joyce8/EMBER2024-capa huggingface dataset:
Function at 0x479680
Capabilities:
Get common file path

Disassembly:
sub esp, 0x418
mov eax, dword [0x57c074]
xor eax, esp
mov dword [esp + 0x414], eax
push ebx
push esi
lea eax, [esp + 0x214]
mov ebx, edx
push eax
push 0x104
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x4796ca
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x414]
xor ecx, esp
call fcn.004d9b30
add esp, 0x418
ret
lea eax, [esp + 0xc]
push eax
push 0
push dword [esi]
lea eax, [esp + 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x4796b1
push ebp
lea eax, [esp + 0x10]
push edi
push eax
call fcn.004dfc45
mov esi, dword [ebx]
mov edi, eax
add esp, 4
test edi, edi
jne 0x479783
lea ecx, [esi - 0x10]
mov edi, dword [ecx]
cmp dword [ecx + 4], eax
je 0x47982d
cmp dword [ecx + 0xc], eax
lea edx, [ecx + 0xc]
jge 0x47972e
cmp dword [esi - 8], eax
jl 0x479848
mov dword [esi - 0xc], eax
xor ecx, ecx
mov eax, dword [ebx]
mov word [eax], cx
jmp 0x47982d
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x47975b
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, 0x533850
jne 0x479852
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [edi]
cmp eax, 0x533850
jne 0x47985b
lock inc dword [edi + 0x14]
lea eax, [edi + 8]
add eax, 0x10
mov dword [ebx], eax
jmp 0x47982d
add eax, 0x10
mov dword [ebx], eax
jmp 0x47982d
mov eax, dword [esi - 0xc]
lea ebp, [esp + 0x14]
sub ebp, esi
mov dword [esp + 0x10], eax
sar ebp, 1
test edi, edi
js 0x479865
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or ecx, eax
jge 0x4797b5
push edi
mov ecx, ebx
call fcn.0040d80a
mov esi, dword [ebx]
lea ecx, [edi + edi]
cmp ebp, dword [esp + 0x10]
ja 0x479803
mov eax, dword [esi - 8]
lea edx, [esi + ebp*2]
test ecx, ecx
je 0x47981b
test edx, edx
jne 0x4797de
call fcn.004dfd74
mov dword [eax], 0x16
call fcn.004dfbe5
jmp 0x479818
add eax, eax
cmp eax, ecx
jae 0x4797f6
call fcn.004dfd74
mov dword [eax], 0x22
call fcn.004dfbe5
jmp 0x479818
push ecx
push edx
push esi
call fcn.004db7c0
add esp, 0xc
jmp 0x479818
mov edx, dword [esi - 8]
lea eax, [esp + 0x14]
push ecx
push eax
add edx, edx
mov ecx, esi
call fcn.0040d8e3
add esp, 8
lea ecx, [edi + edi]
mov eax, dword [ebx]
cmp edi, dword [eax - 8]
jg 0x479848
mov dword [eax - 0xc], edi
xor edx, edx
mov eax, dword [ebx]
mov word [ecx + eax], dx
mov ecx, dword [esp + 0x424]
mov al, 1
pop edi
pop ebp
pop esi
pop ebx
xor ecx, esp
call fcn.004d9b30
add esp, 0x418
ret
push 0x80070057
call fcn.0040d968
mov ecx, edx
call esi
jmp 0x47975b
mov ecx, edi
call dword [eax + 0xc]
jmp 0x479779
push 0x80070057
call fcn.0040d968
int3
Function at 0x47a9c0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x514e58
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x57c074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x14], 0x532e68
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
cmp esi, 0xffffffff
jne 0x47aa22
or esi, eax
xor bl, bl
jmp 0x47aa38
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
jne 0x47aa34
xor bl, bl
jmp 0x47aa38
mov dword [edi], eax
mov bl, 1
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], 0x532e68
test esi, esi
je 0x47aa58
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x47aa70
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x514d10
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x57c074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
lea ecx, [ebp - 0x10]
call fcn.0047ab20
