joyce8/EMBER2024-capa huggingface dataset:
Function at 0x478bbc
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd3c
cmp ecx, 0x4e
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
jne 0x478c9f
mov edx, eax
mov ecx, dword [edx + 8]
sub ecx, 0xfffffcdb
je 0x478beb
sub ecx, 5
je 0x478c05
jmp 0x478c9b
cmp dword [eax + 0x118], 2
jne 0x478bfe
mov eax, 0x4b9dec
call fcn.004785e8
xor eax, eax
jmp 0x478caa
mov ebx, eax
mov esi, dword [ebx + 0xc]
mov eax, dword [ebx + 0x2c]
cmp dword [eax], 4
jne 0x478c17
mov edi, dword [eax + 4]
jmp 0x478c1a
lea edi, [eax + 8]
cmp dword [eax], 4
jne 0x478c26
mov eax, 8
jmp 0x478c28
xor eax, eax
test esi, 1
mov dword [ebp - 4], eax
je 0x478c5e
mov edx, dword [ebp - 4]
lea ecx, [ebp - 0x164]
or edx, 0x200
push edx
push 0x160
push ecx
push 0
push edi
call sub.SHELL32.DLL_SHGetFileInfoA
test eax, eax
je 0x478c5e
lea eax, [ebp - 0x158]
mov dword [ebx + 0x14], eax
test esi, 6
je 0x478c90
mov edx, dword [ebp - 4]
lea ecx, [ebp - 0x2c4]
or edx, 0x4001
push edx
push 0x160
push ecx
push 0
push edi
call sub.SHELL32.DLL_SHGetFileInfoA
mov eax, dword [ebp - 0x2c0]
mov dword [ebx + 0x20], eax
mov dword [ebx + 0x1c], eax
or dword [ebx + 0xc], 0x10000000
xor eax, eax
jmp 0x478caa
xor eax, eax
jmp 0x478caa
push eax
push dword [ebp + 0xc]
push ecx
push edx
call sub.USER32.DLL_DefWindowProcA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x478dd4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov byte [ebp - 1], cl
push dword [ebp + 8]
mov ebx, edx
call sub.USER32.DLL_GetSysColor
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x478e06
mov edx, ebx
shl edx, 3
sub edx, ebx
mov ecx, dword [edx*8 + 0x4a1ba0]
jmp 0x478e14
mov eax, ebx
shl eax, 3
sub eax, ebx
mov ecx, dword [eax*8 + 0x4a1ba4]
cmp byte [ebp - 1], 0
mov ebx, ecx
jne 0x478e53
push 2
push ebx
push dword [0x4a7028]
call sub.KERNEL32.DLL_FindResourceA
push eax
push dword [0x4a7028]
call sub.KERNEL32.DLL_LoadResource
test eax, eax
jne 0x478e41
mov edx, 4
jmp 0x478e45
movzx edx, word [eax + 0xe]
mov eax, edx
cmp eax, 8
je 0x478e53
mov dword [ebp - 0xc], 0x800080
push 1
lea eax, [ebp - 0xc]
push eax
push 0
push ebx
push dword [0x4a7028]
call sub.COMCTL32.DLL_CreateMappedBitmap
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x47a34c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff98
mov ebx, eax
lea edi, [esp + 8]
mov eax, dword [ebx + 4]
test eax, eax
je 0x47a36b
push eax
call sub.USER32.DLL_DestroyWindow
xor edx, edx
mov dword [ebx + 4], edx
mov edx, str.ViewSmall
mov eax, str.GeneralToolbar
mov ecx, 1
call fcn.00465b48
test eax, eax
je 0x47a4be
mov esi, 0x56000944
push 0
push dword [0x4a702c]
push 0xd
push dword [0x4b9890]
push 0
push 0
push 0
push 0
push esi
push 0
push str.ToolbarWindow32
push 0
call sub.USER32.DLL_CreateWindowExA
mov ebp, eax
mov dword [ebx + 4], ebp
push 0
push 0x14
push 0x41e
push ebp
call sub.USER32.DLL_SendMessageA
push 0x100010
push 0
push 0x41f
push dword [ebx + 4]
call sub.USER32.DLL_SendMessageA
push 0x100010
push 0
push 0x420
push dword [ebx + 4]
call sub.USER32.DLL_SendMessageA
push 0
mov edx, str.FolderUp.bmp
mov eax, 0x4ba0b8
mov ecx, 0xf
call fcn.0047d3c8
test eax, eax
jne 0x47a40c
mov eax, dword [ebx + 0x1c]
xor edx, edx
mov ecx, esp
mov dword [esp], edx
mov dword [esp + 4], eax
push ecx
push 1
