joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49b460
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 0xc]
push edi
mov edi, edx
call fcn.004a15a7
mov edx, eax
mov dword [ebp - 0xc], edx
test edx, edx
js 0x49b5ef
mov ebx, dword [ebp + 0x18]
mov eax, 0xff
dec ebx
and ebx, 7
mov ecx, ebx
mov dword [ebp - 0x10], ebx
shl eax, cl
test byte [esi], al
jne 0x49b5ea
test ebx, ebx
lea ecx, [esi + 1]
lea eax, [edi - 1]
cmovne eax, edi
cmovne ecx, esi
mov esi, eax
mov dword [ebp - 4], ecx
sub esi, edx
mov dword [ebp - 8], eax
sub esi, 1
jns 0x49b4c4
mov eax, 0xffffff16
jmp 0x49b5ef
mov edi, dword [ebp + 0x14]
cmp edi, 0xffffffff
jne 0x49b4e1
cmp dword [ebp + 0x18], 0x400
mov edi, edx
jne 0x49b4f2
cmp edx, 0x40
jne 0x49b4f2
push 0x3e
pop edi
jmp 0x49b4f2
cmp edi, edx
jg 0x49b5e3
cmp edi, 0xffffffff
jl 0x49b5e3
lea eax, [edi + 1]
cmp esi, eax
jl 0x49b5e3
mov eax, dword [ebp - 8]
cmp byte [eax + ecx - 1], 0xbc
jne 0x49b5ea
mov ecx, esi
call fcn.0049945a
mov ebx, eax
mov dword [ebp - 0x14], ebx
test ebx, ebx
jne 0x49b523
push 0xffffffffffffff83
pop eax
jmp 0x49b5ef
mov edx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp + 0x10]
push esi
push ebx
push dword [ebp - 0xc]
lea edx, [edx + esi]
call fcn.0049ad99
add esp, 0x10
mov dword [ebp + 0x18], eax
test eax, eax
je 0x49b545
mov esi, eax
jmp 0x49b59d
mov ecx, dword [ebp - 0x10]
mov al, 1
mov edx, dword [ebp - 4]
shl al, cl
xor ecx, ecx
dec al
and byte [ebx], al
and byte [edx], al
mov eax, esi
sub eax, edi
mov dword [ebp - 0x18], eax
dec eax
mov dword [ebp - 0x10], eax
test eax, eax
jle 0x49b58e
mov eax, edx
mov dword [ebp + 0x18], ebx
sub dword [ebp + 0x18], edx
mov dword [ebp - 8], eax
mov edx, dword [ebp + 0x18]
mov al, byte [edx + eax]
mov edx, dword [ebp - 8]
cmp al, byte [edx]
mov edx, dword [ebp - 4]
jne 0x49b598
mov eax, dword [ebp - 8]
inc ecx
inc eax
mov dword [ebp - 8], eax
cmp ecx, dword [ebp - 0x10]
jl 0x49b571
mov al, byte [edx + ecx]
xor al, 1
cmp byte [ecx + ebx], al
je 0x49b5a8
mov esi, 0xffffff06
mov ecx, ebx
call fcn.0049946f
mov eax, esi
jmp 0x49b5ef
inc ecx
cmp ecx, esi
jge 0x49b5ca
lea eax, [edx + ecx]
mov dword [ebp + 0x18], ebx
sub ebx, edx
mov dword [ebp - 0x10], eax
sub esi, ecx
mov ecx, eax
mov al, byte [ecx + ebx]
xor byte [ecx], al
inc ecx
sub esi, 1
jne 0x49b5bc
mov ebx, dword [ebp - 0x14]
mov ecx, ebx
call fcn.0049946f
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
add eax, edi
jmp 0x49b5ef
mov eax, 0xffffff06
jmp 0x49b5ef
mov eax, 0xffffff3f
pop edi
pop esi
pop ebx
leave
ret
Function at 0x49d337
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
jne 0x49d348
mov eax, 0xffffff53
pop ebp
ret
xor ecx, ecx
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0xc0], ecx
mov dword [eax + 0xc8], ecx
mov dword [eax + 0xcc], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], ecx
xor eax, eax
pop ebp
ret
Function at 0x4a0a07
Capabilities:
Hash data using sha224

Disassembly:
test ecx, ecx
jne 0x4a0a11
mov eax, 0xffffff53
ret
xor eax, eax
mov dword [ecx], 0xc1059ed8
mov dword [ecx + 4], 0xcbbb9d5d
mov dword [ecx + 8], 0x367cd507
mov dword [ecx + 0xc], 0x629a292a
mov dword [ecx + 0x10], 0x3070dd17
mov dword [ecx + 0x14], 0x9159015a
mov dword [ecx + 0x18], 0xf70e5939
mov dword [ecx + 0x1c], 0x152fecd8
mov dword [ecx + 0x20], 0xffc00b31
mov dword [ecx + 0x24], 0x67332667
