joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4778f0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x4f6fc0]
xor eax, ebp
mov dword [ebp - 4], eax
or eax, 0xffffffff
mov word [ebp - 0x208], ax
mov cl, byte [0x54e6bb]
mov byte [ebp - 0x104], cl
push 0xfe
push 0
lea edx, [ebp - 0x103]
push edx
call fcn.004b6780
add esp, 0xc
mov al, byte [0x54e6bc]
mov byte [ebp - 0x204], al
push 0xfe
push 0
lea ecx, [ebp - 0x203]
push ecx
call fcn.004b6780
add esp, 0xc
cmp dword [0x54e8f8], 1
jne 0x477965
mov ax, word [ebp - 0x208]
jmp 0x477a5d
lea edx, [ebp - 0x204]
push edx
call fcn.0049d800
add esp, 4
push 0x4ec4b8
lea eax, [ebp - 0x204]
push eax
call fcn.004b5e70
add esp, 8
lea ecx, [ebp - 0x204]
push ecx
push 0xff
lea edx, [ebp - 0x104]
push edx
push 0x54e6bd
push 0x4ec4c4
push 0x4ec4d4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, 1
imul eax, eax, 0
movsx ecx, byte [ebp + eax - 0x104]
test ecx, ecx
jne 0x477a0a
push 0x4ec4dc
push 0x4fcad8
push 0x4ec4e8
lea edx, [ebp - 0x204]
push edx
call fcn.004b6e08
add esp, 0x10
lea eax, [ebp - 0x204]
push eax
push 0xff
lea ecx, [ebp - 0x104]
push ecx
push 0x54e6be
push 0x4ec4f0
push 0x4ec500
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0x104]
push edx
call fcn.004ca3dc
add esp, 4
mov eax, 1
imul eax, eax, 0
movsx ecx, byte [ebp + eax - 0x104]
test ecx, ecx
je 0x477a56
lea edx, [ebp - 0x104]
push edx
push 0
push 0
call fcn.00476ad0
add esp, 0xc
mov eax, 2
imul eax, eax, 0
mov cx, word [eax + 0x54e6d8]
mov word [ebp - 0x208], cx
mov ax, word [ebp - 0x208]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b6253
mov esp, ebp
pop ebp
ret
Function at 0x483cd0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x750
mov eax, dword [0x4f6fc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x104]
push ecx
call fcn.004b5e60
add esp, 8
lea edx, [ebp - 0x104]
push edx
call fcn.004b5f60
add esp, 4
test eax, eax
jbe 0x483d5e
lea eax, [ebp - 0x104]
push eax
call fcn.004b5f60
add esp, 4
movsx ecx, byte [ebp + eax - 0x105]
cmp ecx, 0x5c
jne 0x483d5e
lea edx, [ebp - 0x104]
push edx
call fcn.004b5f60
add esp, 4
sub eax, 1
mov dword [ebp - 0x74c], eax
cmp dword [ebp - 0x74c], 0xff
jae 0x483d4b
jmp 0x483d50
call fcn.004b64ae
mov eax, dword [ebp - 0x74c]
mov byte [ebp + eax - 0x104], 0
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x204]
push edx
call fcn.004b5e60
add esp, 8
lea eax, [ebp - 0x204]
push eax
call fcn.004b5f60
add esp, 4
test eax, eax
jbe 0x483dd9
lea ecx, [ebp - 0x204]
push ecx
call fcn.004b5f60
add esp, 4
movsx edx, byte [ebp + eax - 0x205]
cmp edx, 0x5c
jne 0x483dd9
lea eax, [ebp - 0x204]
push eax
call fcn.004b5f60
add esp, 4
sub eax, 1
mov dword [ebp - 0x750], eax
cmp dword [ebp - 0x750], 0xff
jae 0x483dc6
jmp 0x483dcb
call fcn.004b64ae
mov ecx, dword [ebp - 0x750]
mov byte [ebp + ecx - 0x204], 0
lea edx, [ebp - 0x104]
push edx
push 0x4eeb74
lea eax, [ebp - 0x404]
push eax
call fcn.004b6e08
add esp, 0xc
lea ecx, [ebp - 0x744]
push ecx
lea edx, [ebp - 0x404]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x748], eax
cmp dword [ebp - 0x748], 0xffffffff
je 0x483f2d
mov eax, 1
imul eax, eax, 0
movsx ecx, byte [ebp + eax - 0x718]
cmp ecx, 0x2e
jne 0x483e35
jmp 0x483efb
mov edx, dword [ebp - 0x744]
and edx, 0x10
je 0x483eab
lea eax, [ebp - 0x718]
push eax
lea ecx, [ebp - 0x204]
push ecx
push 0x4eeb7c
lea edx, [ebp - 0x304]
push edx
call fcn.004b6e08
add esp, 0x10
lea eax, [ebp - 0x304]
push eax
call fcn.0049b980
add esp, 4
lea ecx, [ebp - 0x718]
push ecx
lea edx, [ebp - 0x104]
push edx
push 0x4eeb84
lea eax, [ebp - 0x504]
push eax
call fcn.004b6e08
add esp, 0x10
lea ecx, [ebp - 0x304]
