joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4688ab
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.004a98b0
mov eax, dword [0x4dd52c]
and word [ebp - 0x1004], 0
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
push edi
xor eax, eax
mov ecx, 0x3ff
lea edi, [ebp - 0x1002]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esi + 0x1e7f4]
test eax, eax
je 0x4689c3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi + 0x1dfa8], 1
jne 0x4689c3
mov eax, dword [esi + 0x1dfac]
test eax, eax
je 0x4689c3
cmp eax, 3
jb 0x4689c3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [ebp - 0x1014]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
xor eax, eax
push 0x40e678
mov ecx, 0x400
lea edi, [ebp - 0x1004]
rep stosd dword es:[edi], eax
movzx eax, word [ebp - 0x1006]
push 0x40e638
push eax
movzx eax, word [ebp - 0x1008]
push eax
movzx eax, word [ebp - 0x100a]
push eax
movzx eax, word [ebp - 0x100c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x4065a0
lea eax, [ebp - 0x1004]
push 0x800
push eax
call fcn.00431bde
add esp, 0x2c
cmp word [esi + 0x1dfa0], 1
lea eax, [ebp - 0x1004]
push eax
jne 0x4689a5
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x4689c3
add esi, 0x1dfa4
push 0x4060a8
push dword [esi]
call dword [sym.imp.msvcrt.dll_fwprintf]
push dword [esi]
call dword [sym.imp.msvcrt.dll_fflush]
add esp, 0x10
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
inc eax
pop esi
call fcn.004a9585
leave
ret 4
Function at 0x4800bd
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x4dd52c]
push esi
push edi
mov esi, dword [ebp + 8]
push 0x3f
mov dword [ebp - 4], eax
pop ecx
xor eax, eax
mov byte [ebp - 0x104], 0
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x100
stosb byte es:[edi], al
lea eax, [ebp - 0x104]
push eax
push 9
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea eax, [ebp - 0x104]
push eax
call fcn.0048003f
mov ecx, eax
and ecx, 0x3ff
dec ecx
cmp ecx, 0x2c
ja case.0x480123.9
jmp dword [ecx*4 + 0x4802dc]
push 0x412680
jmp 0x4802c5
push 0x412678
jmp 0x4802c5
push 0x412670
jmp 0x4802c5
push 0x412668
jmp 0x4802c5
push 0x412660
jmp 0x4802c5
push 0x412658
jmp 0x4802c5
push 0x412650
jmp 0x4802c5
push 0x412648
jmp 0x4802c5
push 0x412640
jmp 0x4802c5
push 0x412638
jmp 0x4802c5
push 0x412630
jmp 0x4802c5
push 0x412628
jmp 0x4802c5
push 0x412620
jmp 0x4802c5
push 0x412618
jmp 0x4802c5
and ax, 0xfc00
cmp ax, 0x800
jne 0x4801ca
push 0x412610
jmp 0x4802c5
push 0x412608
jmp 0x4802c5
and ax, 0xfc00
cmp ax, 0x800
jne 0x4801e8
push 0x412600
jmp 0x4802c5
push 0x4125f8
jmp 0x4802c5
push 0x4125f0
jmp 0x4802c5
push 0x4125e8
jmp 0x4802c5
push 0x4125e0
jmp 0x4802c5
push 0x4125d8
jmp 0x4802c5
push 0x4125d0
jmp 0x4802c5
push 0x4125c8
jmp 0x4802c5
push 0x4125c0
jmp 0x4802c5
push 0x4125b8
jmp 0x4802c5
push 0x4125b0
jmp 0x4802c5
push 0x4125a8
jmp 0x4802c5
push 0x4125a0
jmp 0x4802c5
push 0x412598
jmp 0x4802c5
push 0x412590
jmp 0x4802c5
push 0x412588
jmp 0x4802c5
push 0x412580
jmp 0x4802c5
push 0x412578
jmp 0x4802c5
push 0x412570
jmp 0x4802c5
push 0x412568
jmp 0x4802c5
push 0x412560
jmp 0x4802c5
push 0x412558
jmp 0x4802c5
push 0x412550
jmp 0x4802c5
push 0x412548
jmp 0x4802c5
push 0x412540
jmp 0x4802c5
push 0x412538
jmp 0x4802c5
push 0x412530
jmp 0x4802c5
push 0x412528
jmp 0x4802c5
push 0x412520
push esi
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.004a9585
leave
ret 4
Function at 0x4815bb
Capabilities:
Delete file
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp word [esi + 0x8d3c], bx
push edi
je 0x4816fd
cmp word [esi + 0x8d3e], 2
je 0x4816fd
cmp dword [esi + 0x8178], 0xffffffff
je 0x4816fd
mov edi, 0x2000
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x48171c
push ebx
push ebx
push ebx
push dword [esi + 0x8178]
call fcn.004809d9
cmp eax, 0xffffffff
jne 0x481624
cmp edx, ebx
je 0x481707
cmp dword [esi + 0x817c], ebx
jbe 0x4816cd
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esi + 0x817c]
cmp eax, edi
push 0
jbe 0x481685