push 0x413
push dword [ebx + 4]
call sub.USER32.DLL_SendMessageA
push 0x4a1ffc
push 1
push 0x414
push dword [ebx + 4]
call sub.USER32.DLL_SendMessageA
mov ecx, edi
mov edx, 2
mov eax, ebx
call fcn.0047a544
mov dword [edi], 0x38
mov dword [edi + 4], 0x173
cmp dword [edi + 8], 0
jne 0x47a460
or dword [edi + 8], 1
or dword [edi + 8], 4
mov eax, dword [ebx + 4]
xor edx, edx
mov dword [edi + 0x20], eax
mov dword [edi + 0x34], 2
mov dword [edi + 0x24], edx
push 0x12
call sub.USER32.DLL_GetSysColor
mov dword [edi + 0xc], eax
push 0xf
call sub.USER32.DLL_GetSysColor
mov dword [edi + 0x10], eax
cmp dword [edi + 0x2c], 0
jne 0x47a497
mov dword [edi + 0x2c], 0x28
mov eax, dword [0x4b9dec]
lea edx, [esp + 0x58]
push edx
push eax
call sub.USER32.DLL_GetClientRect
mov ecx, dword [esp + 0x64]
mov dword [edi + 0x28], ecx
push edi
push 0xffffffffffffffff
push 0x401
push dword [ebx + 8]
call sub.USER32.DLL_SendMessageA
add esp, 0x68
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x47d06c
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffd4
mov esi, edx
mov ebx, eax
cmp esi, 0xa6
jne 0x47d08c
mov eax, ebx
call fcn.0047da60
mov al, 1
jmp 0x47d193
cmp esi, 0xa7
jne 0x47d0b8
push 1
push 0x4a2374
push 0
mov eax, 0x4f7
call fcn.004116e8
push eax
push 0
push 0
call sub.SHELL32.DLL_ShellExecuteA
mov al, 1
jmp 0x47d193
mov eax, ebx
call fcn.0047cf30
mov edi, eax
cmp esi, 0xa8
jne 0x47d0e9
mov dword [ebx + 0x114], 0xffffffff
mov ecx, 0x4a2374
mov edx, str.ActivePath
mov eax, str.InterfaceThemes
call fcn.004657a8
jmp 0x47d165
cmp esi, 0x3e8
jl 0x47d0f9
cmp esi, 0x428
jl 0x47d100
xor eax, eax
jmp 0x47d193
push 0x2c
push 0
lea edx, [esp + 8]
push edx
call fcn.0048d768
add esp, 0xc
mov dword [esp], 0x2c
mov dword [esp + 4], 0x20
push esp
push 0
push esi
push edi
call sub.USER32.DLL_GetMenuItemInfoA
test eax, eax
jne 0x47d132
xor eax, eax
jmp 0x47d193
mov eax, dword [esp + 0x20]
cmp eax, dword [ebx + 0x10c]
jb 0x47d142
xor eax, eax
jmp 0x47d193
mov edx, eax
mov eax, str.InterfaceThemes
imul ecx, edx, 0x584
mov dword [ebx + 0x114], edx
mov edx, str.ActivePath
add ecx, dword [ebx + 0x108]
call fcn.004657a8
mov eax, dword [ebx + 0x518]
cmp eax, 0xffffffff
je 0x47d179
push 0
push eax
push edi
call sub.USER32.DLL_CheckMenuItem
push 8
push esi
push edi
call sub.USER32.DLL_CheckMenuItem
mov dword [ebx + 0x518], esi
xor edx, edx
mov eax, ebx
call fcn.0047d2a0
mov al, 1
add esp, 0x2c
pop edi
pop esi
pop ebx
ret
Function at 0x484866
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
add esp, 0xfffffff4
mov ebx, eax
mov eax, edx
call fcn.004849bc
push 0xc
push ebx
lea edx, [esp + 8]
push edx
call fcn.0048d6f8
add esp, 0xc
xor ebx, ebx
call fcn.00484934
xor byte [esp + ebx], al
mov al, byte [esp + ebx]
and eax, 0xff
call fcn.00484958
inc ebx
cmp ebx, 0xc
jl 0x484886
mov edx, dword [0x4c98a4]
xor eax, eax
mov al, byte [esp + 0xb]
test byte [edx + 0x28], 2
je 0x4848bf
movzx ecx, word [0x4d990a]
sar ecx, 8
jmp 0x4848cb
mov ecx, dword [0x4d9910]
shr ecx, 0x18
movzx ecx, cx
movzx eax, ax
cmp ecx, eax
je 0x4848d7
or eax, 0xffffffff
jmp 0x48492b
mov eax, dword [0x4d98b8]
cdq
cmp edx, dword [0x4c8d7c]
jne 0x4848f0
cmp eax, dword [0x4c8d78]
jbe 0x4848fc
jmp 0x4848f2
jle 0x4848fc
mov eax, dword [0x4c8d78]
mov ebx, eax
jmp 0x484904
mov eax, dword [0x4d98b8]
mov ebx, eax