push ecx
lea edx, [ebp - 0x504]
push edx
call fcn.00483cd0
add esp, 8
jmp 0x483efb
lea eax, [ebp - 0x718]
push eax
lea ecx, [ebp - 0x604]
push ecx
call fcn.004b5e60
add esp, 8
lea edx, [ebp - 0x604]
push edx
call fcn.004ca3dc
add esp, 4
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x104]
push ecx
lea edx, [ebp - 0x718]
push edx
call fcn.00483f40
add esp, 0xc
test eax, eax
jne 0x483efb
mov dword [0x550470], 1
lea eax, [ebp - 0x744]
push eax
mov ecx, dword [ebp - 0x748]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x483f20
cmp dword [0x550470], 0
je 0x483e1b
mov edx, dword [ebp - 0x748]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b6253
mov esp, ebp
pop ebp
ret
Function at 0x483f40
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54c
mov eax, dword [0x4f6fc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x54c], 0
mov eax, dword [ebp + 0xc]
push eax
call fcn.004b5f60
add esp, 4
mov ecx, dword [ebp + 0xc]
movsx edx, byte [ecx + eax - 1]
cmp edx, 0x5c
jne 0x483f94
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0x4eeaf4
lea edx, [ebp - 0x204]
push edx
call fcn.004b6e08
add esp, 0x10
jmp 0x483fb0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0x4eeafc
lea edx, [ebp - 0x204]
push edx
call fcn.004b6e08
add esp, 0x10
mov eax, dword [ebp + 0x10]
push eax
call fcn.004b5f60
add esp, 4
mov ecx, dword [ebp + 0x10]
movsx edx, byte [ecx + eax - 1]
cmp edx, 0x5c
jne 0x483fe7
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 0x4eeb04
lea edx, [ebp - 0x104]
push edx
call fcn.004b6e08
add esp, 0x10
jmp 0x484003
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 0x4eeb0c
lea edx, [ebp - 0x104]
push edx
call fcn.004b6e08
add esp, 0x10
lea eax, [ebp - 0x544]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x54c], eax
cmp dword [ebp - 0x54c], 0xffffffff
jne 0x48402a
xor eax, eax
jmp 0x484130
mov edx, dword [ebp - 0x54c]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 0x204]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov dword [ebp - 0x548], eax
cmp dword [ebp - 0x548], 0
je 0x484078
push 0x80
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, 1
jmp 0x484130
push 0
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 0x204]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov dword [ebp - 0x548], eax
cmp dword [ebp - 0x548], 0
je 0x4840b6
push 0x80
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, 1
jmp 0x484130
lea eax, [ebp - 0x404]
push eax
push 0x4eeb14
push 0
call fcn.00475ed0
add esp, 0xc
lea ecx, [ebp - 0x104]
push ecx
push 0x4eeb34
push 0x4eeb38
lea edx, [ebp - 0x204]
push edx
push 0x4eeb3c
push 0x4eeb40
push 0x4eeb44
lea eax, [ebp - 0x404]
push eax
push str._s_s_s_From:_s_s_sTo:_s__s
lea ecx, [ebp - 0x304]
push ecx
call fcn.004b6e08
add esp, 0x28
lea edx, [ebp - 0x304]
push edx
push 0x550474
push 0x4eeb64
lea eax, [ebp - 0x304]
push eax
call fcn.00458fb0
add esp, 0x10
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b6253
mov esp, ebp
pop ebp
ret
Function at 0x4857a0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
mov eax, dword [0x4f6fc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x314], 1
push str.SoftwareQualcommEudoraCommandline
lea eax, [ebp - 0x304]
push eax
call fcn.004b5e60
add esp, 8
lea ecx, [ebp - 0x204]
push ecx
push str.Current
lea edx, [ebp - 0x304]
push edx
push 0x80000001
call fcn.00487ad0
add esp, 0x10
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 0
je 0x485993
mov eax, 1
imul eax, eax, 0
mov dword [ebp - 0x310], eax
cmp dword [ebp - 0x310], 0xff
jae 0x485820
jmp 0x485825
call fcn.004b64ae
mov ecx, dword [ebp - 0x310]
mov byte [ebp + ecx - 0x104], 0
