joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4117e7
Capabilities:
Write file on windows

Disassembly:
push 4
mov eax, 0x5b8a79
call fcn.00595e20
mov esi, ecx
mov eax, dword [esi + 0x24]
and dword [ebp - 0x10], 0
cmp eax, 0xffffffff
jne 0x41183e
push 1
push 0x42
push ecx
mov ecx, esp
mov dword [ebp + 0xc], esp
push str.CCoreStreamFile::Write
call fcn.004015a6
and dword [ebp - 4], 0
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
push str.Stream_is_not_open_
call fcn.004015a6
mov byte [ebp - 4], 1
mov eax, dword [esi]
push 1
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call dword [eax + 0xc]
xor eax, eax
jmp 0x4118a0
push 0
lea ecx, [ebp - 0x10]
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x411891
push 1
push 0x47
push ecx
mov ecx, esp
mov dword [ebp + 0xc], esp
push str.CCoreStreamFile::Write
call fcn.004015a6
mov dword [ebp - 4], 2
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
push str.WriteFile_failed_
call fcn.004015a6
mov byte [ebp - 4], 3
mov eax, dword [esi]
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call dword [eax + 0x14]
jmp 0x41183a
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x41189d
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
xor eax, eax
inc eax
call fcn.00595ef8
ret 0xc
Function at 0x417bd8
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x5cbceb
call fcn.00595e20
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
push 0x25
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
mov edi, str.CPing::Start
push edi
call fcn.004015a6
mov byte [ebp - 4], 1
mov byte [ebp - 4], bl
call fcn.0040b1a6
cmp dword [esi + 0x64], ebx
jne 0x417c6e
push 1
push 0x29
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push edi
call fcn.004015a6
mov byte [ebp - 4], 2
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Called_with_NULL_ConfigManager_
call fcn.004015a6
mov byte [ebp - 4], 3
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.pingnoconfig
call fcn.004015a6
mov byte [ebp - 4], 4
lea ecx, [esi + 0x6c]
mov eax, dword [ecx]
push 1
mov byte [ebp - 4], bl
call dword [eax + 8]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401752
xor eax, eax
call fcn.00595ef8
ret 4
cmp dword [esi + 0x68], ebx
jne 0x417cb1
push 1
push 0x2f
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push edi
call fcn.004015a6
mov byte [ebp - 4], 5
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Called_with_NULL_DetectionManager_
call fcn.004015a6
mov byte [ebp - 4], 6
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.pingnodetection
call fcn.004015a6
mov byte [ebp - 4], 7
jmp 0x417c4b
lea eax, [ebp + 8]
lea ecx, [esi + 0x21c]
push eax
call fcn.004048fa
cmp dword [esi + 0x214], ebx
mov dword [esi + 0x224], ebx
je 0x417d0f
push 1
push 0x3a
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push edi
call fcn.004015a6
mov byte [ebp - 4], 8
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Ping_download_thread_is_not_NULL_in_StartDownload_
call fcn.004015a6
mov byte [ebp - 4], 9
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.threadnotnull
call fcn.004015a6
mov byte [ebp - 4], 0xa
jmp 0x417c4b
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.Starting_ping_download...
call fcn.004015a6
mov byte [ebp - 4], 0xb
push 4
mov byte [ebp - 4], bl
call fcn.0040b216
push ebx
push 4
push ebx
push ebx
push esi
push 0x417ddf
call fcn.00570c4c
cmp eax, ebx
mov dword [esi + 0x214], eax
jne 0x417daa
push 1
push 0x46
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push edi
call fcn.004015a6
mov byte [ebp - 4], 0xc
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.AfxBeginThread_failed_
call fcn.004015a6
mov byte [ebp - 4], 0xd
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.beginthread
call fcn.004015a6
mov byte [ebp - 4], 0xe
add esi, 0x6c
mov edi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov byte [ebp - 4], bl
mov ecx, esi
call dword [edi + 8]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401752
mov eax, ebx
jmp 0x417c66
mov dword [eax + 0x28], ebx
mov esi, dword [esi + 0x214]
push dword [esi + 0x2c]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.__ping_download_thread_started.
call fcn.004015a6
mov byte [ebp - 4], 0xf
push 4
mov byte [ebp - 4], bl
call fcn.0040b216
xor ebx, ebx
inc ebx
jmp 0x417d97
Function at 0x432e22
Capabilities:
Create process on windows

