joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b748f
Capabilities:
Get hostname
Get user security identifier

Disassembly:
push 0x230
mov eax, 0x581130
call fcn.004fba06
mov eax, dword [ebp + 8]
mov dword [ebp - 0x238], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x23c], 0x104
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x224], ebx
push 0x20a
push ebx
lea eax, [ebp - 0x220]
push eax
call fcn.004fc1f0
add esp, 0xc
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
cmp eax, ebx
je 0x4b75e4
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x230]
push eax
push ebx
lea eax, [ebp - 0x22c]
push eax
push ebx
lea eax, [ebp - 0x220]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
cmp eax, ebx
je 0x4b7531
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4b75e4
push dword [ebp - 0x22c]
push 8
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call esi
push eax
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
call edi
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x230]
add eax, eax
push eax
push 8
call esi
push eax
call edi
cmp dword [ebp - 0x228], ebx
je 0x4b75e4
cmp eax, ebx
je 0x4b75e4
lea ecx, [ebp - 0x234]
push ecx
lea ecx, [ebp - 0x230]
push ecx
push eax
lea eax, [ebp - 0x22c]
push eax
push dword [ebp - 0x228]
lea eax, [ebp - 0x220]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
cmp eax, ebx
je 0x4b75e4
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 0x228]
call sub.ADVAPI32.dll_ConvertSidToStringSidW
cmp eax, ebx
je 0x4b75e4
push dword [ebp - 0x224]
mov ecx, dword [ebp - 0x238]
call fcn.00433c70
cmp dword [ebp - 0x224], ebx
je 0x4b75d5
push dword [ebp - 0x224]
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
inc eax
jmp 0x4b75e6
xor eax, eax
call fcn.004fba62
ret 4
Function at 0x4b75ee
Capabilities:
Get common file path
Get disk information

Disassembly:
push 0x21c
mov eax, 0x5811f2
call fcn.004fba06
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, 0x602968
push esi
lea ecx, [ebp - 0x220]
call fcn.00431ef7
mov byte [ebp - 4], 1
mov byte [ebp - 4], 2
push esi
lea ecx, [ebp - 0x224]
call fcn.00431ef7
mov byte [ebp - 4], 3
mov byte [ebp - 4], 4
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x4b767d
mov byte [ebp - 4], 5
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x224]
add ecx, 0xfffffff0
call fcn.004310e3
mov byte [ebp - 4], 6
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
call fcn.004310e3
xor eax, eax
call fcn.004fba62
ret 4
lea eax, [ebp - 0x21c]
push eax
call fcn.004fb22e
pop ecx
push eax
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x220]
call fcn.0043340b
push ebx
push 0x5c
lea ecx, [ebp - 0x220]
call fcn.004324ff
cmp eax, 0xffffffff
jne 0x4b76cc
mov byte [ebp - 4], 7
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x224]
add ecx, 0xfffffff0
call fcn.004310e3
mov byte [ebp - 4], 8
jmp 0x4b7662
inc eax
push eax
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x220]
call fcn.00433310
mov byte [ebp - 4], 9
push eax
lea ecx, [ebp - 0x224]
call fcn.00433c20
mov byte [ebp - 4], 0xa
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x228]
add ecx, 0xfffffff0
call fcn.004310e3
mov esi, dword [ebp - 0x224]
cmp dword [esi - 0xc], 3
jge 0x4b772b
mov byte [ebp - 4], 0xb
mov byte [ebp - 4], 2
lea ecx, [esi - 0x10]
call fcn.004310e3
mov byte [ebp - 4], 0xc
jmp 0x4b7662
push ebx
push ebx
push ebx
push ebx
push edi
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov byte [ebp - 4], 0xd
mov byte [ebp - 4], 2
lea ecx, [esi - 0x10]
call fcn.004310e3
mov byte [ebp - 4], 0xe
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
call fcn.004310e3
xor eax, eax
inc eax
jmp 0x4b7675
Function at 0x4b798e
Capabilities:
Reference sql statements