lea edx, [ebp - 0x204]
push edx
call fcn.004ca3dc
add esp, 4
push str.EUDORA.INI
lea eax, [ebp - 0x204]
push eax
call fcn.004b5ff0
add esp, 8
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 0
je 0x4858b8
mov ecx, dword [ebp - 0x308]
movsx edx, byte [ecx]
cmp edx, 0x20
jne 0x485890
mov eax, dword [ebp - 0x308]
add eax, 1
push eax
lea ecx, [ebp - 0x104]
push ecx
call fcn.004b5e60
add esp, 8
jmp 0x4858b8
mov edx, dword [ebp - 0x308]
sub edx, 1
mov dword [ebp - 0x308], edx
lea eax, [ebp - 0x204]
cmp dword [ebp - 0x308], eax
jne 0x4858af
jmp 0x4858b8
cmp dword [ebp - 0x314], 1
je 0x485865
mov ecx, 1
imul ecx, ecx, 0
movsx edx, byte [ebp + ecx - 0x104]
test edx, edx
je 0x485993
lea eax, [ebp - 0x104]
push eax
push 0xff
push 0x55f7c0
push 0x550587
push str.ReturnAddress
push 0x4eed8c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 0
jne 0x485931
lea ecx, [ebp - 0x104]
push ecx
push 0xff
push 0x55f7c0
push 0x550588
push str.POPAccount
push 0x4eeda4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 0x30c], eax
lea edx, [ebp - 0x104]
push edx
push 0xff
push 0x55f6c0
push 0x550589
push str.AutoReceiveAttachmentsDirectory
push 0x4eedd0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 0x30c], eax
lea eax, [ebp - 0x104]
push eax
push 0xff
push 0x55f5c0
push 0x55058a
push str.SMTPServer
push str.Settings
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 0x30c], eax
mov dword [0x4fa364], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b6253
mov esp, ebp
pop ebp
ret
Function at 0x4865a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4f6fc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x208], 1
mov eax, dword [ebp + 8]
push eax
push 3
call fcn.00440830
add esp, 8
cmp dword [0x4e145c], 1
jne 0x486640
push 1
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0x4f07f8
mov edx, dword [0x18a0254]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 0x210], eax
mov eax, dword [ebp + 8]
push eax
push 1
call fcn.00440830
add esp, 8
cmp dword [ebp - 0x210], 0
jne 0x486635
lea ecx, [ebp - 0x104]
push ecx
push 0x550812
push 0x4f0800
push 0x4f0810
call fcn.00458fb0
add esp, 0x10
mov dword [ebp - 0x208], 0
mov eax, dword [ebp - 0x208]
jmp 0x486708
cmp dword [0x4f07ac], 1
jne 0x486660
push 0x550890
call fcn.0048e220
add esp, 4
mov dword [0x4f07ac], 0
mov edx, 1
imul edx, edx, 0
movsx eax, byte [edx + 0x550890]
test eax, eax
jne 0x48669d
lea ecx, [ebp - 0x104]
push ecx
push 0x550813
push 0x4f0838
push str.MSG_Message_CantFindInternetBrowser
call fcn.00458fb0
add esp, 0x10
mov dword [ebp - 0x208], 0
jmp 0x486702
mov edx, dword [ebp + 8]
push edx
push 0x550890
push str._s__s
lea eax, [ebp - 0x204]
push eax
call fcn.004b6e08
add esp, 0x10
push 0
lea ecx, [ebp - 0x204]
push ecx
call fcn.00487ce0
add esp, 8
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
jne 0x486702
lea edx, [ebp - 0x104]
push edx
push 0x550814
push 0x4f0874
push str.MSG_Message_CantLaunchInternetBrowser
call fcn.00458fb0
add esp, 0x10
mov dword [ebp - 0x208], 0
mov eax, dword [ebp - 0x208]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b6253
mov esp, ebp
pop ebp
ret
Function at 0x4873e0
Capabilities:
Check if process is running under wine

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x4f6fc0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x5507c0], 1
jne 0x487401
jmp 0x48755e
mov dword [0x5507c0], 1
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x4ef760
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x110], eax
lea ecx, [ebp - 0x10c]
push ecx
push 0x20019
push 0
push str.SoftwareWine
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x110], 0