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 0x8178]
call ebx
test eax, eax
je 0x481707
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 8]
lea eax, [esi + 0x1f778]
push dword [esi + 4]
push eax
call fcn.00480a26
test eax, eax
je 0x481707
add dword [esi + 0x817c], 0xffffe000
jmp 0x4816c0
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp + 8]
push dword [esi + 0x8178]
call ebx
test eax, eax
je 0x481707
lea eax, [ebp - 4]
push eax
push dword [esi + 0x817c]
lea eax, [esi + 0x1f778]
push dword [ebp + 8]
push dword [esi + 4]
push eax
call fcn.00480a26
test eax, eax
je 0x481707
and dword [esi + 0x817c], 0
cmp dword [esi + 0x817c], 0
ja 0x481636
push dword [esi + 0x8178]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esi + 0xb800]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [ebp + 8]
or dword [esi + 0x8178], 0xffffffff
or dword [esi + 0x8174], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 4
push dword [esi + 0x8178]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
jmp 0x481700
Function at 0x481c49
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x830
mov eax, dword [0x4dd52c]
push ebx
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
xor ebx, ebx
mov edx, 0x81
mov word [ebp - 0x420], bx
mov ecx, edx
lea edi, [ebp - 0x41e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x218], bx
mov ecx, edx
lea edi, [ebp - 0x216]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov esi, dword [ebp + 8]
mov word [ebp - 0x628], bx
mov ecx, edx
lea edi, [ebp - 0x626]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x830], bx
mov ecx, edx
lea edi, [ebp - 0x82e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
push ebx
mov word [ebp - 0x10], bx
lea edi, [ebp - 0xe]
stosd dword es:[edi], eax
push 1
stosw word es:[edi], ax
push ebx
lea eax, [ebp - 0x420]
push eax
push dword [esi + 4]
call fcn.00481725
movsx eax, word [esi + 0x973c]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push eax
lea eax, [ebp - 0x218]
push 0x40c24c
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
add esp, 0xc
lea eax, [ebp - 0x420]
push eax
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x628]
push eax
push 0x4127b0
lea eax, [ebp - 0x218]
push eax
push 0x4127a4
call edi
movsx eax, word [ebp + 0xc]
push eax
lea eax, [ebp - 0x218]
push 0x40c24c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x420]
push eax
push ebx
lea eax, [ebp - 0x830]
push eax
push 0x412794
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x628]
push eax
call edi
push 4
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x830]
push eax
call fcn.004807f8
cmp word [ebp + 0x10], 1
pop edi
pop esi
pop ebx
jne 0x481d86
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xe]
jmp 0x481d8c
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xa]
imul eax, ecx
mov ecx, dword [ebp - 4]
call fcn.004a9585
leave
ret 0xc
Function at 0x485e11
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 0x10]
xor esi, esi
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
cmp ebx, esi
je 0x485ead
cmp dword [ebp + 0x10], esi
je 0x485ea6
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, esi
je 0x485e74
push esi
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 4]
push eax
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x485e96
cmp esi, dword [ebp - 4]
jne 0x485e96
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov eax, ecx
shr ecx, 2
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
inc eax
jmp 0x485eaf
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x485ead
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x485ebb
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
test ebx, ebx
je 0x485efb
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x485ef4
xor esi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x486b55
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x424
push ebx
push esi
push edi
mov eax, dword [0x4dd52c]
push 7
pop ecx
mov esi, 0x413550
