joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4547ac
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x18]
call fcn.00403728
xor eax, eax
push ebp
push 0x454891
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp + 0x18], 0
jne 0x4547f3
lea edx, [ebp + 0x18]
mov eax, edi
call fcn.0042c870
cmp dword [ebp + 0x18], 0
jne 0x4547f3
lea eax, [ebp + 0x18]
call fcn.0042d890
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x3c
call fcn.00402934
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x540
test ebx, ebx
je 0x45481e
mov eax, ebx
call fcn.00403738
mov dword [ebp - 0x34], eax
mov eax, edi
call fcn.00403738
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
call fcn.00403738
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x18]
call fcn.00403738
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
push eax
call fcn.0042cc70
mov ebx, eax
neg ebx
sbb ebx, ebx
neg ebx
test bl, bl
jne 0x454862
call fcn.00405924
mov dword [esi], eax
jmp 0x45487b
mov dword [esi], 0x103
mov eax, dword [ebp - 8]
test eax, eax
je 0x45487b
push esi
mov ecx, dword [ebp + 0xc]
mov dl, byte [ebp + 0x14]
call fcn.00454498
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x454898
lea eax, [ebp + 0x18]
call fcn.00403400
ret

Function at 0x454a7c
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffec
mov ebx, eax
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
call fcn.004058bc
test eax, eax
je 0x454aaa
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x10
call fcn.0040355c
jmp 0x454ab1
mov eax, ebx
call fcn.00403400
add esp, 0x14
pop ebx
ret

Function at 0x454ab8
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
mov dword [esp], 0x101
push esp
lea eax, [esp + 8]
push eax
call fcn.00405774
test eax, eax
je 0x454ae9
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x101
call fcn.0040355c
jmp 0x454af0
mov eax, ebx
call fcn.00403400
add esp, 0x108
pop ebx
ret

Function at 0x454b00
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffec
cmp dword [0x4980dc], 2
jne 0x454b67
push esp
push 0x28
call fcn.004058cc
push eax
call fcn.00405784
test eax, eax
jne 0x454b22
xor eax, eax
jmp 0x454b76
lea eax, [esp + 8]
push eax
push 0x454b7c
push 0
call fcn.0040577c
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call fcn.00454af8
call fcn.00405924
test eax, eax
je 0x454b67
xor eax, eax
jmp 0x454b76
push 0
push 2
call fcn.00405ebc
neg eax
sbb eax, eax
neg eax
add esp, 0x14
ret
Function at 0x454b90
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x454bea
inc esi
xor edi, edi
cmp edi, 1
jne 0x454bb6
mov eax, dword [ebp + 0xc]
push eax
call fcn.00405ae4
jmp 0x454bc4
cmp edi, 1
jle 0x454bc4
mov eax, dword [ebp + 8]
push eax
call fcn.00405ae4
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00451f68
test eax, eax
jne 0x454bea
call fcn.00405924
cmp eax, 2
je 0x454bea
call fcn.00405924
cmp eax, 3
je 0x454bea
inc edi
dec esi
jne 0x454ba6
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x4552b8
Capabilities:
Delete registry value

Disassembly:
push ebx
push esi
push ecx
mov ebx, edx
mov esi, eax
push 0
push 2
lea eax, [esp + 8]
push eax
call fcn.0042db1c
and eax, 0x7f
mov ecx, dword [eax*4 + 0x498a50]
mov edx, 0x80000002
xor eax, eax
call fcn.0042dd44
test eax, eax
jne 0x455302
mov eax, esi
call fcn.00403738
push eax
mov eax, dword [esp + 4]
push eax
call fcn.004057ac
mov eax, dword [esp]
push eax
call fcn.00405794
mov eax, ebx
call fcn.00403738
push eax
call fcn.00405ce4
test eax, eax
je 0x455323
push 0
push 0
push 0x1d
push 0xffff
call fcn.0040614c
pop edx
pop esi
pop ebx
ret