Disassembly:
push 0x430
mov eax, 0x5812c2
call fcn.004fba06
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x43c], eax
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x438], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
mov byte [ebp - 0x414], bl
push 0x3ff
push ebx
lea eax, [ebp - 0x413]
push eax
call fcn.004fc1f0
add esp, 0xc
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x41c], 0xf
mov dword [ebp - 0x420], ebx
mov byte [ebp - 0x430], bl
mov byte [ebp - 4], 1
cmp esi, ebx
je 0x4b7a36
cmp dword [ebp - 0x43c], ebx
je 0x4b7a36
push dword [ebp - 0x438]
push str.SELECT_specifics_non_unique_name_FROM_metas_WHERE_unique_client_tag_s
lea eax, [ebp - 0x414]
push eax
call fcn.004a3400
push ebx
lea eax, [ebp - 0x434]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x414]
push eax
push esi
call fcn.004826e2
add esp, 0x20
cmp eax, ebx
je 0x4b7a52
mov byte [ebp - 4], bl
push ebx
push 1
lea ecx, [ebp - 0x430]
call fcn.0040ff10
or eax, 0xffffffff
call fcn.004fba62
ret 0x10
push dword [ebp - 0x434]
call fcn.0048b8cf
pop ecx
cmp eax, 0x64
jne 0x4b7a36
push ebx
push dword [ebp - 0x434]
call fcn.0047436c
mov dword [ebp - 0x438], eax
push ebx
push dword [ebp - 0x434]
call fcn.00474392
mov dword [edi], eax
push 1
push dword [ebp - 0x434]
call fcn.0047445a
add esp, 0x18
mov esi, eax
cmp esi, ebx
je 0x4b7aea
push esi
call fcn.004fba80
pop ecx
push eax
push esi
lea ecx, [ebp - 0x430]
call fcn.00410120
mov esi, str.encrypted
push esi
call fcn.004fba80
pop ecx
push eax
push esi
push dword [ebp - 0x420]
push ebx
lea ecx, [ebp - 0x430]
call fcn.00417c30
test eax, eax
jne 0x4b7aea
mov byte [ebp - 4], bl
push ebx
push 1
lea ecx, [ebp - 0x430]
call fcn.0040ff10
push 0xfffffffffffffffd
pop eax
jmp 0x4b7a4a
cmp dword [ebp - 0x438], ebx
jne 0x4b7afa
cmp dword [edi], ebx
jle 0x4b7a36
push dword [edi]
push dword [ebp - 0x438]
push dword [ebp - 0x43c]
call fcn.004fbb10
push dword [ebp - 0x434]
call fcn.0048b8cf
add esp, 0x10
cmp eax, 0x64
je 0x4b7a36
push dword [ebp - 0x434]
call fcn.0048103b
pop ecx
mov byte [ebp - 4], bl
push ebx
push 1
lea ecx, [ebp - 0x430]
call fcn.0040ff10
xor eax, eax
inc eax
jmp 0x4b7a4a

Function at 0x4baa0d
Capabilities:
Persist via run registry key

Disassembly:
push 0xc
mov eax, 0x581969
call fcn.004fb967
mov esi, ecx
and dword [ebp - 0x10], 0
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0x5a8358
call fcn.0043479c
mov byte [ebp - 4], 2
push SysReAllocString
mov byte [ebp - 4], bl
mov ecx, esi
call fcn.00434682
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0x59a2c0
call fcn.0043479c
mov byte [ebp - 4], 3
push ecx
lea eax, [ebp + 0xc]
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
call fcn.004324a9
mov byte [ebp - 4], 4
push dword [ebp + 8]
mov byte [ebp - 4], bl
mov ecx, esi
call fcn.00434b9b
mov dword [ebp - 0x10], ebx
and dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.004310e3
mov eax, dword [ebp + 8]
call fcn.004fba3f
ret 8
Function at 0x4bab71
Capabilities:
Get common file path