mov dword [ecx + 0x28], 0x68581511
mov dword [ecx + 0x2c], 0x8eb44a87
mov dword [ecx + 0x30], 0x64f98fa7
mov dword [ecx + 0x34], 0xdb0c2e0d
mov dword [ecx + 0x38], 0xbefa4fa4
mov dword [ecx + 0x3c], 0x47b5481d
mov dword [ecx + 0xc0], eax
mov dword [ecx + 0xc8], eax
mov dword [ecx + 0xcc], eax
mov dword [ecx + 0xd0], eax
mov dword [ecx + 0xd4], eax
ret

Function at 0x4a0aa1
Capabilities:
Hash data using sha224

Disassembly:
push ebx
push esi
mov ebx, ecx
push edi
mov edi, edx
test ebx, ebx
je 0x4a0aca
test edi, edi
je 0x4a0aca
call fcn.004a0838
test eax, eax
jne 0x4a0acf
push 0xc
pop ecx
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
pop edi
pop esi
pop ebx
jmp fcn.004a0a07
mov eax, 0xffffff53
pop edi
pop esi
pop ebx
ret

Function at 0x4a1152
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, edx
mov dword [ebp - 4], esi
push edi
mov edi, ecx
test ebx, ebx
je 0x4a116a
and dword [ebx], 0
test edi, edi
je 0x4a127a
test esi, esi
je 0x4a127a
push 0x278
push 0
push edi
call fcn.004cd4b0
add esp, 0xc
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x4a118d
sub esi, ecx
mov ecx, 0xfd
cmp esi, ecx
jg 0x4a1273
push ecx
push dword [ebp - 4]
lea eax, [edi + 0x178]
push eax
call fcn.004dbc70
mov eax, 0x100
lea ecx, [edi + 0x178]
sub eax, esi
add ecx, esi
push eax
push 0x5268a0
push ecx
call fcn.004dbc70
add esp, 0x18
lea eax, [edi + 0x178]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [edi + 0x140], eax
cmp eax, 0xffffffff
je 0x4a1273
test byte [edi], 0x10
je 0x4a1210
push edi
push dword [edi + 0x140]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4a11ee
mov ecx, edi
call fcn.004a1366
or eax, 0xffffffff
jmp 0x4a127f
lea ecx, [edi + 0x2c]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a1216
sub ecx, edx
lea eax, [esi + 2]
add eax, ecx
cmp eax, 0x100
jg 0x4a1273
lea eax, [esi + 1]
push eax
push dword [ebp - 4]
lea eax, [edi + 0x178]
push eax
call fcn.004dbc70
mov eax, 0xff
mov byte [esi + edi + 0x178], 0x5c
sub eax, esi
push eax
lea eax, [edi + 0x2c]
push eax
lea eax, [edi + 0x179]
add eax, esi
push eax
call fcn.004dbc70
add esp, 0x18
test ebx, ebx
je 0x4a126f
lea eax, [edi + 0x178]
mov dword [ebx], eax
xor eax, eax
jmp 0x4a127f
mov eax, 0xffffff0c
jmp 0x4a127f
mov eax, 0xffffff53
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4a13f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov eax, edx
mov esi, ecx
neg eax
mov dword [ebp - 8], esi
mov dword [ebp - 4], eax
test esi, esi
je 0x4a14a7
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x4a14a7
mov edx, dword [esi]
mov ecx, ebx
inc edx
call fcn.00494a0a
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x4a14ac
push edi
mov edi, dword [esi]
xor edx, edx
test edi, edi
jle 0x4a145e
mov edi, dword [ebx + 0xc]
mov ecx, esi
call fcn.004a13da
mov ecx, ebx
mov esi, eax
call fcn.004a13da
mov ecx, dword [ebp - 4]
xor esi, eax
and esi, ecx
xor dword [edi + edx*4], esi
inc edx
mov esi, dword [ebp - 8]
mov edi, dword [esi]
cmp edx, edi
jl 0x4a1435
jmp 0x4a1461
mov ecx, dword [ebp - 4]
mov eax, dword [ebx]
cmp edx, eax
jge 0x4a1490
mov edi, dword [ebx + 0xc]
mov ecx, esi
call fcn.004a13da
mov ecx, ebx
mov esi, eax
call fcn.004a13da
mov ecx, dword [ebp - 4]
xor esi, eax
and esi, ecx
xor dword [edi + edx*4], esi
inc edx
mov eax, dword [ebx]
mov esi, dword [ebp - 8]
cmp edx, eax
jl 0x4a1467