Function at 0x455328
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov edi, ecx
mov esi, edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x455467
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x45547c
push 0x455490
call fcn.0040594c
push eax
call fcn.00405964
mov ebx, eax
lea edx, [ebp - 0xc]
mov al, byte [ebp - 1]
call fcn.00451d84
test al, al
jne 0x45537d
mov byte [ebp - 2], 0
jmp 0x45544c
xor eax, eax
push ebp
push 0x455445
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x4553c1
push 0
mov eax, dword [ebp + 8]
push eax
push edi
lea edx, [ebp - 0x24]
mov eax, esi
call fcn.0042c7d0
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.0042c40c
mov eax, dword [ebp - 0x20]
call fcn.00403738
push eax
call ebx
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 2], al
jmp 0x45542f
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x20]
mov eax, esi
call fcn.0042c7d0
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x24]
call fcn.0042c898
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.0042c40c
mov eax, dword [ebp - 0x20]
call fcn.00403738
push eax
call fcn.004058ec
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 2], al
cmp byte [ebp - 2], 0
je 0x45542f
mov ecx, edi
mov eax, dword [ebp - 0x14]
imul dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
call fcn.00430a50
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x14]
imul dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.00430a50
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45544c
lea eax, [ebp - 0xc]
call fcn.00451dc0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45546e
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00403420
ret
Function at 0x455610
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov byte [ebp - 1], dl
mov esi, eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 2], 0
test edi, edi
je 0x45565d
xor ebx, ebx
jmp 0x455652
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov eax, edi
call fcn.00406acc
test eax, eax
jne 0x455651
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 2
jmp 0x45570d
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x455633
mov al, byte [ebp - 1]
sub al, 1
jb 0x455668
je 0x455671
jmp 0x45567a
call fcn.0042e340
mov edi, eax
jmp 0x45567c
call fcn.004059a4
mov edi, eax
jmp 0x45567c
xor edi, edi
test di, di
je 0x45570d
xor ebx, ebx
jmp 0x4556b8
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
movzx edx, di
cmp eax, edx
jne 0x4556b7
mov eax, dword [ebp - 8]
cmp dword [eax + 0x2c], 0
je 0x4556ac
call fcn.004058ac
mov edx, dword [ebp - 8]
cmp eax, dword [edx + 0x2c]
jne 0x4556b7
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x45570d
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x455689
xor ebx, ebx
jmp 0x455702
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
and eax, 0x3ff
mov edx, edi
and dx, 0x3ff
movzx edx, dx
cmp eax, edx
jne 0x455701
mov eax, dword [ebp - 8]
cmp dword [eax + 0x2c], 0
je 0x4556f6
call fcn.004058ac
mov edx, dword [ebp - 8]
cmp eax, dword [edx + 0x2c]
jne 0x455701
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x45570d
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x4556c7
mov al, byte [ebp - 2]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x458254
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
add esp, 0xfffffff4
mov ebx, edx
mov esi, eax
cmp byte [esi + 4], 0
je 0x45832e
mov byte [esi + 5], 1
mov eax, dword [esi + 0x10]
mov dword [esp + 4], eax
mov byte [esp + 8], 0
lea edx, [esp + 4]
xor ecx, ecx
mov eax, 0x45833c
call fcn.00457204
mov eax, dword [esi + 0xc]
push eax
call fcn.004057e4
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4582ac
mov eax, 0x458370
call fcn.00456ff8
push 1
mov eax, dword [esi + 8]
push eax
call fcn.00405aec
push 0x2710
mov eax, dword [esi + 8]
push eax
call fcn.00405b1c
cmp eax, 0x102
je 0x458297
push esp
mov eax, dword [esi + 8]
push eax
call fcn.00405904
test eax, eax
je 0x4582ff
cmp dword [esp], 0
jne 0x4582e1
mov eax, 0x4583a0
call fcn.00456ff8
jmp 0x458309
mov eax, dword [esp]
mov dword [esp + 4], eax
mov byte [esp + 8], 0
lea edx, [esp + 4]
xor ecx, ecx
mov eax, 0x4583c0
call fcn.00457204
jmp 0x458309
mov eax, 0x4583f8
call fcn.00456ff8
mov eax, dword [esi + 8]
push eax
call fcn.004057e4
xor eax, eax
mov dword [esi + 8], eax
xor eax, eax
mov dword [esi + 0x10], eax
mov byte [esi + 4], 0
test bl, bl
je 0x45832e
push 0xfa
call fcn.00405ae4
add esp, 0xc
pop esi
pop ebx
ret
Function at 0x45842c
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45866e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
inc dword [eax + 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
mov ebx, dword [ebp - 4]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x24], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x28], ecx
xor eax, eax
lea ebx, [eax + 0xc]
add ebx, ecx
xor edx, edx
push ebp
push 0x45860b
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
push 1
push 0