Disassembly:
push 0x48
mov eax, 0x5c3ad1
call fcn.00595e20
xor ebx, ebx
mov dword [ebp - 4], ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.__Postback_using_Shell...
call fcn.004015a6
mov byte [ebp - 4], 1
push 2
mov byte [ebp - 4], bl
call fcn.0040b216
push ecx
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
mov dword [eax], 0x62cc74
mov dword [eax + 4], 1
mov byte [ebp - 4], 2
push ecx
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
call fcn.004049a2
mov byte [ebp - 4], 3
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], bl
mov ecx, dword [ebp + 0xc]
call fcn.00431541
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp + 8]
call fcn.004048fa
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x10]
call fcn.00401752
push str.ShellExecuteEx:
lea ecx, [ebp + 0xc]
call fcn.004015a6
mov byte [ebp - 4], 5
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
lea edx, [ebp + 8]
push edx
push eax
push ecx
call fcn.004045e6
add esp, 0xc
mov byte [ebp - 4], 6
push 4
mov byte [ebp - 4], 5
call fcn.0040b216
mov byte [ebp - 4], bl
lea ecx, [ebp + 0xc]
call fcn.00401752
push 0x3c
lea eax, [ebp - 0x54]
push ebx
push eax
call fcn.0058ee10
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], eax
add esp, 0xc
lea eax, [ebp - 0x54]
push eax
mov dword [ebp - 0x54], 0x3c
mov dword [ebp - 0x50], 0x440
mov dword [ebp - 0x48], str.open
mov dword [ebp - 0x38], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x432f85
push 1
push 0x226
push ecx
mov ecx, esp
mov dword [ebp + 0xc], esp
push str.CWebManager::PostbackShell
call fcn.004015a6
mov byte [ebp - 4], 7
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.ShellExecuteEx_failed_
call fcn.004015a6
mov byte [ebp - 4], 8
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.postshell
call fcn.004015a6
mov byte [ebp - 4], 9
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
mov byte [ebp - 4], bl
call dword [eax + 0x10]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401752
mov eax, ebx
call fcn.00595ef8
ret 0xc
cmp dword [ebp - 0x1c], ebx
je 0x432fa1
push 0xbb8
push dword [ebp - 0x1c]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
inc ebx
jmp 0x432f6f
Function at 0x43520c
Capabilities:
Inspect section memory permissions

Disassembly:
push 0x5c
mov eax, 0x5b7d5c
call fcn.00595e20
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
xor edi, edi
mov ebx, str.DxPresent
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], 1
mov dword [ebp - 0x60], str.DxVersionSatisfy
mov dword [ebp - 0x5c], 2
mov dword [ebp - 0x58], str.DxUseHardware
mov dword [ebp - 0x54], 4
mov dword [ebp - 0x50], str.DxMaxTextureHeight
mov dword [ebp - 0x4c], 8
mov dword [ebp - 0x48], str.DxMaxTextureWidth
mov dword [ebp - 0x44], 0x10
mov dword [ebp - 0x40], str.DxMaxNumBlendingStages
mov dword [ebp - 0x3c], 0x20
mov dword [ebp - 0x38], str.Stencil16
mov dword [ebp - 0x34], 0x20000000
mov dword [ebp - 0x30], str.Stencil32
mov dword [ebp - 0x2c], 0x40000000
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x18], edi
call fcn.0043481b
mov dword [ebp - 4], edi
lea eax, [ebp - 0x18]
push eax
mov esi, 0x61d500
push esi
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x14]
call fcn.0040dd0a
mov byte [ebp - 4], 1
jmp 0x43537f
and dword [ebp - 0x10], 0
mov eax, ebx
push eax
push dword [ebp + 0xc]
call fcn.0058d09d
test eax, eax
pop ecx
pop ecx
je 0x43534e
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*8 - 0x68]
test eax, eax
jne 0x4352c8
push 1
push 0x120
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.CRequirements::ParseExecuteResult
call fcn.004015a6
mov byte [ebp - 4], 2
push ecx
mov eax, esp
mov dword [ebp - 0x18], esp
push str.Invalid_flag_in_ExecuteResult:
push eax
lea ecx, [ebp + 0xc]
call fcn.004046a1
pop ecx
pop ecx
mov byte [ebp - 4], 3
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
add eax, 0xc
push 1
mov byte [ebp - 4], 1
call dword [eax]
xor edi, edi
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.00401752
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00401752
mov eax, edi
call fcn.00595ef8
ret 8
mov eax, dword [ebp - 0x10]
or edi, dword [ebp + eax*8 - 0x64]
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x14]
call fcn.0040dd0a
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp + 0xc]
call fcn.004048fa
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.00401752
mov eax, dword [ebp + 0xc]
cmp dword [eax - 0xc], 0
jne 0x4352c2
jmp 0x43532c
Function at 0x4355a6
Capabilities:
Persist via run registry key

