joyce8/EMBER2024-capa huggingface dataset:
Function at 0x475628
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4f4de0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esi + 0x13c], edi
mov eax, dword [0x4cd7a4]
mov dword [ebp - 0xc], eax
mov eax, dword [0x4cd7a8]
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x140]
cmp dword [eax - 0xc], edi
jge 0x47566a
push 0x80070057
call fcn.00404ce0
mov ax, word [eax]
mov word [ebp - 0xc], ax
push dword [ebp - 0xc]
call fcn.00491d33
pop ecx
cmp eax, 1
je 0x475689
mov dword [esi + 0x13c], 2
lea ebx, [esi + 0x148]
mov eax, dword [ebx]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x18], eax
cmp dword [esi + 0x13c], edi
jne 0x4756e8
lea eax, [ebp - 0x14]
push eax
lea eax, [esi + 0x150]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x4756dc
mov ecx, esi
call fcn.004735c9
cmp dword [ebx + 4], edi
ja 0x4756dc
jb 0x4756d2
cmp dword [ebx], 0x11e1a300
ja 0x4756dc
mov dword [esi + 0x13c], 1
cmp dword [esi + 0x13c], edi
je 0x475779
cmp dword [ebp + 8], edi
je 0x475773
push edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, dword [esi + 0x13c]
cmp eax, 2
jne 0x47570d
push str.ERROR_NOUDISK
jmp 0x475717
cmp eax, 1
jne 0x475754
push str.ERROR_NODISKSPACE
lea eax, [ebp - 0x10]
mov edi, 0x4fa998
push eax
mov ecx, edi
call fcn.00473572
mov eax, dword [eax]
push 0
push 0
push eax
push 0x4cd754
mov ecx, edi
call fcn.0047351b
push eax
push dword [0x4fb2ac]
call fcn.004753f6
mov ecx, dword [ebp - 0x10]
add esp, 0x14
add ecx, 0xfffffff0
call fcn.00404d30
push 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, dword [ebp - 0x1c]
mov dword [ebx], eax
mov eax, dword [ebp - 0x18]
mov ecx, esi
mov dword [ebx + 4], eax
call fcn.004735c9
jmp 0x475779
mov dword [esi + 0x13c], edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00497941
leave
ret 4

Function at 0x475cf8
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
cmp ax, word [ebp + 8]
jne 0x475d0d
cmp ax, word [ebp + 0xc]
jne 0x475d0d
mov al, 1
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx ecx, ax
mov ax, cx
shr ax, 0xa
cmp word [ebp + 8], 0
movzx edx, ax
mov al, 1
je 0x475d37
and ecx, 0x3ff
cmp cx, word [ebp + 8]
je 0x475d37
xor al, al
cmp word [ebp + 0xc], 0
je 0x475d46
cmp dx, word [ebp + 0xc]
je 0x475d46
xor al, al
pop ebp
ret
Function at 0x476118
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, 0x4fc0d8
push esi
mov ecx, ebx
call fcn.00418850
push esi
lea ecx, [ebp + 8]
call fcn.00418850
mov esi, 0x105
push esi
lea ecx, [ebp + 8]
call fcn.00404b90
mov edi, eax
test edi, edi
je 0x4761a0
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x4761a0
xor eax, eax
push 0xffffffffffffffff
lea ecx, [ebp + 8]
mov word [edi + 0x208], ax
call fcn.00404c40
push esi
mov ecx, ebx
call fcn.00404b90
mov esi, eax
test esi, esi
je 0x4761a0
push esi
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x476197
xor eax, eax
mov word [esi + 0x208], ax
push 0xffffffffffffffff
mov ecx, ebx
call fcn.00404c40
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00404d30
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret
Function at 0x478bb4
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x4f4de0]
xor eax, ebp
mov dword [ebp + 0x9c], eax
push ebx
push 0x118
xor ebx, ebx
lea eax, [ebp - 0x7c]
push ebx
push eax
call fcn.00497680
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x7c], 5
jne 0x478c15
cmp dword [ebp - 0x78], 2
jne 0x478c15
call fcn.00418ce0
test al, al
je 0x478c15
cmp byte [ebp + 0x9a], 1
jne 0x478c15
mov bl, 1