je 0x487469
cmp dword [ebp - 0x114], 0
jne 0x487554
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x4e145c], 1
push str.Linux_VersionTRUE
push 1
call fcn.00440830
add esp, 8
push str.DYNED_IS_MANAGED
call fcn.004ba5eb
add esp, 4
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x108]
push eax
push str.managed_user___d
lea ecx, [ebp - 0x104]
push ecx
call fcn.004b6e08
add esp, 0xc
lea edx, [ebp - 0x104]
push edx
push 1
call fcn.00440830
add esp, 8
cmp dword [ebp - 0x108], 0
je 0x487552
push str.DYNED_I_AM_ROOT
call fcn.004ba5eb
add esp, 4
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x108]
push eax
push str.root_user___d
lea ecx, [ebp - 0x104]
push ecx
call fcn.004b6e08
add esp, 0xc
lea edx, [ebp - 0x104]
push edx
push 1
call fcn.00440830
add esp, 8
cmp dword [ebp - 0x108], 0
je 0x487552
push 0x5507bf
push 0x5507c4
push 0x4ef7dc
push str.MSG_YouMayNotBeRootUser
call fcn.00458fb0
add esp, 0x10
push 0x5507c5
push 0x11ec
push str.IsLinux
call fcn.0042b120
add esp, 0xc
jmp 0x48755e
mov dword [0x4e145c], 0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b6253
mov esp, ebp
pop ebp
ret
Function at 0x487ad0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x4f6fc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x108], 0xff
lea eax, [ebp - 0x104]
mov dword [ebp - 0x118], eax
mov ecx, 1
imul ecx, ecx, 0
mov dword [ebp - 0x11c], ecx
cmp dword [ebp - 0x11c], 0xff
jae 0x487b1f
jmp 0x487b24
call fcn.004b64ae
mov edx, dword [ebp - 0x11c]
mov byte [ebp + edx - 0x104], 0
lea eax, [ebp - 0x110]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jne 0x487be6
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp - 0x118]
push ecx
push 0
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x110]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x10c], eax
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x10c], 0
jne 0x487be6
cmp dword [ebp - 0x108], 0xfe
jbe 0x487bb6
mov dword [ebp - 0x108], 0xfe
mov edx, dword [ebp - 0x108]
push edx
mov eax, dword [ebp - 0x118]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.004b8640
add esp, 0xc
mov edx, dword [ebp + 0x14]
add edx, dword [ebp - 0x108]
mov byte [edx], 0
mov dword [ebp - 0x114], 1
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b6253
mov esp, ebp
pop ebp
ret

Function at 0x487c00
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], 0xff
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
push 0x20006
push 0
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x14]
push edx
call fcn.004b5f60
add esp, 4
add eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
push 1
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x487c80
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
push 0x20006
push 0
push 0
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 4], eax
push 4
lea ecx, [ebp + 0x14]
push ecx
push 4
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4888b0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34c
mov eax, dword [0x4f6fc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 1
imul eax, eax, 0
movsx ecx, byte [eax + 0x5505c0]
test ecx, ecx
je 0x4888ef
push 0x5505c0
mov edx, dword [ebp + 8]
push edx
call fcn.004b5e60
add esp, 8
mov eax, dword [ebp + 8]
jmp 0x488a23
push str._none_
mov eax, dword [ebp + 8]
push eax
call fcn.004b5e60
add esp, 8
push str.SoftwareMicrosoft.NETFramework
push 0x5505c0
call fcn.004b5e60
add esp, 8
lea ecx, [ebp - 0x104]
push ecx
push str.InstallRoot
push 0x5505c0
push 0x80000002
call fcn.00487ad0
add esp, 0x10
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0
je 0x4889ea
push str.v.