mov edi, dword [esi]
xor eax, edi
and eax, ecx
xor dword [ebx], eax
mov eax, dword [esi + 8]
xor eax, dword [ebx + 8]
and eax, ecx
xor dword [ebx + 8], eax
mov eax, dword [ebp - 0xc]
pop edi
jmp 0x4a14ac
mov eax, 0xffffff53
pop esi
pop ebx
leave
ret
Function at 0x4a1c85
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], ecx
push ebx
push esi
push edi
test ecx, ecx
je 0x4a1ebf
cmp dword [ebp + 8], 0
mov esi, dword [ebp + 0xc]
jne 0x4a1caa
test esi, esi
jne 0x4a1ebf
cmp edx, 3
je 0x4a1ce0
cmp edx, 4
je 0x4a1ce0
cmp edx, 5
je 0x4a1ce0
cmp edx, 6
je 0x4a1ce0
cmp edx, 7
je 0x4a1ce0
cmp edx, 8
je 0x4a1ce0
cmp edx, 0xa
je 0x4a1ce0
cmp edx, 0xb
je 0x4a1ce0
cmp edx, 0xc
je 0x4a1ce0
cmp edx, 0xd
jne 0x4a1ebf
push ecx
mov byte [ecx + 0x225], 0
mov byte [ecx + 0x224], dl
call fcn.004a1c13
mov ebx, eax
mov dword [ebp - 0xc], ebx
pop ecx
test ebx, ebx
jne 0x4a1ec4
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 0x224]
lea edi, [eax + 0xe0]
sub ecx, 3
je 0x4a1e54
sub ecx, 1
je 0x4a1e1d
dec ecx
sub ecx, 1
je 0x4a1dda
sub ecx, 1
je 0x4a1d9d
sub ecx, 1
jne 0x4a1ebf
mov edx, 0x80
mov dword [ebp - 4], edx
cmp esi, edx
ja 0x4a1d63
cmp dword [ebp + 8], 0
je 0x4a1e8a
push esi
push dword [ebp + 8]
push edi
call fcn.004cc9b0
add esp, 0xc
jmp 0x4a1e8a
mov edx, dword [ebp + 8]
mov ecx, eax
push esi
call fcn.004a081b
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x4a1ebb
mov ecx, dword [ebp - 8]
push edi
push ecx
call fcn.004a09ee
mov ebx, eax
mov dword [ebp - 0xc], ebx
pop ecx
pop ecx
test ebx, ebx
jne 0x4a1ebb
push 0x40
mov eax, dword [ebp - 4]
pop esi
jmp 0x4a1e91
mov edx, 0x80
mov dword [ebp - 4], edx
cmp esi, edx
jbe 0x4a1d47
mov edx, dword [ebp + 8]
mov ecx, eax
push esi
call fcn.004a081b
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x4a1ebb
mov ecx, dword [ebp - 8]
mov edx, edi
call fcn.004a0aa1
mov ebx, eax
mov dword [ebp - 0xc], ebx
test ebx, ebx
jne 0x4a1ebb
push 0x30
jmp 0x4a1d94
push 0x40
pop ecx
mov dword [ebp - 4], ecx
cmp esi, ecx
jbe 0x4a1d47
mov edx, dword [ebp + 8]
mov ecx, eax
push esi
call fcn.004a384b
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x4a1ebb
mov ecx, dword [ebp - 8]
mov edx, edi
call fcn.004a391c
mov ebx, eax
mov dword [ebp - 0xc], ebx
test ebx, ebx
jne 0x4a1ebb
push 0x20
pop esi
push 0x40
pop eax
jmp 0x4a1e91
push 0x40
pop ecx
mov dword [ebp - 4], ecx
cmp esi, ecx
jbe 0x4a1d47
mov edx, dword [ebp + 8]
mov ecx, eax
push esi
call fcn.0049d078
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x4a1ebb
mov ecx, dword [ebp - 8]
mov edx, edi
call fcn.0049d193
mov ebx, eax
mov dword [ebp - 0xc], ebx
test ebx, ebx
jne 0x4a1ebb
push 0x14
jmp 0x4a1e17
push 0x40
pop ecx
mov dword [ebp - 4], ecx
cmp esi, ecx
jbe 0x4a1d47
mov edx, dword [ebp + 8]
mov ecx, eax
push esi
call fcn.004a2f69
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x4a1ebb
mov ecx, dword [ebp - 8]
mov edx, edi
call fcn.004a306f
mov ebx, eax
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x4a1ebb
push 0x10
pop esi
mov eax, dword [ebp - 4]
cmp esi, eax
jae 0x4a1ea2
sub eax, esi
push eax
lea eax, [edi + esi]
push 0
push eax
call fcn.004cd4b0
add esp, 0xc
mov ebx, dword [ebp - 4]
mov al, byte [edi]
xor al, 0x5c
mov byte [edi + 0x80], al
xor byte [edi], 0x36
inc edi
sub ebx, 1
jne 0x4a1ea5
mov ebx, dword [ebp - 0xc]
mov eax, ebx
jmp 0x4a1ec4
mov eax, 0xffffff53