Disassembly:
push 0x214
mov eax, 0x581a3e
call fcn.004fb9d0
mov esi, dword [ebp + 8]
xor edi, edi
xor eax, eax
mov dword [ebp - 0x21c], edi
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push edi
push eax
mov dword [ebp - 0x220], esi
call fcn.004fc1f0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push edi
push edi
push 0x8017
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ecx, esi
test eax, eax
js 0x4babd8
lea eax, [ebp - 0x218]
push eax
call fcn.0043479c
jmp 0x4babe2
push 0x59a2c0
call fcn.0043479c
mov dword [ebp - 4], edi
mov dword [ebp - 0x21c], 1
mov eax, esi
call fcn.004fba53
ret 4

Function at 0x4bac41
Capabilities:
Get common file path

Disassembly:
push 0x21c
mov eax, 0x581afb
call fcn.004fb9d0
mov esi, dword [ebp + 8]
xor edi, edi
xor eax, eax
mov dword [ebp - 0x220], edi
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push edi
push eax
mov dword [ebp - 0x228], esi
call fcn.004fc1f0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push edi
push edi
push 0x1a
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x4bad50
push 0x602968
lea ecx, [ebp - 0x21c]
call fcn.00431ef7
mov dword [ebp - 4], 2
lea eax, [ebp - 0x218]
push eax
call fcn.004fb22e
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.0043340b
push 0x5c
push dword [ebp - 0x21c]
call fcn.004faab9
pop ecx
pop ecx
cmp eax, edi
jne 0x4bace8
or eax, 0xffffffff
jmp 0x4bacf0
sub eax, dword [ebp - 0x21c]
sar eax, 1
push eax
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x21c]
call fcn.00433310
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x21c]
call fcn.00433c20
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x224]
add ecx, 0xfffffff0
call fcn.004310e3
lea eax, [ebp - 0x21c]
push eax
mov ecx, esi
call fcn.004324a9
mov dword [ebp - 0x220], 1
mov dword [ebp - 4], edi
mov ecx, dword [ebp - 0x21c]
add ecx, 0xfffffff0
call fcn.004310e3
jmp 0x4bad69
push 0x59a2c0
mov ecx, esi
call fcn.0043479c
mov dword [ebp - 4], edi
mov dword [ebp - 0x220], 1
mov eax, esi
call fcn.004fba53
ret 4

Function at 0x4bad73
Capabilities:
Get common file path

Disassembly:
push 0x214
mov eax, 0x581b45
call fcn.004fb9d0
mov esi, dword [ebp + 8]
xor edi, edi
xor eax, eax
mov dword [ebp - 0x21c], edi
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push edi
push eax
mov dword [ebp - 0x220], esi
call fcn.004fc1f0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push edi
push edi
push 0x801c
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ecx, esi
test eax, eax
js 0x4badda
lea eax, [ebp - 0x218]
push eax
call fcn.0043479c
jmp 0x4bade4
push 0x59a2c0
call fcn.0043479c
mov dword [ebp - 4], edi
mov dword [ebp - 0x21c], 1
mov eax, esi
call fcn.004fba53
ret 4
Function at 0x4badfb
Capabilities:
Get common file path

Disassembly:
push 0x214
mov eax, 0x581b8f
call fcn.004fb9d0
mov esi, dword [ebp + 8]
xor edi, edi
xor eax, eax
mov dword [ebp - 0x21c], edi
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push edi
push eax
mov dword [ebp - 0x220], esi
call fcn.004fc1f0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push edi
push edi
push 0x8019
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ecx, esi
test eax, eax
js 0x4bae62
lea eax, [ebp - 0x218]
push eax
call fcn.0043479c
jmp 0x4bae6c
push 0x59a2c0
call fcn.0043479c
mov dword [ebp - 4], edi
mov dword [ebp - 0x21c], 1
mov eax, esi
call fcn.004fba53
ret 4