lea edi, [ebp - 0x310]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 0x39
pop ecx
mov dword [ebp - 4], eax
xor eax, eax
lea edi, [ebp - 0x2f3]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 7
pop ecx
and dword [ebp - 0x420], 0
push 0x3a
mov ebx, dword [ebp + 8]
xor eax, eax
cmp dword [ebp + 0x10], 1
mov esi, 0x413534
lea edi, [ebp - 0x20c]
rep movsd dword es:[edi], dword [esi]
pop ecx
push 5
lea edi, [ebp - 0x1f0]
rep stosd dword es:[edi], eax
pop ecx
push 0x3c
mov esi, 0x413520
lea edi, [ebp - 0x414]
rep movsd dword es:[edi], dword [esi]
pop ecx
lea edi, [ebp - 0x400]
rep stosd dword es:[edi], eax
push 0x40
mov byte [ebp - 0x108], al
pop ecx
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
jne 0x486c00
lea eax, [ebp - 0x310]
mov dword [ebp - 0x418], eax
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x486bf7
jmp 0x486c16
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x418], eax
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x486c0f
sub eax, edx
cmp word [ebx + 0x1bf2a], 1
mov dword [ebp - 0x41c], eax
jne 0x486c68
movsx eax, word [ebp + 0xc]
push eax
push dword [ebp - 0x418]
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.msvcrt.dll_sprintf]
lea eax, [ebp - 0x108]
add esp, 0x10
mov dword [ebp - 0x418], eax
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x486c59
sub eax, edx
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x41c]
add ecx, eax
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
xor esi, esi
cmp edi, esi
mov dword [ebp - 0x424], edi
je 0x486d30
push esi
push esi
push esi
push dword [ebx + 0x8148]
call fcn.004809d9
push esi
lea eax, [ebp - 0x420]
push eax
push 9
push edi
push dword [ebx + 0x8148]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 0x41c]
mov eax, dword [ebp - 0x420]
mov esi, dword [ebp - 0x418]
mov edx, ecx
shr ecx, 2
add edi, 9
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x424]
push 0
lea ecx, [ebp - 0x420]
push ecx
mov ecx, dword [ebp + 0x14]
add eax, edx
add ecx, 0xfffffff7
mov dword [ebp - 0x418], eax
push ecx
add eax, esi
push eax
push dword [ebx + 0x8148]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 0x418]
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebp - 0x420]
add ecx, eax
push ecx
push esi
push dword [ebx + 4]
add ebx, 0x1f778
push ebx
call fcn.00480a26
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.004a9585
leave
ret 0x10
Function at 0x489f51
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x658
mov eax, dword [0x4dd52c]
and word [ebp - 0x414], 0
and word [ebp - 0x61c], 0
push ebx
and word [ebp - 0x20c], 0
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
mov edx, 0x81
mov ecx, edx
lea edi, [ebp - 0x412]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov ecx, edx
lea edi, [ebp - 0x61a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov ecx, edx
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
push 0xf
stosw word es:[edi], ax
pop ecx
xor eax, eax
lea edi, [ebp - 0x658]
rep stosd dword es:[edi], eax
push 0x405e8c
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.00480395
test eax, eax
je 0x48a0bb
xor esi, esi
cmp dword [ebp + 0x14], esi
lea eax, [ebp - 0x20c]
jne 0x48a005
push 0x413a80
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
push ebx
push 2
push 0x413b0c
jmp 0x48a019
push 0x413afc
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
push ebx
push 2
push 0x413a90
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
lea eax, [ebp - 0x61c]
mov dword [ebp - 0x640], eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x648], eax
lea eax, [ebp - 0x414]
mov dword [ebp - 0x644], eax
add esp, 0x18
lea eax, [ebp - 0x658]
push eax
mov dword [ebp - 0x650], esi
mov dword [ebp - 0x64c], 0x413a74
mov dword [ebp - 0x63c], esi
mov dword [ebp - 0x654], 0x440
mov dword [ebp - 0x658], 0x3c
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x48a0bb
cmp dword [ebp - 0x620], esi
je 0x48a0bb
jmp 0x48a0b6
push 0x1f4
push dword [ebp - 0x620]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, esi