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4a3186
Capabilities:
Hash data using sha256

Disassembly:
test ecx, ecx
jne 0x4a3190
mov eax, 0xffffff53
ret
xor eax, eax
mov dword [ecx], 0x6a09e667
mov dword [ecx + 4], 0xbb67ae85
mov dword [ecx + 8], 0x3c6ef372
mov dword [ecx + 0xc], 0xa54ff53a
mov dword [ecx + 0x10], 0x510e527f
mov dword [ecx + 0x14], 0x9b05688c
mov dword [ecx + 0x18], 0x1f83d9ab
mov dword [ecx + 0x1c], 0x5be0cd19
mov dword [ecx + 0x60], eax
mov dword [ecx + 0x64], eax
mov dword [ecx + 0x68], eax
ret

Function at 0x4a386f
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
test esi, esi
jne 0x4a387d
mov eax, 0xffffff53
pop esi
ret
mov eax, dword [esi + 0x60]
push ebx
push edi
lea edi, [esi + 0x20]
mov byte [edi + eax], 0x80
inc dword [esi + 0x60]
mov ecx, dword [esi + 0x60]
push 0x38
pop ebx
cmp ecx, ebx
jbe 0x4a38cc
push 0x40
pop eax
sub eax, ecx
push eax
lea eax, [ecx + edi]
push 0
push eax
call fcn.004cd4b0
push 0x40
pop eax
push eax
mov edx, edi
mov dword [esi + 0x60], eax
mov ecx, edi
call fcn.0049c087
add esp, 0x10
mov edx, edi
mov ecx, esi
call fcn.004a31ea
test eax, eax
jne 0x4a3918
and dword [esi + 0x60], eax
xor ecx, ecx
sub ebx, ecx
lea eax, [ecx + edi]
push ebx
push 0
push eax
call fcn.004cd4b0
mov eax, dword [esi + 0x64]
mov edx, edi
mov ecx, dword [esi + 0x68]
shr eax, 0x1d
push 0x40
lea eax, [eax + ecx*8]
mov ecx, edi
mov dword [esi + 0x68], eax
mov eax, dword [esi + 0x64]
shl eax, 3
mov dword [esi + 0x64], eax
call fcn.0049c087
mov eax, dword [esi + 0x68]
add esp, 0x10
mov dword [edi + 0x38], eax
mov edx, edi
mov eax, dword [esi + 0x64]
mov ecx, esi
mov dword [edi + 0x3c], eax
pop edi
pop ebx
pop esi
jmp fcn.004a31ea
pop edi
pop ebx
pop esi
ret

Function at 0x4a391c
Capabilities:
Hash data using sha256

Disassembly:
push ebx
mov ebx, ecx
push edi
mov edi, edx
test ebx, ebx
je 0x4a3951
test edi, edi
je 0x4a3951
call fcn.004a386f
test eax, eax
jne 0x4a3956
push esi
push 0x20
mov edx, ebx
mov ecx, ebx
call fcn.0049c087
pop ecx
push 8
pop ecx
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
pop esi
pop edi
mov ecx, ebx
pop ebx
jmp fcn.004a3186
mov eax, 0xffffff53
pop edi
pop ebx
ret
Function at 0x4addb8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x80], 0
jne 0x4adf06
cmp dword [esi + 8], 0
je 0x4adf06
push dword [ebp + 8]
lea ecx, [esi + 0x14]
call fcn.0043b5f2
lea edi, [esi + 0x2c]
push 0x51f46c
mov ecx, edi
call fcn.0043b5f2
lea ebx, [esi + 0x44]
push 0x51f46c
mov ecx, ebx
call fcn.0043b5f2
cmp dword [ebp + 0xc], 0
je 0x4ade13
push dword [ebp + 0xc]
mov ecx, edi
call fcn.0043b5f2
jmp 0x4ade1f
mov ecx, dword [ebp + 8]
mov edx, edi
push ebx
call fcn.004adffa
pop ecx
mov eax, dword [esi + 0xc]
xor edi, edi
inc edi
xor ebx, ebx
test eax, eax
jne 0x4ade40
push ebx
push ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0xc], eax
test eax, eax
je 0x4adf06
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, dword [esi + 0x7c]
test ecx, ecx
je 0x4ade56
mov eax, dword [ecx]
push edi
call dword [eax]
mov dword [esi + 0x7c], ebx
call fcn.004ae5e2
test eax, eax
je 0x4ade78
cmp dword [esi + 4], edi
jne 0x4ade78
push 0x54
call fcn.004caa83
pop ecx
mov ecx, eax
mov dword [ebp + 0xc], eax
call fcn.004b63b4
jmp 0x4adea5
push 0x2c
call fcn.004caa83
pop ecx
xor ecx, ecx
mov dword [ebp + 0xc], eax
mov dword [eax], vtable.CWininetFile.0
