joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47d554
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47d62c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4b6f58], 0
jne 0x47d610
lea eax, [ebp - 4]
mov edx, 0x47d644
call fcn.004045f0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404a08
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x47d610
mov eax, ebx
call fcn.0040274c
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x47d609
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x47d5f3
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x47d654
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x47d5f3
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x4b6f58], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47d610
mov eax, dword [ebp - 0xc]
call fcn.0040276c
ret
mov ebx, dword [0x4b6f58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47d633
lea eax, [ebp - 4]
call fcn.00404558
ret

Function at 0x48971c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov bl, byte [0x489754]
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x489732
or bl, 1
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x489741
or bl, 4
push 0x12
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x489750
or bl, 2
mov eax, ebx
pop ebx
ret

Function at 0x48aa64
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x4b5c6c]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x48aa8a
push 0
mov eax, dword [0x4b5c6c]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
ret
Function at 0x48be30
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48c090
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x48be93
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.0048bad8
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040cddc
cmp al, 1
jne 0x48be93
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.0048bda0
test al, al
je 0x48c01f
cmp dword [ebp - 8], 0
jge 0x48beb1
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.0048bad8
mov eax, dword [ebp - 0x210]
call fcn.00404810
cmp ebx, eax
jge 0x48befb
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.0048bad8
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x4b5ec8]
and eax, 0xff
bt dword [edx], eax
jae 0x48befb
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x48bf0f
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0048be0c
cmp ebx, dword [ebp - 8]
je 0x48c011
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x48bf3b
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403920
and eax, 0x7f
movzx eax, word [eax*2 + 0x4b5110]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x48bffe
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403920
and eax, 0x7f
movzx eax, word [eax*2 + 0x4b5110]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.0044396c
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403920
and eax, 0x7f
movzx eax, word [eax*2 + 0x4b5110]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.0044396c
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c005
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x48c072
cmp dword [ebp - 8], 0
jge 0x48c02a
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.0048bad8
mov eax, dword [ebp - 0x218]
call fcn.00404810
cmp eax, dword [ebp - 8]
jg 0x48c064
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.0048bad8
mov eax, dword [ebp - 0x21c]
call fcn.00404810
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0048be0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c097
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.0040457c
ret
Function at 0x49dbc8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x49dc7f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.00404a08
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jne 0x49dc0a
call fcn.00403f9c
jmp 0x49dc86
mov eax, ebx
call fcn.0040274c
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push ebx
push 0
mov eax, esi
call fcn.00404a08
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
jne 0x49dc33
call fcn.00403f9c
jmp 0x49dc86
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x49dc90
mov eax, dword [ebp - 8]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
jne 0x49dc54
call fcn.00403f9c
jmp 0x49dc86
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
mov dword [edi], eax
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49dc86
mov eax, dword [ebp - 8]
call fcn.0040276c
ret
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49dedc
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x49df44
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x164]
xor ecx, ecx
mov edx, 0x160
call fcn.00403030
test ebx, ebx
jne 0x49df19
mov word [ebp - 2], 0
lea ebx, [ebp - 2]
or esi, 0x4008
push esi
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
push ebx
call sub.shell32.dll_SHGetFileInfoA
mov ebx, dword [ebp - 0x160]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49df50
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49e234
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
push 0x49e3e0
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x49e3d8
xor eax, eax
push ebp
push 0x49e3d1
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebp - 6], 0
push 0x4001
push 0x160
lea eax, [ebp - 0x168]
push eax
push 0
push 0x49e3ec
call sub.shell32.dll_SHGetFileInfoA
mov esi, eax
test esi, esi
jne 0x49e2ac
push 0x4009
push 0x160
lea eax, [ebp - 0x168]
push eax
push 0
lea eax, [ebp - 6]
push eax
call sub.shell32.dll_SHGetFileInfoA
mov esi, eax
push 0x4000
push 0x160
lea eax, [ebp - 0x168]
push eax
push 0
push 0x49e3ec
call sub.shell32.dll_SHGetFileInfoA
mov edi, eax
test edi, edi
jne 0x49e2ed
push 0x4008
push 0x160
lea eax, [ebp - 0x168]
push eax
push 0
lea eax, [ebp - 6]
push eax
call sub.shell32.dll_SHGetFileInfoA
mov edi, eax
push 0x8000
push 0x10
push 0x10
push 1
push 0x1d
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_LoadImageA
mov ebx, eax
push 1
mov edx, ebx
mov eax, esi
call fcn.0042e654
push eax
push esi
call sub.comctl32.dll_ImageList_SetOverlayImage
push ebx
call sub.user32.dll_DestroyIcon
push 0x8000
push 0x20
push 0x20
push 1
push 0x1d
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_LoadImageA
mov ebx, eax
push 1
mov edx, ebx
mov eax, edi
call fcn.0042e654
push eax
push edi
call sub.comctl32.dll_ImageList_SetOverlayImage
push ebx
call sub.user32.dll_DestroyIcon
push 0x8000
push 0x10
push 0x10
push 1
push 0x1e
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_LoadImageA
mov ebx, eax
push 2
mov edx, ebx
mov eax, esi
call fcn.0042e654
push eax
push esi
call sub.comctl32.dll_ImageList_SetOverlayImage
push ebx
call sub.user32.dll_DestroyIcon
push 0x8000
push 0x20
push 0x20
push 1
push 0x1e
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_LoadImageA
mov ebx, eax
push 2
mov edx, ebx
mov eax, edi
call fcn.0042e654
push eax
push edi
call sub.comctl32.dll_ImageList_SetOverlayImage
push ebx
call sub.user32.dll_DestroyIcon
mov byte [0x4b56c0], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49e3d8
cmp dword [ebp - 4], 0
je 0x49e3d0
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49e3f0
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffe9c
mov ebx, eax
call fcn.0049dbbc
test al, al
je 0x49e41d
cmp dword [0x4b7110], 0x40047
jl 0x49e41d
cmp byte [0x4b56c0], 0
jne 0x49e41d
call fcn.0049e234
mov esi, ebx
and esi, 0x7f
mov eax, dword [esi*4 + 0x4b56c4]
or eax, 0x4000
push eax
push 0x160
lea eax, [esp + 0xc]
push eax
push 0
push 0x49e480
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
jne 0x49e475
mov word [esp], 0
mov eax, dword [esi*4 + 0x4b56c4]
or eax, 0x4000
or eax, 8
push eax
push 0x160
lea eax, [esp + 0xc]
push eax
push 0
lea eax, [esp + 0x10]
push eax
call sub.shell32.dll_SHGetFileInfoA
add esp, 0x164
pop esi
pop ebx
ret
Function at 0x4a63f0
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffea0
mov ebx, ecx
mov esi, eax
test edx, 0x40000000
jne 0x4a6412
mov edx, ebx
mov eax, dword [0x4b5d20]
call fcn.00406908
jmp 0x4a6449
push 0x408
push 0x160
lea eax, [esp + 8]
push eax
push 0
push esi
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x4a6442
mov eax, ebx
lea edx, [esp + 0x110]
mov ecx, 0x50
call fcn.004047c0
jmp 0x4a6449
mov eax, ebx
call fcn.00404558
add esp, 0x160
pop esi
pop ebx
ret