je 0x48a0b3
cmp eax, 0x102
je 0x48a0b6
cmp eax, 0xffffffff
jne 0x48a0bb
mov dword [ebp + 0xc], esi
cmp dword [ebp + 0xc], esi
jne 0x48a092
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.004a9585
leave
ret 0x10
Function at 0x48a280
Capabilities:
Get common file path
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa2c
mov eax, dword [0x4dd52c]
mov dword [ebp - 4], eax
push ebx
xor eax, eax
push esi
push edi
mov edx, 0x81
xor ebx, ebx
mov word [ebp - 0xa2c], bx
mov ecx, edx
lea edi, [ebp - 0xa2a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x61c], bx
mov ecx, edx
lea edi, [ebp - 0x61a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x20c], bx
mov ecx, edx
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, dword [ebp + 8]
xor eax, eax
mov word [ebp - 0x414], bx
mov ecx, edx
lea edi, [ebp - 0x412]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x824], bx
mov ecx, edx
lea edi, [ebp - 0x822]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x405e8c
lea eax, [ebp - 0xa2c]
push eax
lea eax, [ebp - 0x61c]
push eax
push dword [esi + 4]
xor edi, edi
call fcn.00480395
cmp eax, 1
jne 0x48a3e2
lea eax, [ebp - 0x20c]
push eax
push ebx
push ebx
push 0x23
push ebx
call sub.SHELL32.dll_SHGetFolderPathW
mov edi, dword [sym.imp.msvcrt.dll_wcscat]
lea eax, [ebp - 0x20c]
push 0x405c38
push eax
call edi
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x20c]
push eax
call edi
lea eax, [ebp - 0x20c]
push 0x413b28
push eax
call edi
push dword [esi + 8]
lea eax, [ebp - 0x414]
push 0x40c24c
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0x24
mov edi, 0x40d670
mov esi, 0x413b1c
lea eax, [ebp - 0x20c]
push eax
push 0x104
lea eax, [ebp - 0x824]
push eax
push edi
lea eax, [ebp - 0x414]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.msvcrt.dll__wtoi]
test ax, ax
pop ecx
je 0x48a394
lea eax, [ebp - 0x20c]
push eax
push edi
lea eax, [ebp - 0x414]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
xor edi, edi
inc edi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
pop ebx
call fcn.004a9585
leave
ret 4

Function at 0x48a576
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4dd52c]
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 4], eax
xor eax, eax
xor ebx, ebx
mov word [ebp - 0x20c], bx
mov ecx, 0x81
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push esi
lea eax, [edx + 0x1bf30]
push eax
add edx, 0x1c138
push edx
lea eax, [ebp - 0x20c]
push 0x40c25c
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0x14
test esi, esi
je 0x48a5ed
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x48a5ed
test al, 0x10
jne 0x48a5ef
inc ebx
jmp 0x48a5ef
xor ebx, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
pop ebx
call fcn.004a9585
leave
ret 8
Function at 0x48b65d
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
or dword [esi + 0x10], 0x40
xor ebx, ebx
cmp word [esi + 0x8b16], 3
jne 0x48b690
push 0x15
push esi
call fcn.004a5597
test eax, eax
jne 0x48b690
cmp word [esi + 0x8b18], bx
jle 0x48b690
or dword [esi + 0x10], 0x20
cmp word [esi + 0x1bf2a], 2
jne 0x48b6cb
cmp word [esi + 0x8a36], 1
jle 0x48b6cb
cmp word [esi + 0x976a], 1
je 0x48b6c7
push esi
call fcn.0048b57c
test eax, eax
je 0x48b6c7
mov eax, dword [esi + 0x1f7a4]
cmp dword [eax + 0x1e068], 1
jne 0x48b6cb
or dword [esi + 0x10], 0x10
cmp word [esi + 0x1bf2a], 1
push edi
jne 0x48b71a
cmp word [esi + 0x8a44], 1
jne 0x48b71a
mov cx, word [esi + 0x978d]
movsx edx, word [esi + 0x97ac]
mov ax, word [esi + 0x8a36]
movsx edi, cx
add edx, edi
movsx edi, ax
cmp edi, edx
jne 0x48b71a
cmp ax, 1
jle 0x48b71a
cmp word [esi + 0x941b], 1
jne 0x48b71a
cmp cx, bx
jle 0x48b71a
or dword [esi + 0x10], 0x10
cmp word [esi + 0x8f60], bx
je 0x48b727
or dword [esi + 0x10], 8
mov ax, word [esi + 0x8f56]
cmp ax, 1
je 0x48b73a
cmp ax, 2
jne 0x48b73e
or dword [esi + 0x10], 1
cmp word [esi + 0x8d44], bx
jne 0x48b74f
cmp byte [esi + 0x96ec], bl
je 0x48b753
or dword [esi + 0x10], 2