call fcn.0040580c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4584a1
mov eax, 0x458688
call fcn.00452afc
xor edx, edx
push ebp
push 0x4585a0
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x14
call fcn.00402934
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 8]
push eax
push 0x14
mov eax, dword [ebp - 4]
add eax, 0x4034
push eax
push ebx
mov eax, dword [ebp - 4]
add eax, 0x20
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
call fcn.00405afc
test eax, eax
jne 0x458589
call fcn.00405924
cmp eax, 0x3e5
je 0x458509
mov eax, 0x45869c
call fcn.00452afc
xor edx, edx
push ebp
push 0x458572
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [ebp + 8], 0
je 0x458547
mov eax, dword [ebp - 4]
cmp word [eax + 0x1a], 0
je 0x458547
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x1c]
call dword [edx + 0x18]
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xc]
push eax
push 1
call fcn.004060a4
dec eax
je 0x458527
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x458579
push 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
call fcn.00405954
mov ebx, eax
call fcn.00405924
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4585a7
mov eax, dword [ebp - 0xc]
push eax
call fcn.004057e4
ret
Function at 0x45c3d0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
cmp dword [0x4980dc], 2
jne 0x45c3f9
call fcn.004059ac
and ax, 0xff
cmp ax, 5
jae 0x45c405
mov dword [ebp - 0xc], 1
jmp 0x45c649
push 0x45c658
call fcn.0040594c
mov esi, eax
push 0x45c668
push esi
call fcn.00405964
mov edi, eax
push 0x45c680
push esi
call fcn.00405964
mov dword [ebp - 0x10], eax
push 0x45c698
push esi
call fcn.00405964
mov dword [ebp - 0x14], eax
test edi, edi
je 0x45c44a
cmp dword [ebp - 0x10], 0
je 0x45c44a
cmp dword [ebp - 0x14], 0
jne 0x45c456
mov dword [ebp - 0xc], 0x7f
jmp 0x45c649
mov eax, ebx
call fcn.0045c2d8
mov dword [ebp - 0x18], eax
xor edx, edx
push ebp
push 0x45c642
push dword fs:[edx]
mov dword fs:[edx], esp
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x1c]
push eax
push 0
lea eax, [ebp - 0x20]
push eax
push 0
push 0
push 4
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x18]
push eax
call edi
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x45c4a0
call fcn.004031bc
jmp 0x45c649
xor edx, edx
push ebp
push 0x45c625
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp + 0xc]
shl eax, 5
call fcn.004069e4
mov dword [ebp - 0x28], eax
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 0xc]
dec edi
test edi, edi
jl 0x45c562
inc edi
xor ebx, ebx
lea eax, [ebp - 0x2c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi + 8]
push eax
mov al, byte [esi + 6]
push eax
push esi
call fcn.00405754
test eax, eax
jne 0x45c518
call fcn.00405924
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x45c509
mov dword [ebp - 0xc], 0x57
call fcn.004031bc
call fcn.004031bc
jmp 0x45c649
mov eax, ebx
shl eax, 2
mov edx, dword [ebp - 0x28]
mov ecx, dword [esi + 0x10]
mov dword [edx + eax*8], ecx
mov edx, dword [ebp - 0x28]
mov dword [edx + eax*8 + 4], 1
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp + 8]
mov dword [edx + eax*8 + 8], ecx
mov edx, dword [ebp - 0x28]
xor ecx, ecx
mov dword [edx + eax*8 + 0x14], ecx
mov edx, dword [ebp - 0x28]
xor ecx, ecx
mov dword [edx + eax*8 + 0x18], ecx
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov dword [edx + eax*8 + 0x1c], ecx
add esi, 0x14
inc ebx
dec edi
jne 0x45c4ce
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x28]
push eax
mov eax, dword [ebp + 0xc]
push eax
call dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x45c58d
call fcn.004031bc
call fcn.004031bc
jmp 0x45c649
xor eax, eax
push ebp
push 0x45c5cc
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0x24]
push eax
push 0
push 0
push 4
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x18]
push eax
call dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c5d3
mov eax, dword [ebp - 0x24]
push eax
call fcn.00405a34
ret
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x461f68
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x14c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46203c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea eax, [ebp - 0x148]
push eax
lea edx, [ebp - 0x14c]
mov eax, ebx
call fcn.0042c40c
lea eax, [ebp - 0x14c]
mov edx, 0x462058
call fcn.0040357c
mov eax, dword [ebp - 0x14c]
call fcn.00403738
push eax
call fcn.0040586c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x462023
xor eax, eax
push ebp
push 0x46201c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x148]
call fcn.00461f1c
test al, al
je 0x461ff1
mov byte [ebp - 1], 1
jmp 0x462005
lea eax, [ebp - 0x148]
push eax
mov eax, dword [ebp - 8]
push eax
call fcn.00405874
test eax, eax
jne 0x461fdc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462023
mov eax, dword [ebp - 8]
push eax
call fcn.00405864
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462043
lea eax, [ebp - 0x14c]
call fcn.00403400
ret