lea edx, [ebp - 0x104]
push edx
call fcn.004b5e70
add esp, 8
lea eax, [ebp - 0x344]
push eax
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 0xffffffff
je 0x4889dd
lea edx, [ebp - 0x318]
push edx
lea eax, [ebp - 0x204]
push eax
call fcn.004b5e60
add esp, 8
mov ecx, dword [ebp - 0x344]
and ecx, 0x10
je 0x4889c5
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x204]
push eax
call fcn.004b68e0
add esp, 8
test eax, eax
jle 0x4889c5
lea ecx, [ebp - 0x204]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004b5e60
add esp, 8
lea eax, [ebp - 0x344]
push eax
mov ecx, dword [ebp - 0x348]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x48897a
mov edx, dword [ebp - 0x348]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp + 8]
push eax
push str..NET_Framework_version___s
push 0x5505c0
call fcn.004b6e08
add esp, 0xc
push 0x5505c0
push 0
call fcn.00440830
add esp, 8
mov ecx, dword [ebp + 8]
push ecx
push 0x5505c0
call fcn.004b5e60
add esp, 8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b6253
mov esp, ebp
pop ebp
ret

Function at 0x488a40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30c
mov eax, dword [0x4f6fc0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x104]
push eax
call fcn.00492580
add esp, 4
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 0
jne 0x488a76
jmp 0x488b0c
push 0x4f06c4
lea ecx, [ebp - 0x104]
push ecx
call fcn.0041a470
add esp, 8
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 0
je 0x488ad1
mov edx, dword [ebp - 0x308]
push edx
push 1
mov eax, dword [0x5507d8]
push eax
call fcn.004b5f60
add esp, 4
push eax
mov ecx, dword [0x5507d8]
push ecx
call fcn.004b9519
add esp, 0x10
mov edx, dword [ebp - 0x308]
push edx
call fcn.00419ca0
add esp, 4
jmp 0x488b0c
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 0x304]
push ecx
push 0x4f06d4
push 0
call fcn.004766d0
add esp, 0x10
push str.MSG_Message_CannotWriteFile
push 0x55080e
push 0x4f0734
lea edx, [ebp - 0x304]
push edx
call fcn.00458fb0
add esp, 0x10
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b6253
mov esp, ebp
pop ebp
ret
Function at 0x488e50
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30c
mov eax, dword [0x4f6fc0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x5507fc], 0
jne 0x488fbd
push 2
call fcn.0049ee40
add esp, 4
lea eax, [ebp - 0x204]
push eax
call fcn.0049d800
add esp, 4
push 0x4f03a4
lea ecx, [ebp - 0x204]
push ecx
call fcn.004b5e70
add esp, 8
lea edx, [ebp - 0x204]
push edx
push 0xff
lea eax, [ebp - 0x104]
push eax
push 0x4f03b0
push str.disable_QT_accleration
push 0x4f03cc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x104]
push ecx
call fcn.004ca3dc
add esp, 4
cmp dword [0x4e145c], 1
jne 0x488ef0
push 6
call fcn.004b4ed0
add esp, 4
mov word [ebp - 0x308], ax
jmp 0x488f2c
push 0x4f03d4
lea edx, [ebp - 0x104]
push edx
call fcn.004b5ff0
add esp, 8
test eax, eax
je 0x488f1b
push 2
call fcn.004b4ed0
add esp, 4
mov word [ebp - 0x308], ax
jmp 0x488f2c
push 0
call fcn.004b4ed0
add esp, 4
mov word [ebp - 0x308], ax
lea eax, [ebp - 0x104]
push eax
push str.disable_QT_accleration_s
lea ecx, [ebp - 0x304]
push ecx
call fcn.004b6e08
add esp, 0xc
lea edx, [ebp - 0x304]
push edx
push 1
call fcn.00440830
add esp, 8
push 1
call fcn.0049ee40
add esp, 4
movsx eax, word [ebp - 0x308]
test eax, eax
je 0x488f80
push str.Cannot_initialize_QuickTime_
push 0
call fcn.00440830
add esp, 8
xor eax, eax