cmp byte [esi + 0x1bf18], 1
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
jbe 0x48b77f
or byte [esi + 0x11], 2
push 8
pop eax
push eax
push ebx
mov dword [esi + 0x1bf10], ebx
mov dword [esi + 0x1bf14], eax
call edi
mov dword [esi + 0x1bf0c], eax
cmp word [esi + 0x973c], bx
jle 0x48b7a5
or byte [esi + 0x11], 1
push 8
pop eax
push eax
push ebx
mov dword [esi + 0x1bf20], ebx
mov dword [esi + 0x1bf24], eax
call edi
mov dword [esi + 0x1bf1c], eax
lea edi, [esi + 0x7d38]
push edi
push ebx
push ebx
push 0x23
push ebx
call sub.SHELL32.dll_SHGetFolderPathW
lea eax, [esi + 0x7f40]
push eax
push ebx
push 0x413c1c
push edi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push ebx
push 0x80
push 2
push ebx
push ebx
push 0xc0000000
lea eax, [esi + 0x7f40]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi + 0x8148], eax
pop edi
jne 0x48b7f6
xor eax, eax
jmp 0x48b80b
xor eax, eax
mov dword [esi + 0x3eb0], ebx
mov dword [esi + 0x3eb4], ebx
mov dword [esi + 0x3ea8], ebx
inc eax
pop esi
pop ebx
pop ebp
ret 4
Function at 0x48fe1a
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x26c
mov eax, dword [0x4dd52c]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea edi, [esi + 0x16900]
mov dword [ebp - 4], eax
mov byte [edi], 0
mov eax, dword [esi + 0x16760]
cmp eax, 0x22
mov dword [ebp - 0x26c], edi
ja 0x48fe8c
je case.0x48fe64.1
dec eax
cmp eax, 0x1e
ja case.0x48fe64.2
movzx eax, byte [eax + 0x49006d]
jmp dword [eax*4 + 0x490059]
mov esi, 0x4122bc
jmp 0x490044
mov esi, 0x4122c4
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp case.0x48fe64.1
mov esi, 0x4122b0
jmp 0x490043
cmp eax, 0x47
ja 0x48fec3
je 0x48feb8
cmp eax, 0x25
je case.0x48fe64.1
cmp eax, 0x2b
je case.0x48fe64.1
cmp eax, 0x3b
je case.0x48fe64.1
cmp eax, 0x46
jne case.0x48fe64.2
jmp case.0x48fe64.1
mov esi, 0x4122c8
movsd dword es:[edi], dword [esi]
jmp 0x490031
cmp eax, 0x48
je 0x49003e
cmp eax, 0x58
je 0x490037
cmp eax, 0x79
je 0x49002c
cmp eax, 0x100
je case.0x48fe64.1
lea eax, [ebp - 0x25c]
push eax
call fcn.0042fd0f
xor ebx, ebx
cmp dword [esi + 0x19784], ebx
je case.0x48fe64.1
push dword [esi + 0x16760]
xor eax, eax
mov word [ebp - 0x20c], bx
mov ecx, 0x81
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x20c]
push 0x405bf4
push eax
mov dword [ebp - 0x264], ebx
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0xc
mov dword [ebp - 0x260], ebx
lea edi, [esi + 0x19e44]
push edi
lea ebx, [esi + 0x19a24]
push ebx
lea eax, [ebp - 0x260]
push eax
mov dword [ebp - 0x268], 0x50
call fcn.004805f0
test eax, eax
jne 0x48ffb2
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x25c]
push eax
push 0
push 0
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x260]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x48ff9d
mov dword [ebp - 0x264], 1
push dword [ebp - 0x260]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x264], 0
jne 0x490016
lea eax, [ebp - 0x25c]
push eax
xor eax, eax
mov ax, word [esi + 0x16760]
push eax
push 0
push dword [esi + 0x5010]
call dword [esi + 0x19784]
and dword [ebp - 0x260], 0
push edi
push ebx
lea eax, [ebp - 0x260]
push eax
call fcn.004806cf
test eax, eax
jne 0x490016
push 0x50
lea eax, [ebp - 0x25c]
push eax
push 3
push 0
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x260]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x260]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x20
lea eax, [ebp - 0x24c]
push eax
push dword [ebp - 0x26c]
call fcn.004ac4ed
jmp case.0x48fe64.1
mov esi, 0x4122e8
movsd dword es:[edi], dword [esi]
jmp 0x48fe7a
mov esi, 0x4122e0
jmp 0x490031
mov esi, 0x4122d4
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, dword [ebp - 4]
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
call fcn.004a9585
leave
ret 4
Function at 0x4902b2
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 0xc], esi
je 0x4902d2
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4902d2
test al, 0x10
jne 0x4902d2
inc esi
mov eax, esi
pop esi
pop ebp
ret 8