mov dword [ebp - 4], 0
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
sete bl
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov esi, dword [ebp - 0x10]
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x47aaff
mov edx, dword [esi]
push esi
mov ecx, dword [edx]
mov eax, dword [ecx + 4]
cmp ecx, 0x533850
jne 0x47ab12
mov ecx, dword [edx + 4]
push 0
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edx
call eax
jmp 0x47aaff
Function at 0x47b430
Capabilities:
Query environment variable

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
push 0
push 0
push ebx
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test edi, edi
jne 0x47b4df
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
lea ecx, [eax - 0x10]
mov edi, dword [ecx]
je 0x47b47c
cmp dword [ecx + 0xc], 0
lea edx, [ecx + 0xc]
jge 0x47b484
cmp dword [eax - 8], 0
jl 0x47b53e
mov dword [eax - 0xc], 0
xor ecx, ecx
mov eax, dword [esi]
mov word [eax], cx
pop edi
pop esi
xor eax, eax
pop ebx
ret 4
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x47b4b1
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov ebx, dword [eax + 4]
cmp eax, 0x533850
jne 0x47b548
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [edi]
cmp eax, 0x533850
jne 0x47b551
lock inc dword [edi + 0x14]
lea eax, [edi + 8]
add eax, 0x10
pop edi
mov dword [esi], eax
xor eax, eax
pop esi
pop ebx
ret 4
add eax, 0x10
pop edi
mov dword [esi], eax
xor eax, eax
pop esi
pop ebx
ret 4
js 0x47b55b
mov edx, dword [esi]
mov ecx, 1
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, edi
or ecx, eax
jge 0x47b4fe
push edi
mov ecx, esi
call fcn.0040d80a
mov edx, dword [esi]
push edi
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov eax, dword [esi]
test eax, eax
jne 0x47b511
xor ecx, ecx
jmp 0x47b523
push dword [eax - 8]
push eax
call fcn.004e2917
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x47b53e
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x47b53e
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [esi]
pop edi
pop esi
pop ebx
mov word [eax + ecx*2], dx
lea eax, [edx + 1]
ret 4
push 0x80070057
call fcn.0040d968
mov ecx, edx
call ebx
jmp 0x47b4b1
mov ecx, edi
call dword [eax + 0xc]
jmp 0x47b4d2
push 0x80070057
call fcn.0040d968
int3
Function at 0x488892
Capabilities:
Print debug messages

Disassembly:
push 8
mov eax, 0x516174
call fcn.004da733
mov bl, dl
mov edi, ecx
cmp byte [0x57f5ec], 0
je 0x4888ef
lea ecx, [ebp - 0x10]
call fcn.0040cf67
and dword [ebp - 4], 0
mov esi, dword [edi]
test esi, esi
je 0x4888ce
push esi
call fcn.004dfc45
pop ecx
push eax
push esi
lea ecx, [ebp - 0x10]
call fcn.0041107c
lea eax, [ebp - 0x10]
mov ecx, 0x57f5b8
push eax
call fcn.004a12ac
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 1
call fcn.0040d22d
or dword [ebp - 4], 0xffffffff
cmp byte [0x57cb1c], 0
push dword [edi]
je 0x48894c
lea ecx, [ebp - 0x10]
call fcn.0040da2c
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 2
call fcn.0040cf67
movzx ecx, bl
shl ecx, 0x12
add ecx, 0x10
mov byte [ebp - 4], 3
push ecx
push eax
call dword [sym.imp.USER32.dll_GetActiveWindow]
lea edx, [ebp - 0x10]
mov ecx, eax
call fcn.004758c0
pop ecx
pop ecx
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.0040d22d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0040d22d
jmp 0x488952
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call fcn.004da6fc
ret
Function at 0x48a9c4
Capabilities:
Reference sql statements