mov dword [eax + 0x1c], ebx
mov dword [eax + 0x20], 7
mov word [eax + 0xc], cx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0x24], ebx
mov dword [eax + 0x28], ebx
push ebx
push ebx
push ebx
push 0xfffffffffffffffd
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str.STATIC
push ebx
mov dword [esi + 0x7c], eax
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0x4ae55f
push 0xfffffffffffffffc
push eax
mov dword [esi + 0x5c], eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
lea eax, [ebp - 4]
mov dword [esi + 0x80], edi
push eax
push ebx
push esi
push 0x4ae119
push ebx
push ebx
mov dword [ebp - 4], ebx
call fcn.004d7da0
mov ecx, eax
add esp, 0x18
mov dword [esi + 0x10], ecx
test ecx, ecx
jne 0x4adefd
mov dword [esi + 0x80], ebx
xor eax, eax
test ecx, ecx
setne al
jmp 0x4adf08
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4adffa
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x624
mov eax, dword [0x53b070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x210]
push esi
push edi
push 0x20a
push 0
push eax
mov edi, edx
mov esi, ecx
call fcn.004cd4b0
push 0x412
lea eax, [ebp - 0x624]
push 0
push eax
call fcn.004cd4b0
push 0x2f
push esi
call fcn.004cc897
add esp, 0x20
mov esi, 0x105
test eax, eax
je 0x4ae076
push 0xffffffffffffffff
add eax, 2
push eax
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.004e0393
add esp, 0x10
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.SHELL32.dll_PathCleanupSpec]
cmp word [ebp - 0x210], 0
jne 0x4ae097
push 0xffffffffffffffff
push str.unknown
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.004e0393
add esp, 0x10
lea eax, [ebp - 0x624]
push eax
push 0x208
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x624]
push str.Download
push eax
call esi
lea eax, [ebp - 0x624]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4ae0de
push eax
lea eax, [ebp - 0x624]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x624]
push eax
call esi
lea eax, [ebp - 0x624]
mov ecx, edi
push eax
call fcn.0043b5f2
lea eax, [ebp - 0x210]
mov ecx, ebx
push eax
call fcn.0043b5f2
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004caa72
leave
ret

Function at 0x4ae4af
Capabilities:
Check if file exists
Copy file
Create directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x53b070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x210]
push 0x20a
xor ebx, ebx
mov esi, ecx
push ebx
push eax
call fcn.004cd4b0
push edi
lea eax, [ebp - 0x210]
push 0x105
push eax
call fcn.004dd705
add esp, 0x18
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4ae520
push ebx
lea eax, [ebp - 0x210]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
add esi, 0x2c
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x4ae52d
mov eax, dword [esi]
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edi, eax
cmp dword [ebp + 0xc], ebx
je 0x4ae54c
cmp dword [esi + 0x14], 8
jb 0x4ae545
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004caa72
leave
ret 8
Function at 0x4ae5e2
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x53b070]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x118
lea eax, [ebp - 0x11c]
push 0
push eax
call fcn.004cd4b0
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ecx, ecx
inc ecx
test eax, eax
je 0x4ae654
cmp dword [ebp - 0x11c], 5
jne 0x4ae64e
cmp dword [ebp - 0x118], ecx