mov ecx, dword [ebp + 0x9c]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.00497941
add ebp, 0xa0
leave
ret

Function at 0x478c5d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [esp + 4], 0
jne 0x478c67
xor al, al
ret
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x478c64
shr eax, 4
and al, 1
ret

Function at 0x478c7c
Capabilities:
Delete file
Move file

Disassembly:
push 4
push 0
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
ret

Function at 0x478e70
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push ebp
lea ebp, [esp - 0x38c]
sub esp, 0x40c
mov eax, dword [0x4f4de0]
xor eax, ebp
mov dword [ebp + 0x388], eax
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
xor eax, eax
push edi
push eax
push eax
mov dword [ebp - 0x7c], eax
call esi
mov edi, eax
shl eax, 2
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
push ebx
push edi
call esi
xor edi, edi
mov dword [ebp - 0x80], eax
test eax, eax
jbe 0x478ef1
mov esi, 0x200
movzx eax, word [ebx + edi*4]
cmp eax, 0x42a
jne 0x478ece
or dword [ebp - 0x7c], 1
push esi
lea ecx, [ebp - 0x78]
push ecx
push 2
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push esi
lea eax, [ebp - 0x78]
push 0
push eax
call fcn.00497680
add esp, 0xc
inc edi
cmp edi, dword [ebp - 0x80]
jb 0x478ebf
test ebx, ebx
je 0x478efc
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp + 0x388]
mov eax, dword [ebp - 0x7c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00497941
add ebp, 0x38c
leave
ret
Function at 0x479066
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push edi
cmp ebx, esi
je 0x4791e2
cmp dword [ebp + 0xc], esi
je 0x4791e2
mov edi, dword [ebp + 0x10]
cmp edi, esi
je 0x4791e2
cmp dword [ebp + 0x14], esi
je 0x4791e2
cmp dword [ebp + 0xc], 2
jbe 0x479136
mov dword [ebp - 8], 4
mov al, byte [ebx]
inc ebx
mov cl, byte [ebx]
sub dword [ebp + 0xc], 3
inc ebx
mov dl, byte [ebx]
inc ebx
mov dword [ebp + 8], ebx
mov bl, al
shr bl, 2
mov byte [ebp - 4], bl
mov bl, cl
and al, 3
shr bl, 4
shl al, 4
add al, bl
and cl, 0xf
mov bl, dl
shr bl, 6
shl cl, 2
add cl, bl
mov ebx, dword [ebp - 8]
and dl, 0x3f
mov byte [ebp - 1], dl
cmp ebx, dword [ebp + 0x14]
ja 0x479198
movzx edx, byte [ebp - 4]
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + edi], dl
inc esi
movzx eax, al
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + edi], al
inc ebx
inc esi
movzx eax, cl
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + edi], al
movzx eax, byte [ebp - 1]
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ebx
inc esi
inc ebx
mov byte [esi + edi], al
inc esi
inc ebx
cmp dword [ebp + 0xc], 2
mov dword [ebp - 8], ebx
mov ebx, dword [ebp + 8]
ja 0x4790a9
cmp dword [ebp + 0xc], 0
je 0x4791d5
xor al, al
xor cl, cl
cmp dword [ebp + 0xc], 0
mov byte [ebp + 0xa], 0
mov byte [ebp + 9], al
mov byte [ebp + 8], cl
jbe 0x47916a
push dword [ebp + 0xc]
lea eax, [ebp + 8]
push ebx
push eax
call fcn.00497950
mov al, byte [ebp + 9]
mov cl, byte [ebp + 8]
add esp, 0xc
mov bl, cl
mov dl, al
and cl, 3
shr dl, 4
shl cl, 4
add cl, dl
mov dl, byte [ebp + 0xa]
and al, 0xf
shr dl, 6
shl al, 2
add al, dl
lea edx, [esi + 4]
shr bl, 2
cmp edx, dword [ebp + 0x14]
jbe 0x47919d
mov eax, 0xffffffff
jmp 0x4791e4
or eax, 0xffffffff
jmp 0x4791e4
movzx edx, bl
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + edi], dl
movzx ecx, cl
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc esi
mov byte [esi + edi], cl
inc esi
cmp dword [ebp + 0xc], 1
jne 0x4791c3
mov byte [esi + edi], 0x3d
jmp 0x4791cf
movzx eax, al