Function at 0x4bae83
Capabilities:
Get common file path

Disassembly:
push 0x214
mov eax, 0x581bd9
call fcn.004fb9d0
mov esi, dword [ebp + 8]
xor edi, edi
xor eax, eax
mov dword [ebp - 0x21c], edi
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push edi
push eax
mov dword [ebp - 0x220], esi
call fcn.004fc1f0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push edi
push edi
push 0x8016
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ecx, esi
test eax, eax
js 0x4baeea
lea eax, [ebp - 0x218]
push eax
call fcn.0043479c
jmp 0x4baef4
push 0x59a2c0
call fcn.0043479c
mov dword [ebp - 4], edi
mov dword [ebp - 0x21c], 1
mov eax, esi
call fcn.004fba53
ret 4

Function at 0x4baf0b
Capabilities:
Get common file path

Disassembly:
push 0x214
mov eax, 0x581c23
call fcn.004fb9d0
and dword [ebp - 4], 0
and dword [ebp - 0x21c], 0
mov esi, dword [ebp + 8]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
mov dword [ebp - 0x220], esi
call fcn.004fc1f0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call fcn.0043479c
and dword [ebp - 4], 0
mov dword [ebp - 0x21c], 1
mov eax, esi
call fcn.004fba53
ret 4
Function at 0x4bb25b
Capabilities:
Check if file exists
Create directory

Disassembly:
push 8
mov eax, 0x581e95
call fcn.004fb967
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
push dword [ebp + 8]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call esi
test eax, eax
jne 0x4bb348
push ecx
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call fcn.004324a9
mov byte [ebp - 4], 1
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], bl
mov ecx, edi
call fcn.0049bc99
mov byte [ebp - 4], 2
push dword [ebp - 0x10]
call esi
test eax, eax
jne 0x4bb2f8
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call fcn.004324a9
mov byte [ebp - 4], 3
mov byte [ebp - 4], 2
mov ecx, edi
call fcn.004bb25b
cmp eax, ebx
jne 0x4bb2f8
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004310e3
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004310e3
xor eax, eax
call fcn.004fba3f
ret 4
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4bb32e
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004310e3
mov dword [ebp - 4], 7
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004310e3
mov eax, ebx
jmp 0x4bb2f0
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004310e3
mov dword [ebp - 4], 9
xor ebx, ebx
inc ebx
jmp 0x4bb31b
mov dword [ebp - 4], 0xb
jmp 0x4bb31b

Function at 0x4bb351
Capabilities:
Get common file path

Disassembly:
push 0x214
mov eax, 0x581eea
call fcn.004fb9d0
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x220], edi
mov dword [ebp - 0x21c], ebx
xor esi, esi
inc esi
mov dword [ebp - 4], esi
lea eax, [ebp - 0x218]
push eax
push ebx
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov ecx, edi
test eax, eax
je 0x4bb3a3
lea eax, [ebp - 0x218]
push eax
call fcn.0043479c
mov dword [ebp - 0x21c], esi
jmp 0x4bb3b3
push 0x59a2c0
call fcn.0043479c
mov dword [ebp - 0x21c], esi
mov dword [ebp - 4], ebx
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.004310e3
mov eax, edi
call fcn.004fba53
ret 8
Function at 0x4bb697
Capabilities:
Get geographical location