Disassembly:
push 0x34
mov eax, 0x5bb858
call fcn.00595e20
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
call fcn.004015a6
and dword [ebp - 4], 0
push SysReAllocString
lea eax, [ebp - 0x40]
push eax
or dword [ebp - 4], 0xffffffff
call fcn.0047222e
mov dword [ebp - 4], 1
lea esi, [ebp - 0x14]
call fcn.0040d1ea
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10]
push 0x61b3bc
push ecx
mov ecx, eax
call fcn.004046a1
mov byte [ebp - 4], 3
add esp, 4
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.___runonce
push eax
push ecx
call fcn.0040463d
mov byte [ebp - 4], 4
add esp, 8
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.InstallIQ
call fcn.004015a6
mov byte [ebp - 4], 5
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x40]
call fcn.00472dee
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10]
call fcn.00401752
mov byte [ebp - 4], 1
mov ecx, esi
call fcn.00401752
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.004722dd
call fcn.00595ef8
ret
Function at 0x449ea4
Capabilities:
Persist via run registry key

Disassembly:
push 0x10
mov eax, 0x5c11f8
call fcn.00595e20
mov edi, dword [ebp + 8]
and dword [ebp - 4], 0
and dword [ebp - 0x10], 0
mov ecx, edi
call fcn.004048be
and dword [ebp - 4], 0
push edi
push ecx
xor esi, esi
mov ecx, esp
mov dword [ebp - 0x14], esp
inc esi
push 0x625710
mov dword [ebp - 0x10], esi
call fcn.004015a6
mov dword [ebp - 4], esi
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
call fcn.004015a6
mov byte [ebp - 4], 2
push SysReAllocString
mov byte [ebp - 4], 0
call fcn.004728d1
add esp, 0x10
test eax, eax
jne 0x449f1a
push str._windows_Desktop
mov ecx, edi
call fcn.004014d3
call fcn.00471607
mov eax, edi
call fcn.00595ef8
ret 4
Function at 0x45e2f2
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x6c0bc0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x94
lea eax, [ebp - 0x98]
push 0
push eax
call fcn.0058ee10
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x94], 6
mov ecx, dword [ebp - 4]
sbb eax, eax
xor ecx, ebp
inc eax
call fcn.0058cc82
leave
ret

Function at 0x465019
Capabilities:
Get file size

Disassembly:
push 0
mov eax, 0x5b9709
call fcn.00595e20
xor edi, edi
mov dword [ebp - 4], edi
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, edi
jne 0x46505d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401752
mov eax, edi
call fcn.00595ef8
ret
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x465049

Function at 0x4666ff
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5be87e
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x6c0bc0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
lea ecx, [esp + 0xc]
call fcn.004afa26
and dword [esp + 0x28], 0
lea eax, [esp + 0xc]
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x44]
call fcn.004b0a09
lea ecx, [esp + 0xc]
call fcn.004afe17
push eax
lea ecx, [esp + 8]
call fcn.004015a6
mov byte [esp + 0x28], 1
push ecx
lea eax, [esp + 8]
mov ecx, esp
mov dword [esp + 0xc], esp
push eax
call fcn.004049a2
mov byte [esp + 0x2c], 2
push 1
mov byte [esp + 0x30], 1
call fcn.0040b216
mov byte [esp + 0x28], 0
lea ecx, [esp + 4]
call fcn.00401752
or dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0xc]
call fcn.004afb00
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x468590
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5b63b0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6c0bc0]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov ebx, 1
mov dword [esp + 0x2c], ebx
mov edi, dword [esp + 0x3c]
push 0
push ecx
mov esi, esp
add edi, 0xfffffff0
mov dword [esp + 0x20], esp
push edi
mov dword [esp + 0x28], esi
call fcn.00404947
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0x38], 3
mov esi, dword [esp + 0x44]
mov ebp, esp
add esi, 0xfffffff0
mov dword [esp + 0x28], esp
push esi
mov dword [esp + 0x30], ebp
call fcn.00404947
add eax, 0x10
add esp, 4
mov dword [ebp], eax
mov byte [esp + 0x38], 5
mov eax, dword [esp + 0x40]
push eax
mov byte [esp + 0x3c], bl
call fcn.004af42d
mov ebx, eax
mov byte [esp + 0x2c], 0
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x468637
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov dword [esp + 0x2c], 0xffffffff
lea eax, [edi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x468658
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
mov eax, ebx
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0xc
Function at 0x46faa8
Capabilities:
Read file on windows