jne 0x4ae640
cmp word [ebp - 0xc], cx
jmp 0x4ae64e
cmp dword [ebp - 0x118], 0
jne 0x4ae654
cmp word [ebp - 0xc], 3
jae 0x4ae654
xor eax, eax
jmp 0x4ae656
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004caa72
leave
ret
Function at 0x4b01c9
Capabilities:
Identify system language via api

Disassembly:
push 0x44
mov eax, 0x4fc8a1
call fcn.004cb6c8
mov esi, ecx
mov eax, dword [ebp + 0xc]
mov bl, byte [0x5411e3]
mov bh, byte [0x5411e2]
movsx edi, ax
shr eax, 0x10
cwde
push eax
push edi
push 0x5414cc
mov byte [0x5411e3], 0
mov byte [0x5411e2], 0
mov dword [ebp - 0x4c], eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4b02bc
mov byte [0x5414b9], 0
mov byte [0x5414b8], 1
test bl, bl
je 0x4b0302
lea ecx, [ebp - 0x2c]
call fcn.00440334
xor ebx, ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov ecx, 0x804
movzx eax, ax
cmp ax, cx
lea ecx, [ebp - 0x48]
jne 0x4b025c
push 0x527f30
call fcn.00440943
mov byte [ebp - 4], 1
jmp 0x4b026a
push str.Setup_is_harding_work_it_maybe_make_you_cannt_connect_to_internet_if_you_quit_now._Do_you_sure_to_exit_
call fcn.00440943
mov byte [ebp - 4], 2
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x28]
call fcn.00443482
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], bl
call fcn.00440de9
mov ecx, esi
call fcn.004b0308
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0x34
cmovae eax, dword [ebp - 0x28]
push str.Warning
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x4b02b2
push ebx
push ebx
push 0x10
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [ebp - 0x2c]
call fcn.00440de9
jmp 0x4b0302
push dword [ebp - 0x4c]
push edi
push 0x541494
call dword [sym.imp.USER32.dll_PtInRect]
mov byte [0x5414b8], 0
test eax, eax
je 0x4b02ec
mov byte [0x5414b9], 1
test bh, bh
je 0x4b0302
push 6
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4b0302
mov byte [0x5414b9], 0
test bh, bh
jne 0x4b02fb
test bl, bl
je 0x4b0302
mov ecx, esi
call fcn.004b0308
call fcn.004cb672
ret
Function at 0x4b6eb2
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x28
call fcn.004caa83
mov esi, eax
xor eax, eax
pop ecx
push dword [ebp + 0xc]
mov ecx, esi
and dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
call fcn.0043b5f2
lea ebx, [esi + 0x18]
mov dword [esi + 0x24], 2
xor eax, eax
mov edi, ebx
xor ecx, ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 4]
push eax
push ecx
push esi
push 0x4b6e1c
push ecx
push ecx
mov dword [ebp - 4], ecx
call fcn.004d7da0
mov edi, eax
add esp, 0x18
test edi, edi
jne 0x4b6f17
mov ecx, esi
call fcn.004b61c5
jmp 0x4b6f4a
push 0x2710
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4b6f3c
cmp dword [ebx], 3
jne 0x4b6f3c
mov ecx, dword [ebp + 8]
push 0xc
push ebx
push 0x26
pop edx
call fcn.004b71e3
pop ecx
pop ecx
mov ecx, esi
call fcn.004b61c5
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x4b6f51
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x53b070]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x541504], 0
jne 0x4b6fc4
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.004cd4b0
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.winhttp.dll
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor ecx, ecx
mov dword [0x541504], eax
test eax, eax
setne cl
mov eax, ecx
jmp 0x4b6fc7
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004caa72
leave
ret