mov esi, dword [0x4d98b4]
jmp 0x484920
call fcn.00484934
xor byte [esi], al
mov al, byte [esi]
and eax, 0xff
call fcn.00484958
inc esi
mov edx, ebx
add ebx, 0xffffffff
test edx, edx
jne 0x48490c
xor eax, eax
add esp, 0xc
pop esi
pop ebx
ret

Function at 0x484958
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov edx, dword [0x4d9bd0]
mov ecx, edx
xor ecx, eax
and ecx, 0xff
shr edx, 8
mov ecx, dword [ecx*4 + 0x4a8944]
xor ecx, edx
mov dword [0x4d9bd0], ecx
and ecx, 0xff
add dword [0x4d9bd4], ecx
imul edx, dword [0x4d9bd4], 0x8088405
inc edx
mov dword [0x4d9bd4], edx
shr edx, 0x18
mov ecx, dword [0x4d9bd8]
xor edx, ecx
and edx, 0xff
shr ecx, 8
mov edx, dword [edx*4 + 0x4a8944]
xor edx, ecx
mov dword [0x4d9bd8], edx
ret

Function at 0x484cd1
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov edx, 0x4d9c54
push ebx
mov ecx, dword [edx]
mov ebx, ecx
xor ebx, eax
and ebx, 0xff
shr ecx, 8
mov ebx, dword [ebx*4 + 0x4a8944]
xor ebx, ecx
mov dword [edx], ebx
and ebx, 0xff
add dword [edx + 4], ebx
imul ecx, dword [edx + 4], 0x8088405
inc ecx
mov dword [edx + 4], ecx
shr ecx, 0x18
mov ebx, dword [edx + 8]
xor ecx, ebx
and ecx, 0xff
shr ebx, 8
mov ecx, dword [ecx*4 + 0x4a8944]
xor ecx, ebx
mov dword [edx + 8], ecx
pop ebx
ret

Function at 0x484e34
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp byte [0x4b046c], 0
je 0x484e79
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 8]
imul esi, dword [ebp - 0xc]
test esi, esi
je 0x484e79
call fcn.00484cb0
mov edi, eax
xor eax, eax
mov al, byte [ebx]
call fcn.00484cd1
mov edx, edi
dec esi
xor dl, byte [ebx]
mov byte [ebx], dl
inc ebx
test esi, esi
jne 0x484e5d
push dword [ebp + 8]
push dword [ebp - 0xc]
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.0048fca8
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x484fc9
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, 0x4d9c78
mov edi, 0x4d9c70
xor ebx, ebx
mov dword [0x4d9c74], 2
jmp 0x485159
mov edx, dword [0x4a2b98]
mov eax, dword [esi]
xor ecx, ecx
mov cl, byte [edx + eax + 2]
mov edx, dword [edi]
shl edx, 5
xor ecx, edx
and ecx, 0x7fff
mov dword [edi], ecx
mov ecx, dword [0x4d9c60]
mov edx, dword [edi]
movzx ebp, word [ecx + edx*2]
and eax, 0x7fff
mov edx, dword [0x4a2b9c]
mov word [edx + eax*2], bp
mov eax, dword [0x4d9c60]
mov ecx, dword [edi]
mov dx, word [esi]
mov word [eax + ecx*2], dx
test ebp, ebp
je 0x485051
mov eax, dword [esi]
sub eax, ebp
cmp eax, 0x7efa
ja 0x485051
mov eax, ebp
call fcn.004853bc
mov ebx, eax
mov eax, dword [0x4d9c84]
cmp ebx, eax
jbe 0x485051
mov ebx, eax
cmp ebx, 3
jb 0x4850fb
mov edx, ebx
sub edx, 3
mov eax, dword [esi]
sub eax, dword [0x4d9c7c]
call fcn.00486fdc
sub dword [0x4d9c84], ebx
cmp ebx, dword [0x4d9c8c]
ja 0x4850cd
dec ebx
inc dword [esi]
mov ecx, dword [0x4a2b98]
mov edx, dword [esi]
movzx ecx, byte [ecx + edx + 2]
mov edx, dword [edi]
shl edx, 5
xor ecx, edx
and ecx, 0x7fff
mov dword [edi], ecx
mov ecx, dword [0x4d9c60]
mov edx, dword [edi]
movzx ebp, word [ecx + edx*2]
mov edx, dword [esi]
and edx, 0x7fff
mov ecx, dword [0x4a2b9c]
mov word [ecx + edx*2], bp
mov edx, dword [0x4d9c60]
mov ecx, dword [edi]
mov bp, word [esi]
mov word [edx + ecx*2], bp
dec ebx
jne 0x48507b
inc dword [esi]
jmp 0x485115
add dword [esi], ebx
xor ebx, ebx
mov ecx, dword [esi]