Function at 0x4a6dcc
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x164], ebx
mov dword [ebp - 0x15c], ebx
mov dword [ebp - 0x160], ebx
mov dword [ebp - 0x158], ebx
mov ebx, ecx
test ebx, ebx
js 0x4a6dff
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x4a6df8
mov edx, esp
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004049f8
mov ecx, dword [ebp - 0xc]
inc ecx
mov eax, dword [ebp - 8]
mov edx, dword [0x4010a4]
call fcn.004051ac
xor eax, eax
push ebp
push 0x4a6f8d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
test eax, eax
jl 0x4a6f55
inc eax
mov dword [ebp - 0x14], eax
mov esi, dword [ebp - 8]
lea eax, [ebp - 0x154]
push eax
push dword [ebp - 4]
push 0x4a6fb4
push dword [esi]
lea eax, [ebp - 0x158]
mov edx, 3
call fcn.004048d0
mov eax, dword [ebp - 0x158]
call fcn.00404a08
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4a6f49
mov eax, dword [ebp - 0x154]
test al, 0x10
jne 0x4a6f2e
test al, 2
jne 0x4a6f2e
xor eax, eax
mov dword [ebp - 0x10], eax
push dword [ebp - 4]
push 0x4a6fb4
lea eax, [ebp - 0x160]
lea edx, [ebp - 0x128]
mov ecx, 0x104
call fcn.004047c0
push dword [ebp - 0x160]
lea eax, [ebp - 0x15c]
mov edx, 3
call fcn.004048d0
mov eax, dword [ebp - 0x15c]
lea edx, [ebp - 0x10]
call fcn.0049dd40
call fcn.00418550
test al, al
je 0x4a6eec
or edi, 0xffffffff
jmp 0x4a6efb
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.0049dedc
mov edi, eax
mov eax, dword [ebp - 0x10]
call fcn.0049dca4
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x128]
mov ecx, 0x104
call fcn.004047c0
mov edx, dword [ebp - 0x164]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax]
mov ecx, edi
mov edi, dword [eax]
call dword [edi + 0x3c]
lea eax, [ebp - 0x154]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x4a6e81
push ebx
call sub.kernel32.dll_FindClose_1
add esi, 4
dec dword [ebp - 0x14]
jne 0x4a6e44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a6f94
lea eax, [ebp - 0x164]
mov edx, 4
call fcn.0040457c
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
inc ecx
mov edx, dword [0x4010a4]
call fcn.00405084
lea eax, [ebp - 4]
call fcn.00404558
ret
Function at 0x4a808c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a8123
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x700f0037
mov eax, dword [0x4b5c50]
cmp dword [eax + 4], 0x60000
jl 0x4a80c4
or dword [ebp - 4], 0x400000
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004a81b8
mov eax, dword [ebp - 8]
call fcn.004a5fa8
test al, al
je 0x4a80f4
mov eax, dword [ebp - 8]
call fcn.00404a08
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
jne 0x4a80f4
and dword [ebp - 4], 0xfffbffff
lea eax, [ebp - 4]
push eax
lea eax, [ebx + 0xc]
push eax
push 1
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x418]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a812a
lea eax, [ebp - 8]
call fcn.00404558
ret