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + edi], al
inc esi
mov byte [esi + edi], 0x3d
inc esi
cmp esi, dword [ebp + 0x14]
jae 0x479191
mov byte [esi + edi], 0
mov eax, esi
jmp 0x4791e4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4796c6
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 4]
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [esi + 0xc]
or ecx, 2
push ecx
push 0
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x47970f
push dword [esi + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
mov esi, eax
neg esi
sbb esi, esi
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x479711
xor eax, eax
pop esi
leave
ret

Function at 0x479948
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov ebx, ecx
test esi, esi
jne 0x479959
push 0xd
pop eax
jmp 0x479986
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x47995c
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
ret 8

Function at 0x479e7a
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x19c]
sub esp, 0x21c
mov eax, dword [0x4f4de0]
xor eax, ebp
mov dword [ebp + 0x198], eax
mov eax, dword [ebp + 0x1a4]
push ebx
push esi
mov esi, ecx
mov ecx, dword [esi + 4]
push edi
or ecx, 0x2001f
push ecx
push eax
push dword [esi]
xor edi, edi
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x6c], edi
call fcn.0040b7e0
mov ebx, eax
cmp ebx, edi
je 0x479eea
lea ecx, [ebp - 0x70]
call fcn.0040b7b0
mov eax, ebx
mov ecx, dword [ebp + 0x198]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00497941
add ebp, 0x19c
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x479f02
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x70]
call fcn.00479e7a
cmp eax, edi
jne 0x479f35
lea eax, [ebp - 0x80]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x68]
push eax
push edi
push dword [ebp - 0x70]
mov dword [ebp - 0x74], pe_nt_image_headers32
call ebx
test eax, eax
je 0x479ef2
lea ecx, [ebp - 0x70]
call fcn.0040b7b0
push dword [ebp - 0x78]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea ecx, [ebp - 0x70]
mov esi, eax
call fcn.0040b7b0
mov eax, esi
jmp 0x479ed0
Function at 0x47f8a8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x398]
sub esp, 0x418
mov eax, dword [0x4f4de0]
xor eax, ebp
mov dword [ebp + 0x394], eax
mov eax, dword [ebp + 0x3a0]
push ebx
mov ebx, dword [ebp + 0x3a8]
push esi
mov esi, dword [ebp + 0x3a4]
push edi
xor edi, edi
push 2
push edi
push eax
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x70], edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x74], eax
cmp eax, edi
jne 0x47f903
call fcn.0047986b
mov esi, eax
jmp 0x47f9c9
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, edi
jne 0x47f91c
call fcn.0047986b
jmp 0x47f9be
push esi
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
cmp ebx, edi
je 0x47f912
push esi
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
jae 0x47f978
lea eax, [ebp - 0x6c]
cmp dword [ebp - 0x70], eax
je 0x47f94f
lea ecx, [ebp - 0x70]
call fcn.00479e50
mov esi, 0x8007000e
lea ecx, [ebp - 0x78]
call fcn.00478f17
mov ecx, dword [ebp + 0x394]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00497941
add ebp, 0x398
leave
ret 0x10
push eax
lea ecx, [ebp - 0x70]
call fcn.0047a63d
cmp dword [ebp - 0x70], edi
jne 0x47f98d
mov esi, 0x8007000e
jmp 0x47f9c0
push esi
push dword [ebp - 0x70]
push esi
push ebx
push edi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, edi
je 0x47f912
mov edx, dword [ebp - 0x70]
push dword [ebp + 0x3ac]
xor ecx, ecx
mov word [edx + eax*2], cx