Disassembly:
push 0x68
mov eax, 0x582064
call fcn.004fb9d0
xor esi, esi
mov dword [ebp - 4], esi
mov eax, dword [ebp + 8]
push eax
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x5c], esi
call fcn.0043479c
mov dword [ebp - 4], esi
push 0x18
lea eax, [ebp - 0x74]
push esi
push eax
mov dword [ebp - 0x5c], 1
call fcn.004fc1f0
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add esp, 0xc
push 0x13
pop ebx
push ebx
lea eax, [ebp - 0x38]
push eax
push 0xe
mov esi, 0x400
push esi
call edi
lea eax, [ebp - 0x38]
push ebx
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x4c]
push eax
push 0xf
push esi
call edi
lea eax, [ebp - 0x4c]
push ebx
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x24]
push eax
push 0x12
push esi
call edi
lea eax, [ebp - 0x24]
push eax
call fcn.004fc531
pop ecx
push ebx
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x24]
push eax
push 0x10
push esi
call edi
lea eax, [ebp - 0x24]
push eax
call fcn.004fc531
pop ecx
push ebx
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x24]
push eax
push 0x1010
push esi
call edi
lea eax, [ebp - 0x24]
push eax
call fcn.004fc531
mov edi, dword [ebp + 0xc]
pop ecx
mov dword [ebp - 0x60], eax
cmp edi, 0xffffffff
jne 0x4bb799
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x58]
call fcn.0043479c
mov dword [ebp - 4], 1
mov edi, dword [ebp - 0x54]
push 0
lea eax, [ebp - 0x38]
push eax
mov ecx, edi
call fcn.00432533
cmp eax, 0xffffffff
jne 0x4bb77d
xor edi, edi
jmp 0x4bb78a
mov ecx, dword [edi]
mov edi, dword [ecx - 0xc]
mov edx, dword [ebp - 0x58]
sub edi, dword [edx - 0xc]
sub edi, eax
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x58]
add ecx, 0xfffffff0
call fcn.004310e3
push dword [ebp - 0x50]
mov dword [ebp - 0x74], edi
call fcn.004fb22e
mov edi, eax
imul edi, edi, 3
xor ecx, ecx
push 2
pop edx
lea eax, [edi + 0x64]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004f8908
pop ecx
pop ecx
mov ebx, eax
sub edi, 0xffffff9d
push edi
push ebx
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x50]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
test eax, eax
je 0x4bb7e6
mov ecx, dword [ebp - 0x54]
push ebx
call fcn.00433c70
test ebx, ebx
je 0x4bb7f1
push ebx
call fcn.004fc324
pop ecx
mov ecx, dword [ebp - 0x54]
push 1
lea eax, [ebp - 0x50]
push eax
call fcn.00433310
mov dword [ebp - 4], 3
push 0x59b60c
mov ecx, eax
call fcn.00431ed3
mov ebx, eax
neg ebx
sbb bl, bl
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x50]
add ecx, 0xfffffff0
call fcn.004310e3
inc bl
je 0x4bb85e
push dword [ebp - 0x54]
lea eax, [ebp - 0x50]
push 0x5a84ac
push eax
call fcn.004b01ac
add esp, 0xc
mov dword [ebp - 4], 5
mov ecx, dword [ebp - 0x54]
push eax
call fcn.00433c20
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x50]
add ecx, 0xfffffff0
call fcn.004310e3
mov eax, dword [ebp - 0x54]
call fcn.004fba53
ret
Function at 0x4bbaca
Capabilities:
Check if file exists

Disassembly:
push 0x48
mov eax, 0x582212
call fcn.004fb967
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x18], ebx
call fcn.00432a3a
mov dword [ebp - 4], 2
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.pcmaster.exe
call fcn.0043479c
mov byte [ebp - 4], 3
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push eax
lea ecx, [ebp - 0x54]
call fcn.004bb121
mov byte [ebp - 4], 4
push edi
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x54]
call fcn.0049be74
push dword [edi]
mov dword [ebp - 0x18], 1
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4bbcc4
lea ecx, [ebp - 0x3c]
call fcn.00432a3a
mov byte [ebp - 4], 5
push str.SoftwareRuanMeiPCMaster
lea ecx, [ebp - 0x14]
call fcn.0043479c
mov byte [ebp - 4], 6
call fcn.0043129c
test eax, eax
je 0x4bbb77
mov esi, str.SoftwareWow6432NodeRuanMeiPCMaster
push esi
call fcn.004fb22e
pop ecx
push eax
push esi
lea ecx, [ebp - 0x14]
call fcn.0043340b
push ebx
push ecx
lea eax, [ebp - 0x14]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.004324a9
mov byte [ebp - 4], 7
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x3c]
call fcn.00434682
cmp eax, ebx
je 0x4bbca9
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
mov esi, 0x59a2c0
push esi
call fcn.0043479c
mov byte [ebp - 4], 8
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.Install_Dir
call fcn.0043479c
mov byte [ebp - 4], 9
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x3c]
call fcn.00434b9b
mov byte [ebp - 4], 0xa
push eax
mov ecx, edi
call fcn.00433c20
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004310e3
mov eax, dword [edi]
cmp dword [eax - 0xc], ebx
je 0x4bbca9
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push esi
call fcn.0043479c
mov byte [ebp - 4], 0xc
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.ExeName
call fcn.0043479c
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x3c]
call fcn.00434b9b
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], ebx
jne 0x4bbc4c
mov ecx, edi
call fcn.00431e55
jmp 0x4bbc9a
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
call fcn.004324a9
mov byte [ebp - 4], 0xf
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push edi
call fcn.004324a9
mov byte [ebp - 4], 0x10
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x54]
call fcn.0049be74
mov byte [ebp - 4], 0x11
push eax
mov ecx, edi
call fcn.00433c20
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.004310e3
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004310e3
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.004310e3
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x3c]
call fcn.00432a92
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x54]
call fcn.00432a92
mov eax, edi
call fcn.004fba3f
ret
Function at 0x4bc6a3
Capabilities:
Get memory capacity

Disassembly:
push 0x54
mov eax, 0x582634
call fcn.004fb9d0
xor esi, esi
mov dword [ebp - 4], esi
push 0x602968
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x58], esi
call fcn.00431ef7
mov dword [ebp - 4], esi
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 0x58], 1
mov dword [ebp - 0x50], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov edi, dword [ebp - 0x48]
mov esi, dword [ebp - 0x44]
call fcn.004bc393
cmp esi, edx
jb 0x4bc6f8
ja 0x4bc6f4
cmp edi, eax
jbe 0x4bc6f8
mov eax, edi
mov edx, esi
mov ecx, eax
sub ecx, edi
mov ebx, edx
sbb ebx, esi
mov dword [ebp - 0x5c], ebx
jne 0x4bc70d
cmp ecx, 0x200
jbe 0x4bc711
mov eax, edi
mov edx, esi
push edx
push eax
push 0x5a8668
push dword [ebp - 0x54]
call fcn.00433c96
mov eax, dword [ebp - 0x54]
add esp, 0x10
call fcn.004fba53
ret
Function at 0x4bd771
Capabilities:
Check if file exists

Disassembly:
push 0x24
mov eax, 0x582958
call fcn.004fb967
push 0
push SysReAllocString
call fcn.004bd35c
push 0
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
mov edi, eax
call fcn.004bd35c
add esp, 0x10
or edi, eax
call fcn.0043129c
test eax, eax
je 0x4bd7b2
push 1
push esi
call fcn.004bd35c
pop ecx
pop ecx
or edi, eax
lea ecx, [ebp - 0x30]
call fcn.00432a3a
mov dword [ebp - 4], 1
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Internet_Exploreriexplore.exe
call fcn.0043479c
mov byte [ebp - 4], 2
push ecx
mov eax, esp
mov dword [ebp - 0x18], esp
push eax
lea ecx, [ebp - 0x30]
call fcn.0049bb04
mov byte [ebp - 4], 3
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x30]
call fcn.0049be74
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
je 0x4bd813
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4bd813
or edi, 1
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004310e3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00432a92
mov eax, edi
call fcn.004fba3f
ret