Disassembly:
push 8
mov eax, 0x5b32e8
call fcn.00595e20
xor ebx, ebx
mov dword [ebp - 4], ebx
mov ecx, dword [ebp + 0xc]
push 0xffffffffffffffff
push ebx
mov dword [ebp - 0x10], ebx
call fcn.0056ecd9
push 0x634488
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.0058fd6d
add esp, 0xc
cmp dword [ebp - 0x10], ebx
je 0x46fbaf
push 2
push ebx
push dword [ebp - 0x10]
call fcn.0058fe44
push dword [ebp - 0x10]
call fcn.00595aea
push ebx
push ebx
push dword [ebp - 0x10]
mov esi, eax
inc esi
call fcn.0058fe44
push 1
push esi
call fcn.0058dca7
add esp, 0x24
push dword [ebp - 0x10]
mov edi, eax
cmp edi, ebx
je 0x46fba6
lea ebx, [esi - 1]
push ebx
push 1
push edi
call fcn.00595e05
add esp, 0x10
cmp eax, ebx
je 0x46fb59
push edi
call fcn.0058dafb
push dword [ebp - 0x10]
call fcn.005900a3
and dword [ebp - 0x10], 0
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401752
xor eax, eax
call fcn.00595ef8
ret 8
push dword [ebp - 0x10]
call fcn.005900a3
xor ebx, ebx
pop ecx
xor ecx, ecx
cmp esi, ebx
mov byte [edi + esi - 1], 0
mov dword [ebp - 0x10], ebx
jle 0x46fb85
mov al, byte [ecx + edi]
cmp al, 0xd
je 0x46fb7d
cmp al, 0xa
jne 0x46fb80
mov byte [ecx + edi], bl
inc ecx
cmp ecx, esi
jl 0x46fb72
xor edx, edx
test esi, esi
jle 0x46fbfd
cmp byte [ebx + edi], 0
jne 0x46fbf8
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + 8]
add edx, edi
push edx
push eax
call fcn.0056f018
and dword [ebp - 0x14], 0
jmp 0x46fbf1
call fcn.005900a3
mov dword [ebp - 0x10], ebx
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401752
mov eax, ebx
jmp 0x46fb51
cmp byte [ebx + edi], 0
jne 0x46fbf5
inc ebx
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
and eax, 0x80000001
jns 0x46fbd8
dec eax
or eax, 0xfffffffe
inc eax
jne 0x46fbf1
cmp dword [ebp - 0x14], 2
jle 0x46fbf1
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + 8]
push 0x61b5f4
push eax
call fcn.0056f018
cmp ebx, esi
jl 0x46fbbf
mov edx, ebx
dec ebx
inc ebx
cmp ebx, esi
jl 0x46fb8b
push edi
call fcn.0058dafb
xor ebx, ebx
inc ebx
jmp 0x46fbae
Function at 0x46fc08
Capabilities:
Write file on windows

Disassembly:
push 0x10
mov eax, 0x5b5f93
call fcn.00595e20
mov esi, ecx
xor edi, edi
mov dword [ebp - 4], edi
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x10], edi
call fcn.004048be
mov byte [ebp - 4], 1
push 0xa
push 0xd
lea eax, [ebp - 0x18]
push str._c_c
push eax
call fcn.004048ab
push 0x634494
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.0058fd6d
add esp, 0x1c
cmp dword [ebp - 0x10], edi
je 0x46fd22
cmp dword [esi + 8], edi
mov dword [ebp - 0x14], edi
jle 0x46fcc6
mov eax, dword [ebp - 0x14]
mov ecx, esi
call fcn.0047145b
mov eax, dword [eax]
mov edi, dword [eax - 0xc]
mov eax, dword [ebp - 0x14]
mov ecx, esi
call fcn.0047145b
mov ebx, dword [eax]
mov eax, dword [ebp - 0x14]
mov ecx, esi
call fcn.0047145b
push dword [ebp - 0x10]
mov eax, dword [eax]
mov eax, dword [eax - 0xc]
push edi
push 1
push ebx
mov dword [ebp - 0x1c], eax
call fcn.005958af
add esp, 0x10
cmp eax, dword [ebp - 0x1c]
push dword [ebp - 0x10]
jne 0x46fccb
mov eax, dword [ebp - 0x18]
mov edi, dword [eax - 0xc]
push edi
push 1
push eax
call fcn.005958af
add esp, 0x10
cmp eax, edi
jne 0x46fcf7
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [esi + 8]
jl 0x46fc61
xor esi, esi
inc esi
jmp 0x46fcf9
call fcn.005900a3
and dword [ebp - 0x10], 0
pop ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00401752
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401752
xor eax, eax
call fcn.00595ef8
ret 4
xor esi, esi
push dword [ebp - 0x10]
call fcn.005900a3
and dword [ebp - 0x10], 0
pop ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00401752
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401752
mov eax, esi
jmp 0x46fcef
xor esi, esi
jmp 0x46fd06