jmp 0x488fc2
call fcn.004b5150
mov dword [0x5507fc], 1
push 0x5507e8
push 0x7174696d
call fcn.004b5130
add esp, 8
mov word [ebp - 0x30c], ax
movsx ecx, word [ebp - 0x30c]
test ecx, ecx
je 0x488fbd
mov dword [0x5507e8], 0
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b6253
mov esp, ebp
pop ebp
ret
Function at 0x490b40
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 1
mov dword [ebp - 8], 0xff
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x490b72
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x490e00
Capabilities:
Get local ipv4 addresses

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x4f6fc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x10c], 0
mov eax, 1
imul eax, eax, 0
mov ecx, dword [ebp + 8]
mov byte [ecx + eax], 0
push str.GetTheLocalMachineIM
push 0
call fcn.00440830
add esp, 8
lea edx, [ebp - 0x10c]
push edx
push 0
call sub.IPHLPAPI.DLL_GetAdaptersInfo
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x10c]
push eax
mov ecx, dword [ebp - 0x110]
push ecx
push str.GetTheLocalMachineIM_2_ret_d__OutBufLen_ld
lea edx, [ebp - 0x104]
push edx
call fcn.004b6e08
add esp, 0x10
lea eax, [ebp - 0x104]
push eax
push 0
call fcn.00440830
add esp, 8
cmp dword [ebp - 0x10c], 0
ja 0x490eaf
push str.OutBufLen_0
push 0
call fcn.00440830
add esp, 8
mov eax, dword [ebp - 0x114]
jmp 0x49106b
mov ecx, dword [ebp - 0x10c]
add ecx, 0x64
push ecx
call fcn.004b6c11
add esp, 4
mov dword [ebp - 0x118], eax
lea edx, [ebp - 0x10c]
push edx
mov eax, dword [ebp - 0x118]
push eax
call sub.IPHLPAPI.DLL_GetAdaptersInfo
mov dword [ebp - 0x110], eax
mov ecx, dword [ebp - 0x10c]
push ecx
mov edx, dword [ebp - 0x110]
push edx
push str.GetTheLocalMachineIM_4_ret_d__OutBufLen_ld
lea eax, [ebp - 0x104]
push eax
call fcn.004b6e08
add esp, 0x10
lea ecx, [ebp - 0x104]
push ecx
push 0
call fcn.00440830
add esp, 8
cmp dword [ebp - 0x110], 0
je 0x490f45
push str.ret_ERROR_SUCCESS
push 0
call fcn.00440830
add esp, 8
mov edx, dword [ebp - 0x118]
push edx
call fcn.004b6bd9
add esp, 4
mov eax, dword [ebp - 0x114]
jmp 0x49106b
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
je 0x491056
mov ecx, dword [ebp - 0x108]
add ecx, 0x1b0
je 0x491043
push str.0.0.0.0
mov edx, dword [ebp - 0x108]
add edx, 0x1b0
push edx
call fcn.004b68e0
add esp, 8
test eax, eax
je 0x491043
push 0x10
mov eax, dword [ebp - 0x108]
add eax, 0x1b0
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004b69f0
add esp, 0xc
mov edx, 1
shl edx, 4
mov eax, dword [ebp + 8]
mov byte [eax + edx], 0
mov ecx, dword [ebp + 8]
push ecx
push 0x4f173c
lea edx, [ebp - 0x104]
push edx
call fcn.004b6e08
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
push 0
call fcn.00440830
add esp, 8
push 0x10
mov ecx, dword [ebp - 0x108]
add ecx, 0x1c0
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.004b69f0
add esp, 0xc
mov eax, 1
shl eax, 4
mov ecx, dword [ebp + 0xc]
mov byte [ecx + eax], 0
mov edx, dword [ebp + 0xc]
push edx
push str.GetTheLocalMachineIM__s
lea eax, [ebp - 0x104]
push eax
call fcn.004b6e08
add esp, 0xc
lea ecx, [ebp - 0x104]
push ecx
push 0
call fcn.00440830
add esp, 8
mov dword [ebp - 0x114], 1
jmp 0x491056
mov edx, dword [ebp - 0x108]
mov eax, dword [edx]
mov dword [ebp - 0x108], eax
jmp 0x490f51
mov ecx, dword [ebp - 0x118]
push ecx
call fcn.004b6bd9
add esp, 4
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b6253
mov esp, ebp
pop ebp
ret