mov edx, dword [0x4a2b98]
movzx edx, byte [edx + ecx]
mov dword [edi], edx
mov ebp, dword [esi]
mov ecx, dword [0x4a2b98]
shl edx, 5
movzx ecx, byte [ecx + ebp + 1]
xor ecx, edx
and ecx, 0x7fff
mov dword [edi], ecx
jmp 0x485115
mov eax, dword [0x4a2b98]
mov edx, dword [esi]
movzx edx, byte [eax + edx]
xor eax, eax
call fcn.00486fdc
dec dword [0x4d9c84]
inc dword [esi]
test eax, eax
je 0x485148
mov edx, dword [esi]
sub edx, dword [0x4d9c68]
cmp dword [0x4d9c68], 0
jl 0x485137
mov eax, dword [0x4a2b98]
add eax, dword [0x4d9c68]
jmp 0x485139
xor eax, eax
xor ecx, ecx
call fcn.00486e00
mov edx, dword [esi]
mov dword [0x4d9c68], edx
cmp dword [0x4d9c84], 0x106
jae 0x485159
call fcn.00484e98
cmp dword [0x4d9c84], 0
jne 0x484fe8
mov edx, dword [esi]
sub edx, dword [0x4d9c68]
cmp dword [0x4d9c68], 0
jl 0x485184
mov eax, dword [0x4a2b98]
add eax, dword [0x4d9c68]
jmp 0x485186
xor eax, eax
mov ecx, 1
call fcn.00486e00
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x485198
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, edx
mov ebx, eax
mov esi, 0x4d9c70
cmp ebx, 1
jl 0x4851af
cmp ebx, 9
jle 0x4851b9
mov eax, 0x4a2bf0
call fcn.00488a88
xor edx, edx
mov dword [0x4d9c6c], edx
cmp dword [0x4d9c64], 0
jne 0x4851de
mov dword [0x4d9c6c], 1
mov dword [0x4d9c64], 0x10000
cmp dword [0x4a2b98], 0
jne 0x48521b
push 2
push 0x8000
call fcn.0048bec0
add esp, 8
mov edi, eax
mov dword [0x4a2b98], edi
test edi, edi
jne 0x48521b
mov eax, 0x4a69f4
call fcn.00429630
mov edx, 0x4a2bf0
mov eax, 4
call fcn.0048894c
cmp dword [0x4a2b9c], 0
jne 0x48527e
push 2
push 0x8000
call fcn.0048bec0
add esp, 8
mov dword [0x4a2b9c], eax
push 2
push 0x8000
call fcn.0048bec0
add esp, 8
mov dword [0x4d9c60], eax
cmp dword [0x4a2b9c], 0
je 0x48525e
cmp dword [0x4d9c60], 0
jne 0x48527e
mov eax, 0x1ff
call fcn.004116e8
push eax
call fcn.0044a224
pop ecx
mov edx, 0x4a2bf0
mov eax, 4
call fcn.0048894c
mov eax, dword [0x4d9c60]
mov word [eax + 0xfffe], 0
push 0xfffe
push 0
push eax
call fcn.0048d768
movzx edx, word [ebx*8 + 0x4a2ba2]
mov dword [0x4d9c8c], edx
add esp, 0xc
movzx ecx, word [ebx*8 + 0x4a2ba0]
mov dword [0x4d9c90], ecx
cmp ebx, 2
movzx eax, word [ebx*8 + 0x4a2ba4]
mov dword [0x4d9c94], eax
movzx edx, word [ebx*8 + 0x4a2ba6]
mov dword [0x4d9c88], edx
jg 0x4852df
or word [ebp], 4
jmp 0x4852e9
cmp ebx, 8
jl 0x4852e9
or word [ebp], 2
xor ecx, ecx
xor eax, eax
mov dword [0x4d9c78], ecx
mov ebx, 0x8000
add ebx, ebx
mov dword [0x4d9c68], eax
mov eax, dword [0x4a2b98]
mov edx, ebx
call dword [0x4a2f80]
mov dword [0x4d9c84], eax
mov eax, dword [0x4d9c84]
test eax, eax
je 0x48531f
cmp eax, 0xffffffff
jne 0x485333
mov dword [0x4d9c80], 1
xor edx, edx
mov dword [0x4d9c84], edx
jmp 0x485371
xor ecx, ecx
mov dword [0x4d9c80], ecx
cmp dword [0x4d9c84], 0x106
jae 0x48534c
call fcn.00484e98
xor eax, eax
xor ebx, ebx
mov dword [esi], eax
mov edx, dword [0x4a2b98]
mov eax, dword [esi]
shl eax, 5
xor ecx, ecx
mov cl, byte [edx + ebx]
inc ebx
xor eax, ecx
and eax, 0x7fff
cmp ebx, 2
mov dword [esi], eax
jb 0x485352
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x48d124
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret

Function at 0x48e9d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x48e9ec
call fcn.00490134
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x48ea08