Function at 0x46205c
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffea0
mov ebx, edx
mov esi, eax
push 0x200
push 0x160
lea eax, [esp + 8]
push eax
push 0
mov eax, esi
call fcn.00403738
push eax
call fcn.0042cc60
test eax, eax
je 0x46209c
mov eax, ebx
lea edx, [esp + 0xc]
mov ecx, 0x104
call fcn.0040355c
jmp 0x4620a3
mov eax, ebx
call fcn.00403400
add esp, 0x160
pop esi
pop ebx
ret

Function at 0x4620ac
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffea0
mov ebx, edx
mov esi, eax
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x498b44]
or eax, 0x4001
push eax
push 0x160
lea eax, [esp + 8]
push eax
push 0
mov eax, esi
call fcn.00403738
push eax
call fcn.0042cc60
test eax, eax
je 0x4620ec
mov eax, dword [esp + 4]
jmp 0x4620ee
xor eax, eax
add esp, 0x160
pop esi
pop ebx
ret

Function at 0x4620f8
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffea0
mov ebx, eax
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x498b4c]
or eax, 0x4011
push eax
push 0x160
lea eax, [esp + 8]
push eax
push 0x10
push 0x46213c
call fcn.0042cc60
test eax, eax
je 0x462132
mov eax, dword [esp + 4]
jmp 0x462134
xor eax, eax
add esp, 0x160
pop ebx
ret