push dword [ebp - 0x70]
lea ecx, [ebp - 0x80]
call fcn.0047ba7b
mov esi, eax
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x6c]
cmp dword [ebp - 0x70], eax
je 0x47f954
lea ecx, [ebp - 0x70]
call fcn.00479e50
jmp 0x47f954
Function at 0x481011
Capabilities:
Identify system language via api

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetACP]
push 0x10
mov ebx, eax
call fcn.0046dc3e
pop ecx
mov esi, eax
call fcn.00478e70
cmp esi, 0xfb
je 0x481000
cmp ebx, 0x4ea
je 0x481000
test al, 1
je 0x48100d
push 0x4d7a94
lea ecx, [edi + 0x78]
call fcn.00404670
pop edi
pop esi
pop ebx
ret
push ebx
push ebp
mov ebp, ecx
lea ebx, [ebp + 0x78]
mov eax, dword [ebx]
cmp dword [eax - 0xc], 0
je 0x48103d
push 0x4d7acc
mov ecx, ebx
call fcn.00409370
test eax, eax
jne 0x481104
mov ecx, ebp
pop ebp
pop ebx
jmp 0x480fd0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
push edi
call esi
mov ecx, 0x3ff
and ax, cx
movzx edi, ax
call esi
shr ax, 0xa
movzx ecx, ax
movzx eax, di
cmp eax, 0x1f
pop edi
pop esi
jg 0x4810c0
je 0x4810b9
cmp eax, 4
je 0x4810a1
cmp eax, 7
je 0x48109a
cmp eax, 0xa
je 0x481093
cmp eax, 0x11
je 0x48108c
cmp eax, 0x16
je 0x481085
cmp eax, 0x19
jmp 0x4810d7
push 0x4d7aa4
jmp 0x4810fd
push 0x4d7a8c
jmp 0x4810fd
push 0x4d7aac
jmp 0x4810fd
push 0x4d7ac4
jmp 0x4810fd
push 2
pop eax
cmp ax, cx
mov ecx, ebx
jne 0x4810b2
push str.zh_CN
jmp 0x4810ff
push str.zh_TW
jmp 0x4810ff
push 0x4d7ab4
jmp 0x4810fd
sub eax, 0x2a
je 0x4810f8
sub eax, 0xf
je 0x4810f1
sub eax, 0xb
je 0x4810ea
sub eax, 0x29
je 0x4810ea
sub eax, 0x18
je 0x4810ea
push 0x4d7acc
mov ecx, ebx
call fcn.00404670
jmp 0x481034
push 0x4d7abc
jmp 0x4810fd
push 0x4d7a9c
jmp 0x4810fd
push 0x4d7a94
mov ecx, ebx
call fcn.00404670
pop ebp
pop ebx
ret
Function at 0x4814c9
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x1a4]
sub esp, 0x224
mov eax, dword [0x4f4de0]
xor eax, ebp
mov dword [ebp + 0x1a0], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x6c]
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
push eax
call fcn.00419380
pop ecx
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.004067a0
mov ecx, dword [ebp - 0x6c]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.00404d30
push 0x104
lea eax, [ebp - 0x68]
push eax
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x4815d3
push 0x4fc0d8
lea ecx, [ebp - 0x6c]
call fcn.00418850
lea eax, [ebp - 0x6c]
push eax
push edi
push ecx
lea eax, [ebp - 0x68]
mov ecx, esp
push eax
call fcn.00404050
push ecx
lea eax, [ebp - 0x70]
mov ecx, esp
push eax
call fcn.00404530
mov esi, SysReAllocStringLen
push esi
lea ecx, [ebp - 0x80]
call fcn.0040b9b0
push eax
call fcn.0040be00
pop ecx
pop ecx
lea ecx, [ebp - 0x80]
mov ebx, eax
call fcn.0040c410
cmp ebx, edi
je 0x4815c8
push edi
push ecx
lea eax, [ebp - 0x68]
mov ecx, esp
push eax
call fcn.00404050
push ecx
lea eax, [ebp - 0x70]
mov ecx, esp
push eax
call fcn.00404530
push esi
lea ecx, [ebp - 0x80]
call fcn.0040b9b0
push eax
call fcn.004796c6
pop ecx
lea ecx, [ebp - 0x80]
mov esi, eax
call fcn.0040c410
cmp esi, edi
je 0x4815c8
push 5
push edi
push edi
lea eax, [ebp - 0x68]
push eax
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0x6c]
add ecx, 0xfffffff0
call fcn.00404d30
mov ecx, dword [ebp - 0x70]
add ecx, 0xfffffff0
call fcn.00404d30
mov ecx, dword [ebp + 0x1a0]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00497941
add ebp, 0x1a4
leave
ret

Function at 0x481a82
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 0x28]
push eax
xor eax, eax
push eax
push esi
push 0x481107