Disassembly:
push 0x10
mov eax, 0x5166c7
call fcn.004da733
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
mov esi, dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
cmp dword [ebp - 0x18], ebx
je 0x48a9e8
push dword [ebp - 0x18]
call esi
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x18]
push ecx
push 1
mov dword [ebp - 0x18], ebx
push dword [eax]
call dword [sym.imp.msi.dll_MsiOpenProductW]
test eax, eax
jne 0x48ab58
lea ecx, [ebp - 0x1c]
call fcn.0040cf67
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 1
push dword [eax]
lea eax, [ebp - 0x1c]
push str.SELECT__Value__FROM__Property__WHERE_Property_s
push eax
call fcn.0041186f
add esp, 0xc
mov dword [ebp - 0x10], ebx
mov byte [ebp - 4], 2
cmp dword [ebp - 0x10], 0
je 0x48aa38
push dword [ebp - 0x10]
call esi
mov edi, dword [sym.imp.msi.dll_MsiEnumClientsA]
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x1c]
mov dword [ebp - 0x10], ebx
push dword [ebp - 0x18]
call edi
test eax, eax
jne 0x48ab3d
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.msi.dll_MsiViewModify]
test eax, eax
jne 0x48ab3d
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], 3
cmp dword [ebp - 0x14], eax
je 0x48aa78
push dword [ebp - 0x14]
call esi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
push eax
push dword [ebp - 0x10]
call dword [sym.imp.msi.dll_MsiDatabaseIsTablePersistentA]
cmp eax, 0x103
setne bl
cmp dword [ebp - 0x10], 0
mov byte [ebp + 0xb], bl
je 0x48aa9e
push dword [ebp - 0x10]
call esi
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, str.INSERT_INTO__Property____Property____Value___VALUES_______
test bl, bl
mov eax, str.UPDATE__Property__SET__Property_._Value___WHERE_Property_
cmove eax, ecx
push eax
push dword [ebp - 0x18]
call edi
test eax, eax
jne 0x48ab2c
push 2
call dword [sym.imp.msi.dll_MsiDatabaseExportA]
cmp dword [ebp - 0x14], 0
mov edi, eax
je 0x48aad4
push dword [ebp - 0x14]
call esi
mov dword [ebp - 0x14], edi
test edi, edi
je 0x48ab2c
mov eax, dword [ebp + 0xc]
test bl, bl
mov ebx, dword [ebp + 0x10]
cmovne eax, ebx
push dword [eax]
push 1
push edi
mov edi, dword [sym.imp.msi.dll_MsiReinstallFeatureW]
call edi
test eax, eax
jne 0x48ab2c
cmp byte [ebp + 0xb], al
cmovne ebx, dword [ebp + 0xc]
push dword [ebx]
push 2
push dword [ebp - 0x14]
call edi
test eax, eax
jne 0x48ab2c
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call dword [sym.imp.msi.dll_MsiViewModify]
test eax, eax
jne 0x48ab2c
push dword [ebp - 0x18]
call dword [sym.imp.msi.dll_MsiDatabaseGenerateTransformW]
test eax, eax
jne 0x48ab2c
mov bl, 1
jmp 0x48ab2e
xor bl, bl
mov byte [ebp - 4], 2
cmp dword [ebp - 0x14], 0
je 0x48ab3d
push dword [ebp - 0x14]
call esi
mov byte [ebp - 4], 1
cmp dword [ebp - 0x10], 0
je 0x48ab4c
push dword [ebp - 0x10]
call esi
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0
call fcn.0040d22d
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], 0
je 0x48ab67
push dword [ebp - 0x18]
call esi
mov al, bl
call fcn.004da6fc
ret 0xc
Function at 0x48b354
Capabilities:
Reference sql statements

Disassembly:
push ebp
sub esp, 0x200
lea ebp, [esp - 4]
mov eax, dword [0x57c074]
xor eax, ebp
mov dword [ebp + 0x200], eax
push 0x10
mov eax, 0x5168a3
call fcn.004da733
mov esi, edx
mov dword [ebp - 0x1c], ecx
mov ebx, dword [ebp + 0x20c]
push dword [ebx + 4]
call fcn.004da275
and dword [ebx + 4], 0
lea eax, [ebp]
and dword [ebx], 0
push esi