test bl, 1
je 0x48ea08
call fcn.00494218
mov dword [eax], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x48ebec
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.0048fcf0
test byte [ebp + 0xd], 0xc0
jne 0x48ec10
mov eax, dword [0x4a3b38]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x48ec1d
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x48ec4a
je 0x48ec5c
sub ecx, 0x100
je 0x48ec6a
sub ecx, 0x100
je 0x48ec71
sub ecx, 0x100
je 0x48ec63
jmp 0x48ec78
sub ecx, 0x600
je 0x48ec71
sub ecx, 0x100
je 0x48ec5c
jmp 0x48ec78
mov edi, 1
jmp 0x48ec7d
mov edi, 2
jmp 0x48ec7d
mov edi, 4
jmp 0x48ec7d
mov edi, 5
jmp 0x48ec7d
mov edi, 3
test byte [ebp + 0xd], 1
je 0x48eca4
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x4a35b0]
test al, 0x80
je 0x48ec9d
mov ebx, 0x80
jmp 0x48ecb6
mov ebx, 1
jmp 0x48ecb6
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x48ecb6
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x48ecc8
je 0x48ecd1
dec eax
je 0x48ecda
jmp 0x48ece3
mov dword [ebp - 4], CreateStatusWindowA
jmp 0x48ecf2
mov dword [ebp - 4], 0x40000000
jmp 0x48ecf2
mov dword [ebp - 4], 0xc0000000
jmp 0x48ecf2
push 1
call fcn.004900c8
pop ecx
mov ebx, eax
jmp 0x48ede2
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x48ed0e
sub eax, 0x10
je 0x48ed15
sub eax, 0x10
je 0x48ed1e
sub eax, 0x10
je 0x48ed27
jmp 0x48ed27
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x48ed2e
mov dword [ebp - 8], 1
jmp 0x48ed2e
mov dword [ebp - 8], 2
jmp 0x48ed2e
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x48ed9b
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x48ed90
test byte [ebp + 0xd], 1
je 0x48ed8b
mov ebx, 0x50
jmp 0x48ed90
mov ebx, 2
push ebx
call fcn.004900c8
pop ecx
mov ebx, eax
jmp 0x48ede2
mov edi, esi
push edi
call fcn.0048eb50
pop ecx
test eax, eax
je 0x48edaf
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x48edbb
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.0048fdf0
add esp, 8
mov ebx, eax
inc eax
jne 0x48ede2
push 4
call fcn.004900c8
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
call fcn.0048fd24
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48f2ec
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_SetCurrentDirectoryA
dec eax
je 0x48f308
call fcn.00490134
jmp 0x48f377
lea edx, [ebp - 0x108]
push edx
push 0x104
call sub.KERNEL32.DLL_GetCurrentDirectoryA
test eax, eax
jne 0x48f324
call fcn.00490134
jmp 0x48f377
cmp dword [0x4ddb98], 1
je 0x48f375
movsx ecx, byte [ebp - 0x108]
push ecx
call fcn.004940ec
pop ecx
cmp al, 0x41
jl 0x48f375
cmp al, 0x5a
jg 0x48f375
cmp byte [ebp - 0x107], 0x3a
jne 0x48f375
mov byte [ebp - 4], 0x3d
mov byte [ebp - 3], al
lea eax, [ebp - 0x108]
mov byte [ebp - 2], 0x3a
mov byte [ebp - 1], 0
push eax
lea edx, [ebp - 4]
push edx
call sub.KERNEL32.DLL_SetEnvironmentVariableA
dec eax
je 0x48f375
call fcn.00490134
jmp 0x48f377
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4941b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x494212
call fcn.00494160
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.0048d918
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.0048d918
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x494290
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x4a4a90], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x49436a