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x24], eax
xor eax, eax
inc eax
pop esi
ret
Function at 0x482710
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
mov dword [ebp - 0x1c], ecx
cmp eax, ebx
jne 0x482734
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
cmp eax, ebx
jne 0x482734
xor al, al
jmp 0x482855
lea ecx, [ebp - 0xc]
push ecx
push eax
mov dword [ebp - 0xc], ebx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x10], eax
cmp eax, ebx
je 0x48272d
cmp dword [ebp - 0xc], ebx
jle 0x48284a
push esi
push edi
mov edi, 0x4fc0d8
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + ebx*4]
cmp word [eax], 0x2f
jne 0x48283e
add eax, 2
push eax
lea ecx, [ebp + 8]
call fcn.00404050
push edi
lea ecx, [ebp - 8]
call fcn.00418850
push edi
lea ecx, [ebp - 4]
call fcn.00418850
push 0
push dword [ebp + 0xc]
lea ecx, [ebp + 8]
call fcn.004206e0
mov esi, eax
cmp esi, 0xffffffff
je 0x4827e2
lea eax, [esi + 1]
push eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp + 8]
call fcn.0047bdb2
push eax
lea ecx, [ebp - 4]
call fcn.00404570
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00404d30
push esi
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp + 8]
call fcn.004187d0
push eax
lea ecx, [ebp - 8]
call fcn.00404570
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00404d30
jmp 0x4827ee
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 8]
call fcn.00404570
push 0x22
push 0x22
lea ecx, [ebp - 4]
call fcn.0047bba2
mov ecx, eax
call fcn.0047fe71
lea ecx, [ebp - 8]
call fcn.004050f0
mov ecx, dword [ebp - 0x1c]
push eax
call fcn.00426e70
lea ecx, [ebp - 4]
push ecx
mov ecx, eax
call fcn.00404570
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.00404d30
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
call fcn.00404d30
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00404d30
inc ebx
cmp ebx, dword [ebp - 0xc]
jl 0x482759
pop edi
pop esi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov al, 1
pop ebx
leave
ret 8
Function at 0x483774
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
push 0
push 0x4cd860
mov esi, ecx
push str.default
lea eax, [ebp - 0x18]
lea ecx, [esi + 0x3c]
push eax
call fcn.0047752f
lea ecx, [ebp - 0x38]
call fcn.00473420
push 0x4cd85c
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x18]
call fcn.00477327
xor eax, eax
lea edi, [ebp - 0x10]
add esp, 0xc
stosb byte es:[edi], al
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x28]
lea ecx, [ebp - 0x20]
call fcn.004155d0
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xc]
call fcn.004155d0
push dword [ebp - 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 8]
push dword [ebp - 0xc]
call fcn.00483553
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x2c]
add esp, 0x14
push 0x1c
cdq
pop ecx
idiv ecx
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
lea ebx, [esi + 0x78]
push ebx
mov ecx, esi
movzx edi, ax
call fcn.00483712
mov byte [esi + 0x9b], al
test al, al
je 0x48388b
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x28]
lea ecx, [ebp - 0x20]
call fcn.004155d0
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xc]
call fcn.004155d0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp - 0x20]
push dword [ebp - 0x20]
push dword [ebp - 8]
push dword [ebp - 0xc]
push eax
call fcn.0047f856
add esp, 0x18
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x28]
lea ecx, [ebp - 0x14]
call fcn.004155d0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x14]
call fcn.0047065d
test al, al
jne 0x483933