push str.SELECT__Text__FROM__UIText__WHERE__Key____s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
and dword [ebp - 0x14], 0
add esp, 0x10
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0
mov edi, dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
je 0x48b3be
push dword [ebp - 0x14]
call edi
push dword [ebp - 0x1c]
and dword [ebp - 0x14], 0
lea edx, [ebp - 0x14]
lea ecx, [ebp]
call fcn.0048b5b2
pop ecx
test eax, eax
jns 0x48b3dc
xor bl, bl
jmp 0x48b487
and dword [ebp - 0x10], 0
mov byte [ebp - 4], 1
cmp dword [ebp - 0x10], 0
je 0x48b3ef
push dword [ebp - 0x10]
call edi
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x14], eax
je 0x48b42a
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.msi.dll_MsiDatabaseIsTablePersistentA]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
jns 0x48b425
cmp esi, 0x80070103
je 0x48b425
call fcn.0048b68d
mov eax, dword [ebp - 0x10]
jmp 0x48b42f
mov esi, 0x80070057
test esi, esi
jns 0x48b437
xor bl, bl
jmp 0x48b478
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x18]
mov esi, dword [sym.imp.msi.dll_MsiRecordSetStreamA]
push ecx
push 0x533080
push 1
push eax
call esi
cmp eax, 0xea
jne 0x48b473
mov eax, dword [ebp - 0x18]
mov ecx, ebx
inc eax
push eax
mov dword [ebp - 0x18], eax
call fcn.00483800
lea eax, [ebp - 0x18]
push eax
push dword [ebx + 4]
push 1
push dword [ebp - 0x10]
call esi
test eax, eax
sete bl
mov byte [ebp - 4], 0
cmp dword [ebp - 0x10], 0
je 0x48b487
push dword [ebp - 0x10]
call edi
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
je 0x48b496
push dword [ebp - 0x14]
call edi
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x200]
xor ecx, ebp
call fcn.004d9b30
lea esp, [ebp + 0x204]
pop ebp
ret
Function at 0x48b968
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x516921
call fcn.004da733
lea eax, [ebp - 0x1c]
push eax
movzx eax, byte [ebp + 0xc]
shl eax, 8
inc eax
push eax
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0x14
pop edi
push edi
mov esi, eax
mov dword [ebp - 0x18], 1
call fcn.004da27a
or dword [ebp - 0x34], 0xffffffff
mov ebx, eax
mov dword [ebp - 0x30], ebx
and dword [ebp - 4], 0
push edi
mov dword [ebp - 0x10], edi
call fcn.004da27a
or dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 1
push eax
mov dword [ebp + 0xc], edi
call fcn.004da275
and dword [ebp - 0x28], 0
and dword [ebp - 0x2c], 0
push edi
call fcn.004da27a
or dword [ebp - 0x2c], 0xffffffff
mov edi, eax
xor eax, eax
mov dword [ebp - 0x28], edi
add esp, 0x10
mov dword [ebp - 0x14], eax
test esi, esi
jne 0x48baac
mov esi, str.AI_InstallLanguage
lea ecx, [ebp + 0xc]
push ecx
push edi
lea ecx, [ebp - 0x18]
push ecx
push 0
lea ecx, [ebp - 0x10]
push ecx
push ebx
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [ebp - 0x24], eax
cmp eax, 0xea
jne 0x48ba74
push ebx
call fcn.004da275
push dword [ebp - 0x10]
and dword [ebp - 0x30], 0
and dword [ebp - 0x34], 0
call fcn.004da27a
or dword [ebp - 0x34], 0xffffffff
mov ebx, eax
push edi
mov dword [ebp - 0x30], ebx
call fcn.004da275
push dword [ebp + 0xc]
and dword [ebp - 0x28], 0
and dword [ebp - 0x2c], 0
call fcn.004da27a
or dword [ebp - 0x2c], 0xffffffff
add esp, 0x10
mov edi, eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x28], edi
push eax
push edi
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov ecx, ebx
lea eax, [esi - 1]
sub ecx, str.AI_InstallLanguage
mov dword [ebp - 0x20], ecx
inc eax
mov cl, byte [ecx + eax]
mov dl, byte [eax]
cmp cl, dl
jl 0x48ba9b
jg 0x48ba9b