cmp dword [0x4a4a8c], 0
jne 0x49436a
cmp dword [0x4a4cb8], 0
je 0x494324
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.00494094
add esp, 8
mov ebx, eax
test eax, eax
jne 0x49430a
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.00494094
add esp, 8
mov ebx, eax
test eax, eax
jne 0x49430a
lea ebx, [ebp - 0x84]
jmp 0x49430b
inc ebx
call fcn.0049424c
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x4943a5
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x4a4a94
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.0048d918
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x4a4a97
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x4943a5
cmp dword [0x4a4a8c], 0
je 0x494384
cmp dword [0x4a4a8c], 0xffffffff
je 0x4943a5
push esi
call dword [0x4a4a8c]
pop ecx
mov eax, dword [0x4a4a90]
test eax, eax
je 0x4943a5
cmp dword [0x4a4a90], 0xffffffff
je 0x4943a5
cmp byte [eax], 0
je 0x4943a5
push esi
push eax
call fcn.004941b0
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x495b34
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x1c]
mov esi, dword [ebp + 0xc]
cmp esi, 0x10
jge 0x495b5a
test esi, esi
je 0x495b5a
call fcn.00494218
mov dword [eax], 0x13
or eax, 0xffffffff
jmp 0x495bcc
call fcn.0049584c
mov ebx, eax
test eax, eax
jne 0x495b75
call fcn.00494218
mov dword [eax], 8
or eax, 0xffffffff
jmp 0x495bcc
mov edx, dword [ebp + 0x10]
mov dword [ebx + 4], edx
lea edx, [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [ebx + 0x14], ecx
mov eax, dword [ebp + 0x20]
mov dword [ebx + 0x54], eax
push edx
mov ecx, dword [ebp + 0x18]
push ecx
push ebx
push 0x495a90
push esi
mov eax, dword [ebp + 0x14]
push eax
call sub.KERNEL32.DLL_CreateThread
test eax, eax
jne 0x495bc0
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x718
jne 0x495bb9
push 0x59
call fcn.004900c8
pop ecx
jmp 0x495bcc
call fcn.00490134
jmp 0x495bcc
mov dword [ebx + 8], eax
test edi, edi
je 0x495bcc
mov edx, dword [ebp - 4]
mov dword [edi], edx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x100055e0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x1005eb2b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.10053b48
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x10005662
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.10051a97
mov eax, dword [eax]
push 0x100721c0
push eax
call fcn.100449e4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.10053dd3
test bl, bl
je 0x10005662
push 0x100721c0
lea ecx, [esp + 0xc]
call fcn.10054163
push 0x10075d10
lea ecx, [esp + 0xc]
call fcn.10054163
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x1000569e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.10053dd3
jmp 0x10005769
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x10005722
lea edx, [esp + 0x7c]
push 0x10075d0c
push edx
call fcn.100449e4
add esp, 8
test eax, eax
je 0x10005722
lea eax, [esp + 0x7c]
push 0x10075d08
push eax
call fcn.100449e4
add esp, 8
test eax, eax
je 0x10005722
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x100056b2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.10053dd3
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x10005f60
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x10005fc2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc