joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46ac02
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x54e61c]
push esi
mov esi, ecx
cmp eax, dword [0x54e620]
je 0x46ac1f
push ecx
push 0x54e61c
call fcn.0043c037
pop esi
ret
push 8
call fcn.004da35a
pop ecx
mov edx, eax
xor ecx, ecx
test edx, edx
je 0x46ac36
mov dword [edx], ecx
mov dword [edx + 4], ecx
jmp 0x46ac38
mov edx, ecx
mov eax, dword [esi]
push ecx
push ecx
push edx
push 0x46acd2
push ecx
mov dword [edx], eax
mov eax, dword [esi + 4]
push ecx
mov dword [edx + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop esi
ret

Function at 0x46b3cc
Capabilities:
Read .ini file

Disassembly:
push 0x228
mov eax, 0x5037ac
call fcn.004e6cea
mov esi, dword [ebp + 8]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
mov edi, 0xfffffff
lea eax, [ebp - 0x216]
push eax
call fcn.004deff0
add esp, 0xc
lea eax, [ebp - 0x218]
push esi
push 0x104
push eax
push 0x512700
push str.SLG_time
push 0x513960
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x218], 0
je 0x46b4b8
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov eax, dword [0x548750]
mov dword [ebp - 0x22c], eax
and dword [ebp - 4], 0
movzx eax, word [ebp - 0x222]
push eax
movzx eax, word [ebp - 0x226]
push eax
movzx eax, word [ebp - 0x228]
push eax
lea eax, [ebp - 0x22c]
push 0x52a498
push eax
call fcn.0040306c
add esp, 0x10
lea eax, [ebp - 0x218]
mov ecx, esp
mov dword [ebp - 0x234], esp
push eax
call fcn.00404fa0
push ecx
lea eax, [ebp - 0x22c]
mov byte [ebp - 4], 1
mov ecx, esp
push eax
call fcn.0040291d
mov byte [ebp - 4], 0
call fcn.0046dd2b
pop ecx
pop ecx
lea ecx, [ebp - 0x22c]
mov edi, eax
call fcn.00403080
mov eax, edi
call fcn.004e6c99
ret

Function at 0x46b5f0
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 4], 0
je 0x46b608
push 0
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
and dword [esi + 4], 0
mov ecx, esi
call fcn.0046b676
lea ecx, [esi + 0x4bc]
call fcn.00403080
lea ecx, [esi + 0x4b8]
call fcn.00403080
lea ecx, [esi + 0x4ac]
call fcn.004114d2
lea ecx, [esi + 0x4a0]
call fcn.004114d2
lea ecx, [esi + 0x494]
call fcn.0046d34f
lea ecx, [esi + 0x488]
call fcn.0046d4db
lea ecx, [esi + 0x480]
call fcn.004249eb
lea ecx, [esi + 0x478]
call fcn.0046d27b
lea eax, [esi + 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
pop esi
ret
Function at 0x46b937
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push ebx
push SysReAllocStringLen
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x46b961
xor eax, eax
jmp 0x46ba1f
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x46b97a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x46b9d7
lea ebx, [edi + 1]
push ebx
call fcn.004d980f
push ebx
push 0
push eax
mov dword [ebp - 8], eax
call fcn.004deff0
and dword [ebp - 0xc], 0
add esp, 0x10
test edi, edi
je 0x46b9c3
mov ebx, dword [ebp - 0xc]
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push 0
push eax
mov eax, edi
sub eax, ebx
push eax
mov eax, dword [ebp - 8]
add eax, ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
add ebx, dword [ebp - 4]
cmp edi, ebx
jne 0x46b99d
lea ebx, [edi + 1]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call fcn.004d980f
mov esi, eax
pop ecx
test esi, esi
jne 0x46b9db
xor eax, eax
jmp 0x46ba1e
push ebx
push 0
push esi
call fcn.004deff0
mov ebx, dword [ebp - 8]
add esp, 0xc
mov edx, esi
push 0x100
push ecx
push edi
mov ecx, ebx
call fcn.00413dcd
push esi
call fcn.0040680a
mov ecx, dword [ebp + 8]
add esp, 0x10
push eax
push esi
call fcn.00406919
push ebx
call fcn.004d9740
push esi
call fcn.004d9740
pop ecx
xor eax, eax
pop ecx
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46cfd1
Capabilities:
Read .ini file

Disassembly:
push 8
mov eax, 0x4fc989
call fcn.004e6cb7
push dword [ebp + 8]
call fcn.004b71a6
test eax, eax
jne 0x46cff0
xor ebx, ebx
inc ebx
mov esi, ebx
jmp 0x46d012
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.004b21fb
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x10]
xor ebx, ebx
xor esi, esi
inc ebx
cmp dword [eax - 8], esi
cmove esi, ebx
call fcn.00403080
mov eax, dword [0x548750]
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
mov dword [ebp - 0x14], eax
push dword [ebp + 8]
lea eax, [ebp - 0x10]
mov byte [ebp - 4], bl
push 0x52268c
push eax
call fcn.0040306c
add esp, 0xc
push dword [0x549e80]
push 0
push dword [ebp - 0x10]
push str.SLGAddGameID
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
xor ecx, ecx
cmp eax, 0xffffffff
cmove esi, ecx
lea ecx, [ebp - 0x14]
call fcn.00403080
lea ecx, [ebp - 0x10]
call fcn.00403080
mov eax, esi
call fcn.004e6c85
ret 4
Function at 0x46db8c
Capabilities:
Get file size
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x5475b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], edx
xor eax, eax
mov byte [ebp - 0x14], bl
lea edi, [ebp - 0x13]
mov dword [ebp - 0x30], 0x10
stosd dword es:[edi], eax
mov esi, ecx
push 0xf0000000
push 1
push ebx
stosd dword es:[edi], eax
push ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push 0x8003
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
push ebx
test eax, eax
jne 0x46dbfd
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
jmp 0x46dd1a
push 0x80
push 3
push ebx
push ebx
push SysReAllocStringLen
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x28], edi
cmp edi, 0xffffffff
jne 0x46dc28
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push ebx
jmp 0x46dbed
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0x400
push 1
call fcn.004dda5a
mov esi, eax
mov dword [ebp - 0x2c], esi
pop ecx
pop ecx
test esi, esi
jne 0x46dc6f
jmp 0x46dc1c
cmp dword [ebp - 0x20], ebx
je 0x46dc88
push ebx
push dword [ebp - 0x20]
push esi
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x46dc88
push 0x400
push ebx
push esi
call fcn.004deff0
add esp, 0xc
push ebx
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], ebx
push eax
push 0x400
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x46dc49
push ebx
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x14]
push eax
push 2
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x46dcca
mov edi, dword [ebp - 0x24]
mov esi, ebx
movzx eax, byte [ebp + esi - 0x14]
push eax
push str._02x
push 3
push edi
call fcn.004daa17
add esp, 0x10
add edi, 2
inc esi
cmp esi, 0x10
jl 0x46dca5
mov esi, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x28]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push ebx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.004da742
mov edi, dword [ebp - 0x24]
mov esi, edi
pop ecx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x46dcf3
sub esi, ecx
test esi, esi
jle 0x46dd17
movsx ax, byte [edi + ebx]
movzx eax, ax
push eax
call fcn.004dda49
mov byte [edi + ebx], al
inc ebx
pop ecx
cmp ebx, esi
jl 0x46dd00
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d9731
mov esp, ebp
pop ebp
ret
Function at 0x46f8c8
Capabilities:
Read .ini file

Disassembly:
push 0x19c
mov eax, 0x504008
call fcn.004e6cea
mov edi, ecx
push dword [0x549e80]
mov esi, str.favorite
push 1
push str.AutoAddIEFav
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
xor ebx, ebx
test eax, eax
je 0x46f909
call fcn.0046eab5
push ebx
push str.AutoAddIEFav
push esi
call fcn.00433e43
mov eax, dword [0x548750]
mov esi, ebx
mov dword [ebp - 0x190], eax
push str.SimpleBrowser.xml
push 0x54dbe8
lea eax, [ebp - 0x190]
mov dword [ebp - 4], ebx
push 0x511e14
push eax
call fcn.0040306c
add esp, 0x10
lea ecx, [ebp - 0x18c]
call fcn.004b14f8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18c]
push dword [ebp - 0x190]
call fcn.004b1527
test eax, eax
je 0x46fa2a
mov dword [ebp - 0x194], ebx
mov dword [ebp - 0x198], ebx
lea eax, [ebp - 0x198]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x18c]
call fcn.004b16c4
mov dword [ebp - 0x1a4], ebx
mov dword [ebp - 0x1a8], ebx
lea eax, [ebp - 0x1a8]
mov byte [ebp - 4], 3
push eax
push str.favorite
lea ecx, [ebp - 0x198]
call fcn.004b0e79
test eax, eax
je 0x46f9bd
push edi
xor edx, edx
lea ecx, [ebp - 0x1a8]
call fcn.0046f3ad
pop ecx
mov esi, eax
mov dword [ebp - 0x19c], ebx
mov dword [ebp - 0x1a0], ebx
lea eax, [ebp - 0x1a0]
mov byte [ebp - 4], 4
push eax
push str.favoritefloder
lea ecx, [ebp - 0x198]
call fcn.004b0e79
test eax, eax
je 0x46f9fd
xor edx, edx
lea ecx, [ebp - 0x1a0]
push edi
inc edx
call fcn.0046f3ad
test eax, eax
pop ecx
cmovne esi, eax
lea ecx, [ebp - 0x1a0]
mov byte [ebp - 4], 3
call fcn.004b0e4e
lea ecx, [ebp - 0x1a8]
mov byte [ebp - 4], 2
call fcn.004b0e4e
lea ecx, [ebp - 0x198]
mov byte [ebp - 4], 1
call fcn.004b0e4e
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], bl
call dword [sym.imp.tinyxml.dll_public_virtual:_void___thiscall_TiXmlDocument::destructor_void_]
lea ecx, [ebp - 0x190]
call fcn.00403080
mov eax, esi
call fcn.004e6c99
ret
Function at 0x46fa9b
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x504068
mov eax, dword fs:[0]
push eax
mov eax, 0x1014
call fcn.004eaef0
mov eax, dword [0x5475b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
and dword [ebp - 0x101c], 0
mov eax, dword [0x548750]
mov dword [ebp - 0x1020], esi
mov dword [esi], eax
and dword [ebp - 4], 0
lea ecx, [ebp - 0x1014]
xor ebx, ebx
inc ebx
push edi
mov dword [ebp - 0x101c], ebx
call fcn.00404fa0
push 4
lea eax, [ebp - 0x1018]
mov dword [ebp - 4], ebx
push eax
lea ecx, [ebp - 0x1014]
call fcn.0040e56e
push eax
lea ecx, [ebp - 0x1014]
mov byte [ebp - 4], 2
call fcn.00402aef
lea ecx, [ebp - 0x1018]
mov byte [ebp - 4], bl
call fcn.00403080
lea ecx, [ebp - 0x1014]
call fcn.00402cc2
push dword [ebp - 0x1014]
call dword [sym.imp.USER32.dll_CharLowerW]
push str..url
lea ecx, [ebp - 0x1014]
call fcn.0040e612
test eax, eax
jne 0x46fbaa
push 0xffe
push eax
mov word [ebp - 0x1010], ax
lea eax, [ebp - 0x100e]
push eax
call fcn.004deff0
add esp, 0xc
lea eax, [ebp - 0x1010]
push edi
push 0x800
push eax
push 0x512700
push 0x513330
push 0x51330c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x1010]
mov ecx, esi
push eax
call fcn.004028f2
lea ecx, [ebp - 0x1014]
call fcn.00403080
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d9731
mov esp, ebp
pop ebp
ret
Function at 0x4705ad
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
je 0x470643
push esi
mov esi, edi
xor edx, edx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, dx
jne 0x4705c6
sub esi, ecx
sar esi, 1
cmp esi, 0x104
ja 0x470642
push 0x20
call fcn.004da35a
mov esi, eax
pop ecx
test esi, esi
je 0x470617
mov ecx, dword [0x548750]
mov dword [esi + 0x10], ecx
mov ecx, dword [0x548750]
mov dword [esi + 0x14], ecx
mov ecx, dword [0x548750]
mov dword [esi + 0x18], ecx
mov eax, dword [0x548750]
mov dword [esi + 0x1c], eax
and dword [esi], 0
and dword [esi + 4], 0
jmp 0x470619
xor esi, esi
push edi
lea ecx, [esi + 0x10]
call fcn.004028f2
push ebx
lea ecx, [esi + 0x14]
call fcn.004028f2
mov eax, dword [ebp + 8]
mov dword [esi], eax
xor eax, eax
push eax
push eax
push esi
push 0x4704a7
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x471828
Capabilities:
Check if file exists
Create process on windows
Terminate process

Disassembly:
push 0x86c
mov eax, 0x504366
call fcn.004e6cea
mov dword [ebp - 0x814], edx
mov dword [ebp - 0x81c], ecx
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ebx, dword [ebp + 8]
push 0x44
mov dword [ebp - 0x820], eax
lea eax, [ebp - 0x878]
push esi
push eax
call fcn.004deff0
xor eax, eax
mov dword [ebp - 0x878], 0x44
lea edi, [ebp - 0x830]
mov dword [ebp - 0x84c], 1
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov word [ebp - 0x848], ax
mov eax, dword [0x548750]
mov dword [ebp - 0x818], eax
mov edi, str.6wanWebGame.exe
mov dword [ebp - 4], esi
push edi
push 0x54e030
lea eax, [ebp - 0x818]
push 0x511e14
push eax
call fcn.0040306c
add esp, 0x1c
push dword [ebp - 0x818]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4719c0
xor eax, eax
push 0x7fe
mov word [ebp - 0x810], ax
lea eax, [ebp - 0x80e]
push esi
push eax
call fcn.004deff0
push dword [ebp - 0x814]
lea eax, [ebp - 0x810]
push dword [ebp - 0x81c]
push edi
push str._s__d_s
push eax
call fcn.004143d4
add esp, 0x20
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x878]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x810]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4719b7
mov ecx, dword [ebp - 0x820]
mov eax, dword [ebp - 0x830]
push 0xffffffffffffffff
push eax
mov dword [ecx], eax
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov dword [ebp - 0x814], esi
mov edi, esi
jmp 0x471981
lea eax, [ebp - 0x814]
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [ebp - 0x814]
cmp eax, dword [ebp - 0x828]
je 0x47199a
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
add edi, 0xa
cmp edi, 0xbb8
jg 0x47199a
push esi
push str.6wanWebGame
push esi
push dword [ebp - 0x81c]
call dword [sym.imp.USER32.dll_FindWindowExW]
mov dword [ebx], eax
test eax, eax
jne 0x471951
push dword [ebp - 0x82c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebx], esi
jne 0x4719b7
push esi
push dword [ebp - 0x830]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
cmp dword [ebx], esi
setne al
mov esi, eax
lea ecx, [ebp - 0x818]
call fcn.00403080
mov eax, esi
call fcn.004e6c99
ret
Function at 0x474145
Capabilities:
Create thread

Disassembly:
push 0
mov eax, 0x5049a4
call fcn.004e6cb7
xor edi, edi
push 0x24
mov dword [ebp - 4], edi
call fcn.004da35a
pop ecx
test eax, eax
je 0x47416d
mov ecx, eax
call fcn.0044554c
mov esi, eax
jmp 0x47416f
mov esi, edi
lea eax, [ebp + 8]
mov ecx, esi
push eax
call fcn.004477db
push edi
push edi
push esi
push 0x474370
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea ecx, [ebp + 8]
call fcn.00448e59
call fcn.004e6c85
ret

Function at 0x479550
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x31c
mov eax, dword [0x5475b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x54e3a8]
push ebx
mov ebx, edx
push esi
push edi
test eax, eax
je 0x47958d
push eax
push 0x52be48
lea eax, [ebp - 0x110]
push eax
push 0xe6
call fcn.0047772a
add esp, 0x10
jmp 0x479605
call fcn.00478d78
mov esi, 0xe6
test eax, eax
je 0x4795ce
lea eax, [ebp - 0x318]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [ebp - 0x318]
call fcn.00478e2c
mov edi, eax
test edi, edi
jne 0x4795e9
push 7
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d9731
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x218]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [ebp - 0x218]
call fcn.00478ee5
jmp 0x4795b4
push edi
push 0x52be48
lea eax, [ebp - 0x110]
push eax
push esi
call fcn.0047772a
push edi
call fcn.004da742
add esp, 0x14
lea ecx, [ebp - 0x110]
call fcn.00477ebb
test eax, eax
je 0x47961e
cmp byte [ecx + eax - 1], 0x5c
jne 0x47961e
dec eax
jne 0x479614
cmp eax, 0x105
jae 0x479680
mov byte [ebp + eax - 0x110], 0
lea eax, [ebp - 0x110]
push eax
push str._setilqs_
push ebx
push 0xe7
call fcn.0047772a
mov ecx, ebx
call fcn.00477ebb
mov esi, eax
lea ecx, [ebx + esi]
push ecx
push 0x14
pop edi
push edi
call fcn.0047789d
add esp, 0x18
movzx eax, byte [ebx + esi]
xor edx, edx
push 0x3e
pop ecx
div ecx
mov al, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [ebx + esi], al
inc esi
dec edi
jne 0x47965d
mov byte [ebx + esi], 0
xor eax, eax
jmp 0x4795bd
call fcn.004dbe04
int3
Function at 0x479aac
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x5475b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x110]
mov edi, 0x200
push eax
push 0x104
push edx
push ecx
mov dword [ebp - 0x118], edi
call fcn.004799df
add esp, 0x10
test eax, eax
jne 0x479b85
lea ecx, [ebp - 0x110]
call fcn.00479514
mov esi, eax
test esi, esi
je 0x479b8b
call fcn.00478d78
test eax, eax
mov eax, esi
je 0x479b46
xor ecx, ecx
cmp word [esi], cx
je 0x479b27
cmp word [eax], 0x5c
je 0x479b22
add eax, 2
cmp word [eax], cx
jne 0x479b12
jmp 0x479b27
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x114]
push eax
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x114]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x479b78
cmp byte [esi], 0
je 0x479b5b
cmp byte [eax], 0x5c
je 0x479b58
inc eax
cmp byte [eax], 0
jne 0x479b4b
jmp 0x479b5b
mov byte [eax], 0
lea eax, [ebp - 0x114]
push eax
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x114]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
push esi
mov ebx, eax
call fcn.004da742
pop ecx
test ebx, ebx
je 0x479b8b
mov edi, dword [ebp - 0x118]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d9731
mov esp, ebp
pop ebp
ret
Function at 0x4906fe
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, edx
mov eax, ecx
mov dword [esp + 4], eax
push esi
push edi
test ebx, ebx
jne 0x49071b
xor eax, eax
jmp 0x4907fd
push 0x44
pop edx
call fcn.004766b0
mov edi, eax
test edi, edi
je 0x490714
mov esi, dword [ebp + 8]
mov edx, dword [ebx]
mov ecx, dword [esp + 0xc]
push esi
call fcn.00490431
pop ecx
mov ecx, dword [esp + 0xc]
mov dword [edi], eax
mov edx, dword [ebx + 8]
push esi
call fcn.00490532
pop ecx
mov ecx, dword [esp + 0xc]
mov dword [edi + 8], eax
mov edx, dword [ebx + 0xc]
push 0
push esi
call fcn.0049020f
mov ecx, dword [esp + 0x14]
mov dword [edi + 0xc], eax
mov edx, dword [ebx + 0x10]
push esi
call fcn.00490431
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov dword [edi + 0x10], eax
mov edx, dword [ebx + 0x14]
push 0
push esi
call fcn.0049020f
mov ecx, dword [esp + 0x14]
mov dword [edi + 0x14], eax
mov edx, dword [ebx + 0x18]
push esi
call fcn.00490431
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov dword [edi + 0x18], eax
mov al, byte [ebx + 4]
mov byte [edi + 4], al
mov edx, dword [ebx + 0x1c]
push esi
call fcn.004906fe
pop ecx
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x1c], eax
mov edx, dword [ebx + 0x28]
push 0
push esi
call fcn.0049020f
mov ecx, dword [esp + 0x14]
mov dword [edi + 0x28], eax
mov edx, dword [ebx + 0x2c]
push 0
push esi
call fcn.0049020f
mov dword [edi + 0x2c], eax
xor edx, edx
mov dword [edi + 0x30], edx
mov ecx, 0xfff7
mov dword [edi + 0x34], edx
add esp, 0x10
mov ax, word [ebx + 6]
and ax, cx
mov dword [edi + 0x24], edx
mov word [edi + 6], ax
mov eax, edi
or dword [edi + 0x38], 0xffffffff
or dword [edi + 0x3c], 0xffffffff
or dword [edi + 0x40], 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b065b
Capabilities:
Get file version info

Disassembly:
push 0x14
mov eax, 0x4fea94
call fcn.004e6cb7
mov dword [ebp - 0x1c], edx
mov esi, ecx
mov eax, dword [0x548750]
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x10], eax
push ecx
push edx
mov dword [ebp - 4], ecx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test edi, edi
je 0x4b06f7
push edi
call fcn.004d980f
pop ecx
mov ebx, eax
push ebx
push edi
xor edi, edi
push edi
push dword [ebp - 0x1c]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x4b06f7
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], edi
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], edi
push eax
push 0x513338
push ebx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x4b06f7
cmp dword [ebp - 0x14], 0x34
jne 0x4b06f7
mov ecx, dword [ebp - 0x18]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
lea eax, [ebp - 0x10]
push str._d._d._d._d
push eax
call fcn.0040306c
push ebx
call fcn.004d9740
add esp, 0x1c
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
call fcn.0040291d
lea ecx, [ebp - 0x10]
call fcn.00403080
mov eax, esi
call fcn.004e6c85
ret

Function at 0x4b082c
Capabilities:
Delete file
Read .ini file

Disassembly:
push 0x210
mov eax, 0x501bae
call fcn.004e6cea
lea ecx, [ebp - 0x21c]
call fcn.004b0cc1
xor esi, esi
mov dword [ebp - 4], esi
mov ecx, dword [ebp - 0x21c]
call fcn.00404c46
test eax, eax
je 0x4b08d1
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push esi
push eax
call fcn.004deff0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, dword [ebp - 0x21c]
lea edx, [ebp - 0x218]
call fcn.004b05f9
cmp eax, 1
jne 0x4b08c5
push dword [0x549e80]
push esi
push str.force
push str.updatesetup
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x4b08d1
call fcn.004b08e4
mov esi, eax
jmp 0x4b08d1
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x21c]
call fcn.00403080
mov eax, esi
call fcn.004e6c99
ret

Function at 0x4b08e4
Capabilities:
Create process on windows

Disassembly:
push 8
mov eax, 0x4fe0d6
call fcn.004e6cb7
lea ecx, [ebp - 0x10]
call fcn.004b0cc1
xor esi, esi
mov dword [ebp - 4], esi
mov ecx, dword [ebp - 0x10]
call fcn.00404c46
test eax, eax
je 0x4b0934
push str._typeupdatesetup
lea ecx, [ebp - 0x14]
call fcn.00404fa0
push 5
push esi
push dword [ebp - 0x14]
push dword [ebp - 0x10]
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x14]
call fcn.00403080
inc esi
lea ecx, [ebp - 0x10]
call fcn.00403080
mov eax, esi
call fcn.004e6c85
ret
Function at 0x4b15be
Capabilities:
Delete file

Disassembly:
push 0x1c
mov eax, 0x4fb9ec
call fcn.004e6cea
mov ebx, ecx
mov esi, dword [ebp + 8]
test esi, esi
jne 0x4b15d7
xor eax, eax
jmp 0x4b1644
cmp dword [esi], 0x3cbfbbef
jne 0x4b15e2
add esi, 3
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x4b15d3
cmp byte [ebx], 0
je 0x4b15f9
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp + 0xc], 0
je 0x4b1611
xor edi, edi
lea ecx, [ebx + 0x104]
mov eax, dword [ecx]
push edi
push edi
push esi
call dword [eax + 8]
jmp 0x4b1641
mov edx, esi
lea ecx, [ebp - 0x28]
call fcn.0041019e
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [eax + 0x14], 0x10
jb 0x4b1628
mov eax, dword [eax]
lea ecx, [ebx + 0x104]
mov edx, dword [ecx]
push edi
push edi
push eax
call dword [edx + 8]
push edi
push 1
lea ecx, [ebp - 0x28]
call fcn.00406bf3
xor eax, eax
inc eax
call fcn.004e6c99
ret 8