test cl, cl
je 0x48badc
test dl, dl
je 0x48badc
mov ecx, dword [ebp - 0x20]
jmp 0x48ba82
mov eax, dword [ebp - 0x14]
inc eax
cmp dword [ebp - 0x24], 0
mov dword [ebp - 0x14], eax
je 0x48b9f3
xor esi, esi
push edi
mov byte [ebp - 4], 0
call fcn.004da275
and dword [ebp - 0x28], 0
and dword [ebp - 0x2c], 0
or dword [ebp - 4], 0xffffffff
push ebx
call fcn.004da275
and dword [ebp - 0x30], 0
mov eax, esi
and dword [ebp - 0x34], 0
pop ecx
pop ecx
call fcn.004da6fc
ret
or dword [ebp - 0x24], 0xffffffff
lea edx, [ebp - 0x24]
push ecx
mov ecx, edi
call fcn.004839f0
pop ecx
mov esi, eax
jmp 0x48baae
Function at 0x48efea
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x57c074]
xor eax, ebp
mov dword [ebp - 4], eax
test byte [ecx + 0x74], 1
push ebx
push esi
push edi
je 0x48f074
test dword [ecx + 0x74], 0x2000
jne 0x48f074
call fcn.0048f8f8
mov edi, eax
mov ecx, dword [edi]
cmp dword [ecx - 0xc], 3
jl 0x48f074
xor esi, esi
mov ecx, edi
push esi
call fcn.004738e0
push 0x5c
pop ebx
cmp ax, bx
jne 0x48f049
push 1
mov ecx, edi
call fcn.004738e0
cmp ax, bx
jne 0x48f049
push 2
mov ecx, edi
call fcn.004738e0
cmp ax, bx
jne 0x48f074
push esi
mov ecx, edi
call fcn.004738e0
mov word [ebp + esi*2 - 0xc], ax
inc esi
cmp esi, 3
jl 0x48f049
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
setne al
jmp 0x48f076
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d9b30
mov esp, ebp
pop ebp
ret

Function at 0x48f087
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
push 0x10
mov eax, 0x517268
call fcn.004da733
mov esi, ecx
mov dword [ebp - 0x1c], esi
call fcn.0048f8f8
lea ecx, [ebp - 0x10]
mov edi, eax
call fcn.00478060
and dword [ebp - 4], 0
push 0x5c
push dword [edi]
call fcn.004dde17
pop ecx
pop ecx
test eax, eax
jne 0x48f0bf
or eax, 0xffffffff
jmp 0x48f0c3
sub eax, dword [edi]
sar eax, 1
inc eax
mov ecx, edi
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00406ec6
xor ebx, ebx
lea ecx, [ebp - 0x10]
inc ebx
mov byte [ebp - 4], bl
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.0041107c
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0
call fcn.0040d22d
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x48f10c
push 0x80
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
push dword [ebp - 0x10]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x48f125
mov dword [esi + 0x14], ebx
jmp 0x48f1a9
push edi
push 3
lea ecx, [esi + 0x1c]
call fcn.0049aa7d
lea ecx, [ebp - 0x14]
call fcn.0040cf67
push 0
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 2
push eax
lea ecx, [esi + 0x1c]
call fcn.0049ab8e
mov byte [ebp - 4], 3
push dword [eax]
lea eax, [ebp - 0x14]
push dword [ebp - 0x10]
push 0x541034
push eax
call fcn.0041186f
add esp, 0x10
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.0040d22d
mov esi, dword [ebp - 0x1c]
lea ecx, [esi + 0x184]
call fcn.0049530c
push 0
push 0x20
push 0
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0x10]
call fcn.0049b7de
add esp, 0xc
test al, al
jne 0x48f19b
mov dword [esi + 0x14], ebx
jmp 0x48f19d
xor ebx, ebx
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call fcn.0040d22d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0040d22d
mov eax, ebx
call fcn.004da6fc
ret
Function at 0x490144
Capabilities:
Write file on windows

Disassembly:
push 0x30
mov eax, 0x517521
call fcn.004da733
mov esi, ecx
mov eax, dword [esi + 0x1d8]
test eax, eax
je 0x490281
cmp eax, 0xffffffff
je 0x490281