Function at 0x46211c
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffea0
mov ebx, eax
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x498b4c]
or eax, 0x4011
push eax
push 0x160
lea eax, [esp + 8]
push eax
push 0x10
push 0x46213c
call fcn.0042cc60
test eax, eax
je 0x462132
mov eax, dword [esp + 4]
jmp 0x462134
xor eax, eax
add esp, 0x160
pop ebx
ret
Function at 0x4624f0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
test dl, dl
je 0x462504
add esp, 0xfffffff0
call fcn.00402d30
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.0041595c
mov ax, word [0x4625a4]
not eax
and ax, word [esi + 0x34]
mov word [esi + 0x34], ax
mov edx, 0x79
mov eax, esi
call fcn.0041462c
mov edx, 0x61
mov eax, esi
call fcn.0041464c
xor edx, edx
mov eax, esi
call fcn.00414c60
mov dl, 1
mov eax, esi
call fcn.00418328
call fcn.004059ac
and ax, 0xff
cmp ax, 6
jae 0x462565
mov dx, 0xfffe
mov eax, esi
call fcn.00414c80
push 0
lea eax, [ebp - 0x3c]
push eax
push 0x3c
push 0x1f
call fcn.00406204
test eax, eax
je 0x46258b
lea eax, [ebp - 0x3c]
push eax
call fcn.00405bcc
mov edx, eax
mov eax, dword [esi + 0x44]
call fcn.0041a2e8
test bl, bl
je 0x462599
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46340c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4634d6
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0040593c
mov esi, eax
mov bl, 0x41
test esi, 1
jne 0x463447
mov eax, ebx
call fcn.0046214c
test al, al
je 0x4634af
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403510
lea eax, [ebp - 8]
mov edx, 0x4634ec
call fcn.0040357c
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.0046205c
mov eax, dword [ebp - 4]
push eax
push 0
lea eax, [ebp - 0xc]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x10]
call fcn.00402878
mov edx, 0x4634f0
lea eax, [ebp - 0x10]
mov cl, 2
call fcn.00402848
lea edx, [ebp - 0x10]
lea eax, [ebp - 8]
call fcn.00403520
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
xor edx, edx
call fcn.00462f74
shr esi, 1
inc ebx
cmp bl, 0x5b
jne 0x463434
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4634dd
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403420
ret
Function at 0x4634f4
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x154], ecx
mov dword [ebp - 0x158], ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4636b1
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call fcn.00405aac
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x463684
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00403574
cmp eax, 3
jne 0x463580
mov eax, ebx
call fcn.0046234c
test al, al
jne 0x463560
mov byte [ebp - 1], 0
call fcn.004031bc
jmp 0x46368b
lea edx, [ebp - 0x154]
mov eax, ebx
call fcn.0046205c
mov ecx, dword [ebp - 0x154]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, esi
call fcn.004638ec
mov byte [ebp - 1], 1
lea eax, [ebp - 0x150]
push eax
lea edx, [ebp - 0x154]
mov eax, ebx
call fcn.0042c40c
lea eax, [ebp - 0x154]
mov edx, 0x4636cc
call fcn.0040357c
mov eax, dword [ebp - 0x154]
call fcn.00403738
push eax
call fcn.0040586c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x46366d
xor eax, eax
push ebp
push 0x463666
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x150]
call fcn.00461f1c
test al, al
je 0x46363b
lea eax, [ebp - 0x10]
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.0040355c
lea edx, [ebp - 0x158]
mov eax, ebx
call fcn.0042c40c
lea eax, [ebp - 0x158]
mov edx, dword [ebp - 0x10]
call fcn.0040357c
mov eax, dword [ebp - 0x158]
lea edx, [ebp - 0x154]
call fcn.0046205c
mov eax, dword [ebp - 0x154]
push eax
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 0x10]
mov edx, esi
call fcn.00462f74
lea eax, [ebp - 0x150]
push eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.00405874
test eax, eax
jne 0x4635d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46366d
mov eax, dword [ebp - 0xc]
push eax
call fcn.00405864
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46368b
mov eax, dword [ebp - 8]
push eax
call fcn.00405aac
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4636b8
lea eax, [ebp - 0x158]
mov edx, 2
call fcn.00403420
lea eax, [ebp - 0x10]
call fcn.00403400
ret
Function at 0x463970
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x154], ebx
mov dword [ebp - 0x158], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x463b57
push dword fs:[eax]
mov dword fs:[eax], esp
test edi, edi
je 0x4639e3
lea edx, [ebp - 0x154]
mov eax, edi
call fcn.0042c920
mov eax, dword [ebp - 0x154]
push eax
lea edx, [ebp - 0x158]
mov eax, ebx
call fcn.0042c40c
mov eax, dword [ebp - 0x158]
pop edx
call fcn.0042c5d4
test eax, eax
jne 0x4639e3
lea edx, [ebp - 4]
mov eax, edi
call fcn.0042c8f8
push 1
call fcn.00405aac
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x463b22
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x150]
push eax
lea edx, [ebp - 0x154]
mov eax, ebx
call fcn.0042c40c
lea eax, [ebp - 0x154]
mov edx, 0x463b70
call fcn.0040357c
mov eax, dword [ebp - 0x154]
call fcn.00403738
push eax
call fcn.0040586c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x463b0b
xor eax, eax
push ebp
push 0x463b04
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x150]
call fcn.00461f1c
test al, al
je 0x463ad5
lea eax, [ebp - 0x10]
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.0040355c
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.0042c5d4
test eax, eax
je 0x463ad5
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 0x10]
mov edx, esi
call fcn.0046305c
test eax, eax
jne 0x463ad5
lea edx, [ebp - 0x158]
mov eax, ebx
call fcn.0042c40c
lea eax, [ebp - 0x158]
mov edx, dword [ebp - 0x10]
call fcn.0040357c
mov eax, dword [ebp - 0x158]
lea edx, [ebp - 0x154]
call fcn.0046205c
mov eax, dword [ebp - 0x154]
push eax
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 0x10]
mov edx, esi
call fcn.00462f74
lea eax, [ebp - 0x150]
push eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.00405874
test eax, eax
jne 0x463a4b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463b0b
mov eax, dword [ebp - 0xc]
push eax
call fcn.00405864
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463b29
mov eax, dword [ebp - 8]
push eax
call fcn.00405aac
ret