Function at 0x4abb98
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, eax
mov eax, ebx
call fcn.00404a08
push eax
call sub.kernel32.dll_GetDriveTypeA
sub eax, 3
je 0x4abbd9
dec eax
je 0x4abbbb
sub eax, 2
je 0x4abbd9
jmp 0x4abbea
mov al, byte [ebx]
call fcn.0049f514
test al, al
je 0x4abbea
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, ebx
mov si, 0xffa1
call fcn.00403920
jmp 0x4abbea
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, ebx
mov si, 0xffa1
call fcn.00403920
pop esi
pop ebx
pop ebp
ret

Function at 0x4abbf0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4abc9f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x3f8], 0
jne 0x4abc3e
push 0x465
mov eax, dword [ebp - 4]
call fcn.0044396c
mov ecx, eax
mov dl, 1
mov eax, dword [0x4a8354]
call fcn.004a83c0
mov edx, dword [ebp - 4]
mov dword [edx + 0x3f8], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3f8]
call fcn.004a8888
lea eax, [ebp - 8]
mov edx, 0x4abcb4
call fcn.004045f0
call sub.kernel32.dll_GetLogicalDrives
mov ebx, eax
xor esi, esi
test ebx, ebx
je 0x4abc89
test bl, 1
je 0x4abc82
lea eax, [ebp - 8]
call fcn.00404a60
lea edx, [esi + 0x41]
mov byte [eax], dl
push ebp
mov eax, dword [ebp - 8]
call fcn.004abb98
pop ecx
shr ebx, 1
inc esi
test ebx, ebx
jne 0x4abc66
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4abca6
lea eax, [ebp - 8]
call fcn.00404558
ret
Function at 0x4ac708
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x150], ecx
mov dword [ebp - 0x154], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.004049f8
xor eax, eax
push ebp
push 0x4ac826
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4ac7f9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
or eax, 1
push eax
call sub.kernel32.dll_SetErrorMode
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 4]
call fcn.00404a08
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4ac7d6
test byte [ebp - 0x14c], 0x10
jne 0x4ac7b9
lea eax, [ebp - 0x154]
lea edx, [ebp - 0x120]
mov ecx, 0x104
call fcn.004047c0
mov eax, dword [ebp - 0x154]
lea edx, [ebp - 0x150]
call fcn.00408a64
mov edx, dword [ebp - 0x150]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x14c]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x4ac77c
push ebx
call sub.kernel32.dll_FindClose_1
mov byte [ebp - 5], 1
jmp 0x4ac7e2
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
sete byte [ebp - 5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ac800
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x4b138c
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, eax
mov al, byte [ebx + 4]
sub al, 1
jb 0x4b139a
je 0x4b139f
jmp 0x4b13c4
mov eax, dword [ebx + 8]
pop ebx
ret
cmp dword [ebx + 8], 0
jne 0x4b13bf
lea eax, [ebx + 8]
push eax
xor eax, eax
mov al, byte [ebx + 0xc]
push eax
mov eax, dword [0x4b5c6c]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
mov eax, dword [ebx + 8]
pop ebx
ret
xor eax, eax
pop ebx
ret
Function at 0x1001376
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x28
push 0x10010b0
call fcn.01001514
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x10013b1
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10013b1
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x10013c9
cmp eax, 0x20b
je 0x10013b6
mov dword [ebp - 0x1c], edi
jmp 0x10013dd
cmp dword [ecx + 0x84], 0xe
jbe 0x10013b1
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x10013d7
cmp dword [ecx + 0x74], 0xe
jbe 0x10013b1
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x1002220], 0xffffffff
or dword [0x1002224], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x100221c]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1002218]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x1002228], eax
call fcn.0100150e
cmp dword [section..data], edi
jne 0x1001438
push fcn.0100150e
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.010014fc
push 0x1001088
push 0x1001084
call sub.msvcrt.dll__initterm