push ebx
lea ecx, [esi + 0x20]
call fcn.004105d0
jmp 0x483933
and dword [ebp - 4], 0
cmp dword [ebp - 0x10], 0
jle 0x483933
movzx eax, di
mov dword [ebp - 0x1c], eax
push dword [ebp - 4]
lea ecx, [ebp - 0x38]
call fcn.0048ed4f
cmp dword [eax + 0x18], 8
jb 0x4838b5
mov eax, dword [eax + 4]
jmp 0x4838b8
add eax, 4
push eax
lea ecx, [ebp - 8]
call fcn.00404050
lea eax, [ebp - 8]
push eax
lea ecx, [esi + 0x20]
call fcn.004105d0
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
call fcn.00404d30
mov edi, dword [ebp - 4]
push edi
lea ecx, [ebp - 0x38]
call fcn.0048ed4f
cmp dword [eax + 0x18], 8
jb 0x4838ef
mov eax, dword [eax + 4]
jmp 0x4838f2
add eax, 4
push 0
push str.lang_code
push eax
lea ecx, [esi + 0x3c]
call fcn.004835d6
cmp dword [ebp - 0x1c], eax
jne 0x483926
push edi
lea ecx, [ebp - 0x38]
call fcn.0048ed4f
cmp dword [eax + 0x18], 8
jb 0x48391b
mov eax, dword [eax + 4]
jmp 0x48391e
add eax, 4
push eax
mov ecx, ebx
call fcn.00404670
inc edi
cmp edi, dword [ebp - 0x10]
mov dword [ebp - 4], edi
jl 0x48389f
mov ecx, esi
call fcn.00481011
lea ecx, [esi + 0x20]
mov eax, dword [ecx + 0x10]
sub eax, dword [ecx + 0xc]
test eax, 0xfffffffc
jne 0x483950
push ebx
call fcn.004105d0
lea ecx, [ebp - 0x38]
call fcn.00476e23
push dword [ebp - 0x38]
call fcn.00493cb0
pop ecx
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00404d30
pop edi
pop esi
mov al, 1
pop ebx
leave
ret
Function at 0x485180
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push edi
mov dword [ebp - 0xc], ecx
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push str.PendingFileRenameOperations
mov ebx, str.SYSTEMCurrentControlSetControlSession_Manager
push ebx
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
call esi
test eax, eax
je 0x4851be
xor al, al
jmp 0x485215
cmp dword [ebp - 8], 7
jne 0x4851ba
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4851cf
mov al, 1
jmp 0x485215
push 0x4fc148
xor ecx, ecx
push 2
shr eax, 1
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004994d7
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
test eax, eax
je 0x4851ba
mov edx, dword [ebp - 4]
shr edx, 1
mov dword [ecx + 4], edx
lea ecx, [ebp - 4]
push ecx
push eax
lea eax, [ebp - 8]
push eax
push str.PendingFileRenameOperations
push ebx
push edi
call esi
neg eax
sbb al, al
inc al
pop edi
pop esi
pop ebx
leave
ret

Function at 0x48521a
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4f4de0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
je 0x4852ea
push 0x104
push esi
call fcn.00498625
add eax, 0xfffffffc
pop ecx
pop ecx
cmp eax, 0xff
ja 0x4852ea
mov eax, dword [0x4cd7a4]
mov dword [ebp - 0xc], eax
mov eax, dword [0x4cd7a8]
mov dword [ebp - 8], eax
mov ax, word [esi]
mov word [ebp - 0xc], ax
push dword [ebp - 0xc]
call fcn.00491d33
pop ecx
cmp eax, 1
je 0x48527d
push 0x70
jmp 0x4852ec
push edi
xor eax, eax
mov dword [ebp - 0x14], ebx
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
mov dword [ebp - 0x24], ebx
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
mov dword [ebp - 0x1c], ebx
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
pop edi
test eax, eax
je 0x4852c4
cmp dword [ebp - 0x10], ebx
ja 0x4852c4
jb 0x4852c0
cmp dword [ebp - 0x14], 0x11e1a300
ja 0x4852c4
push 0x6f
jmp 0x4852ec
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x4852e6
push esi
call fcn.0048abd3
pop ecx
test al, al
je 0x4852e6
xor eax, eax
jmp 0x4852ed
push 0x6c
jmp 0x4852ec
push 0x65
pop eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00497941
leave
ret