Function at 0x46fd26
Capabilities:
Write file on windows

Disassembly:
push 4
mov eax, 0x5b32c5
call fcn.00595e20
and dword [ebp - 4], 0
and dword [ebp - 0x10], 0
push 0x634494
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.0058fd6d
xor esi, esi
add esp, 0xc
cmp dword [ebp - 0x10], esi
je 0x46fd7c
push dword [ebp - 0x10]
inc esi
push dword [ebp + 0x10]
push esi
push dword [ebp + 0xc]
call fcn.005958af
add esp, 0x10
cmp eax, dword [ebp + 0x10]
je 0x46fd6f
xor esi, esi
push dword [ebp - 0x10]
call fcn.005900a3
and dword [ebp - 0x10], 0
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401752
mov eax, esi
call fcn.00595ef8
ret 0xc
Function at 0x46fe09
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x258
lea ebp, [esp - 4]
mov eax, dword [0x6c0bc0]
xor eax, ebp
mov dword [ebp + 0x258], eax
push 8
mov eax, 0x5b4139
call fcn.00595e20
xor esi, esi
mov dword [ebp - 4], esi
mov ecx, edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], esi
call fcn.004048be
mov dword [ebp - 4], esi
push 0x61b5f4
mov ecx, edi
mov dword [ebp - 0x10], 1
call fcn.004014d3
lea eax, [ebp]
push eax
mov esi, 0x258
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x46fe80
push esi
lea eax, [ebp]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
lea eax, [ebp]
push eax
mov ecx, edi
call fcn.004014d3
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x258]
xor ecx, ebp
call fcn.0058cc82
add ebp, 0x25c
leave
ret

Function at 0x471470
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa0
mov eax, dword [0x6c0bc0]
xor eax, esp
mov dword [esp + 0x9c], eax
push 0x94
lea eax, [esp + 4]
push 0
push eax
call fcn.0058ee10
add esp, 0xc
lea eax, [esp]
push eax
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
xor eax, eax
cmp dword [esp + 0x10], 2
jne 0x471510
cmp dword [esp + 4], 6
jne 0x4714f3
cmp dword [esp + 8], 1
jne 0x4714dc
call fcn.004715a8
neg eax
sbb eax, eax
neg eax
add eax, 8
cmp dword [esp + 4], 6
jne 0x4714f3
cmp dword [esp + 8], 0
jne 0x47153e
call fcn.004715a8
neg eax
sbb eax, eax
neg eax
add eax, 6
jmp 0x47153e
cmp dword [esp + 4], 5
jne 0x47153e
cmp dword [esp + 8], 1
jne 0x471505
push 5
jmp 0x471532
cmp dword [esp + 8], 0
jne 0x47153e
push 4
jmp 0x471532
cmp dword [esp + 0x10], 1
jne 0x47153e
cmp dword [esp + 4], 4
jne 0x47153e
cmp dword [esp + 8], 0x5a
jne 0x471529
push 3
jmp 0x471532
cmp dword [esp + 8], 0xa
jne 0x471535
push 2
pop eax
jmp 0x47153e
cmp dword [esp + 8], eax
jne 0x47153e
xor eax, eax
inc eax
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.0058cc82
mov esp, ebp
pop ebp
ret
Function at 0x472714
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x5b3191
call fcn.00595e20
xor esi, esi
inc esi
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x14]
call fcn.004048be
mov byte [ebp - 4], 2
xor ebx, ebx
cmp dword [ebp + 8], ebx
jne 0x472764
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00401752
mov byte [ebp - 4], bl
lea ecx, [ebp + 0xc]
call fcn.00401752
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.00401752
xor eax, eax
call fcn.00595ef8
ret
push 0x61b5f4
lea ecx, [ebp + 0xc]
call fcn.004047b4
test eax, eax
jne 0x47279e
xor esi, esi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00401752
mov byte [ebp - 4], bl
lea ecx, [ebp + 0xc]
call fcn.00401752
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.00401752
mov eax, esi
jmp 0x47275e
lea eax, [ebp - 0x10]
push eax
push 0x20019
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x472775
lea eax, [ebp - 0x18]
push eax
push ebx
lea eax, [ebp - 0x1c]
push eax
push ebx
push dword [ebp + 0x10]
mov dword [ebp - 0x18], ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
push dword [ebp - 0x10]
jne 0x4727e0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x472777
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x472775