xor ecx, ecx
xor edx, edx
mov eax, 5
call fcn.0046aa14
mov bl, 1
test bl, bl
je 0x4631ff
lea eax, [ebp - 0x20f0]
call fcn.0046c1fc
call fcn.0046b7e4
call fcn.00440e74
cmp byte [ebp + 0x14], 0
je 0x46321f
lea eax, [ebp - 0x20f0]
call fcn.0040a924
lea edx, [ebp - 0x20f0]
cmp eax, edx
jne 0x463223
xor eax, eax
jmp 0x463228
mov eax, 1
mov word [ebp - 0x1438], 0x14
push esi
push eax
mov dl, byte [ebp + 0x10]
lea eax, [ebp - 0x20f0]
push edx
lea edx, [ebp - 0x1cf0]
mov cl, byte [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x20f0]
push dword [ebp + 8]
call fcn.004632f8
lea edx, [ebp - 0x20f0]
lea eax, [ebp - 0x1424]
call fcn.00411470
test eax, eax
jne 0x463277
cmp dword [0x4afc18], 0
je 0x4631c3
dec dword [0x4afc14]
mov eax, dword [0x4afc18]
test eax, eax
sete dl
and edx, 1
mov byte [ebp - 0x1451], dl
mov word [ebp - 0x1438], 0x14
test eax, eax
je 0x4632ae
mov eax, esi
call fcn.00460138
xor edx, edx
mov dword [0x4afc18], edx
jmp 0x4632b5
mov eax, esi
call fcn.00460438
test bl, bl
je 0x4632c4
push dword [0x4ad5b4]
call sub.USER32.DLL_DestroyWindow
mov al, byte [ebp - 0x1451]
mov edx, 2
push eax
lea eax, [ebp - 0x1424]
dec dword [ebp - 0x142c]
call fcn.00411414
pop eax
mov edx, dword [ebp - 0x1448]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10