lea ecx, [ebp - 0x1c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [ebp - 0x1c], 0x103
jne 0x490281
lea ecx, [ebp - 0x3c]
call fcn.004a2fa8
xor ebx, ebx
lea ecx, [ebp - 0x18]
push str.Advinst_Estimate_
mov dword [ebp - 4], ebx
call fcn.0040da2c
mov byte [ebp - 4], 1
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.0048f8f8
push ecx
lea edx, [ebp - 0x28]
mov ecx, dword [eax]
call fcn.004836b0
pop ecx
push dword [ebp - 0x24]
lea ecx, [ebp - 0x14]
call fcn.0047b2b0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x20]
push dword [ebp - 0x14]
call fcn.004887cf
push eax
lea edx, [ebp - 0x18]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x10]
call fcn.004734e0
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 5
call fcn.004a2fe6
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.0040d22d
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 3
call fcn.0040d22d
push str.CLOSE
lea ecx, [ebp - 0x10]
call fcn.0040da2c
mov byte [ebp - 4], 6
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0x10]
push ebx
push edx
mov ecx, dword [eax - 0xc]
add ecx, ecx
push ecx
push eax
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.0040d22d
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.0040d22d
mov byte [ebp - 4], 1
push dword [ebp - 0x24]
call fcn.004da275
pop ecx
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov byte [ebp - 4], bl
call fcn.0040d22d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.004a30bf
call fcn.004da6fc
ret
Function at 0x49103a
Capabilities:
Delete directory
Delete file

Disassembly:
push 0x24
mov eax, 0x517759
call fcn.004da733
mov edi, ecx
mov dword [ebp - 0x14], edi
cmp byte [edi + 0xc0], 0
je 0x4911b9
cmp byte [edi + 0xd8], 0
jne 0x4911b9
xor ebx, ebx
inc ebx
cmp dword [edi + 0x90], 3
je 0x491092
call fcn.00492f82
mov eax, dword [edi + 0x90]
cmp eax, 2
je 0x491092
cmp eax, ebx
je 0x491092
test byte [edi + 0x44], 0x48
je 0x491092
mov ecx, edi
call fcn.00491ba2
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 4], bl
mov ebx, ecx
mov eax, dword [edi + 0xa8]
mov dword [ebp - 0x18], eax
test eax, eax
jle 0x491100
lea eax, [edi + 0xa4]
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
push ebx
mov ecx, eax
call fcn.00412720
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x4910f5
mov ecx, dword [ebp - 0x10]
push ebx
call fcn.00412720
push eax
lea ecx, [ebp - 0x30]
call fcn.004701a0
mov eax, dword [ebp - 0x10]
inc ebx
cmp ebx, edi
jl 0x4910c7
mov edi, dword [ebp - 0x14]
mov ebx, dword [edi + 0xb4]
lea eax, [edi + 0xb0]
sub ebx, 1
mov dword [ebp - 0x18], eax
js 0x49114b
mov edi, eax
push ebx
mov ecx, edi
call fcn.00412720
push dword [eax]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x491143
push ebx
mov ecx, edi
call fcn.00412720
push eax
lea ecx, [ebp - 0x24]
call fcn.004701a0
sub ebx, 1
jns 0x491116
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x30]
push eax
lea ecx, [edi + 0xa4]
call fcn.0049479b
lea ebx, [edi + 0xb0]
mov ecx, ebx
call fcn.00456e1f
mov esi, dword [ebp - 0x20]
jmp 0x49117d
push esi
lea ecx, [ebp - 0x24]
call fcn.00412720
push eax
mov ecx, ebx
call fcn.004701a0
sub esi, 1
jns 0x49116c
cmp dword [edi + 0xa8], 0
jne 0x491199
cmp dword [edi + 0xb4], 0
jne 0x491199
xor eax, eax
inc eax
jmp 0x49119b
xor al, al
mov byte [edi + 0xd8], al
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0
call fcn.00456e1f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00456e1f
call fcn.004da6fc
ret