mov eax, dword [0x1002214]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x1002210]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x30], eax
push 0x1001080
push 0x100107c
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x24]
mov ecx, dword [sym.imp.msvcrt.dll___initenv]
mov dword [ecx], eax
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.010011e6
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x34], esi
cmp dword [ebp - 0x1c], edi
jne 0x10014af
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x10014e4
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0100154d
ret
Function at 0x4013a0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov ecx, dword [esp + 0xc]
mov dword [esi], 0x463264
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ecx
call fcn.0043e483
call fcn.0043e482
call fcn.0043ed33
mov edx, dword [esi + 0xc]
mov dword [esi + 0x20], eax
mov dword [eax + 0x28], edx
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x10]
push 0x1c
mov dword [eax + 0x2c], ecx
mov edx, dword [esi + 0x20]
mov eax, dword [esi + 0xc]
mov dword [edx + 0x294], eax
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x10]
mov dword [ecx + 0x298], edx
call fcn.0043e6dd
add esp, 4
mov dword [esi + 0x1c], eax
test eax, eax
jne 0x40141a
push str.codec_not_found_n
push 0x481a40
call fcn.0043165b
add esp, 8
push 1
call fcn.00431568
call fcn.0043e83a
mov dword [esi + 4], eax
mov eax, dword [esi + 0x1c]
test byte [eax + 0x20], 8
je 0x401435
mov eax, dword [esi + 0x20]
or dword [eax + 0xc], 0x10000
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0x20]
push ecx
push edx
call fcn.0043e746
add esp, 8
test eax, eax
jge 0x401462
push str.could_not_open_codec_n
push 0x481a40
call fcn.0043165b
add esp, 8
push 1
call fcn.00431568
mov eax, esi
pop esi
ret 8
Function at 0x405a90
Capabilities:
Create process on windows

Disassembly:
sub esp, 0xe0
push esi
push edi
xor dl, dl
mov ecx, 0x1f
xor eax, eax
lea edi, [esp + 0x69]
mov byte [esp + 0x68], dl
mov byte [esp + 8], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x17
xor eax, eax
lea edi, [esp + 9]
push 0x60
rep stosd dword es:[edi], eax
mov ecx, dword [0x484e44]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xc]
push eax
push 0x37
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
mov edi, str.Explorer.exe
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x68]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [esp + 8]
push ecx
call esi
push eax
lea edx, [esp + 0xc]
lea eax, [esp + 0x6c]
push edx
push eax
call esi
lea ecx, [esp + eax + 0x70]
push ecx
call fcn.00431d90
add esp, 0xc
lea edx, [esp + 0x68]
push 1
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
add esp, 0xe0
ret
Function at 0x415d30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x4688f8
push CreateStatusWindowA
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x415d87
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x415d87
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp + 8]
jne 0x415d87
xor eax, eax
inc eax
jmp 0x415d89
xor eax, eax
leave
ret 0x10

Function at 0x41665a
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push edi
lea eax, [ebp - 4]
push eax
push 0x4688f8
push CreateStatusWindowA
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x4166c8
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0x468958
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4166bf
cmp dword [ebp - 0xc], 4
jne 0x4166bf
cmp dword [ebp - 0x10], edi
je 0x4166bf
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x478c0c], edi
xor eax, eax
jmp 0x416707
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x478c0c], edi
jge 0x416702
lea eax, [ebp - 0x34]
push eax
mov dword [0x478c0c], edi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x34], di
jne 0x416702
cmp word [ebp - 0x14], 5
jb 0x416702
call fcn.00416635
test eax, eax
je 0x416702
emms
mov dword [0x478c0c], 1
mov eax, dword [0x478c0c]
pop edi
leave
ret