joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50daa0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53bd7b
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x59a0a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
mov byte [ebp - 4], 1
call fcn.00401980
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x50dafa
push 0x80004005
call fcn.00401b40
mov eax, dword [edx]
mov esi, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x50db0f
lock inc dword [edx + 0x14]
lea eax, [edx + 8]
jmp 0x50db13
mov ecx, edx
call esi
add eax, 0x10
mov dword [ebp - 0x10], eax
push 0x56e3bc
push 0x56e3c0
lea ecx, [ebp + 8]
mov byte [ebp - 4], 2
call fcn.004072d0
mov eax, dword [0x59fb74]
cmp dword [eax - 0xc], 0
jne 0x50db4b
push 0x1d
push 0x56e358
lea ecx, [ebp - 0x10]
call fcn.00402d50
jmp 0x50db5d
push eax
lea eax, [ebp - 0x10]
push str.SOFTWARETencent_s
push eax
call fcn.004023f0
add esp, 0xc
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push esi
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x50dbd8
mov edi, dword [ebp - 0x14]
xor ecx, ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
test eax, eax
mov dword [ebp - 0x24], edi
setne cl
test ecx, ecx
je 0x50dbd8
mov edx, eax
lea ebx, [edx + 2]
nop dword [eax + eax]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x50dbb0
sub edx, ebx
sar edx, 1
lea ecx, [edx*2 + 2]
push ecx
push eax
push 1
push 0
push 0x56e404
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [esi - 0x10]
mov byte [ebp - 4], 1
or esi, 0xffffffff
mov eax, esi
lock xadd dword [ecx + 0xc], eax
dec eax
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
jg 0x50dc1d
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov ebx, dword [eax + 4]
mov dword [ebp - 0x10], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x50dc18
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call ebx
jmp 0x50dc1d
mov ecx, edx
call dword [ebp - 0x10]
test edi, edi
je 0x50dc28
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], esi
dec esi
test esi, esi
jg 0x50dc70
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x50dc6c
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, edx
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x50dc90
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53bd9e
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x59a0a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push 0x6b
push dword [0x59e5dc]
call dword [sym.imp.USER32.dll_LoadIconW]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
push edi
push 0
push 0x80
push dword [ebx + 4]
call esi
push edi
push 1
push 0x80
push dword [ebx + 4]
call esi
push ecx
lea ecx, [ebx + 0x40]
call fcn.004442b0
lea edi, [ebx + 0x64]
test edi, edi
je 0x50dcff
lea esi, [edi - 0x24]
jmp 0x50dd01
xor esi, esi
mov eax, dword [esi + 0x24]
lea ecx, [esi + 0x24]
push 0x79
call dword [eax + 0x38]
test eax, eax
jne 0x50dd3a
mov eax, dword [esi + 0x114]
lea ecx, [esi + 0x114]
push 0x79
call dword [eax + 0x38]
test eax, eax
jne 0x50dd3a
mov eax, dword [esi + 0x204]
lea ecx, [esi + 0x204]
push 0x79
call dword [eax + 0x38]
test eax, eax
je 0x50dd48
or dword [eax + 0x7c], 4
mov ecx, esi
push 1
push eax
call fcn.004458f0
push 0x565514
push 0x77
mov ecx, edi
call fcn.00443e40
mov eax, dword [ebx + 0x3f8]
push dword [eax + 0x2c]
push 0x56551c
push ecx
mov ecx, edi
call fcn.00443d90
push dword [ebx + 0x49c]
mov ecx, edi
push 0x70
call fcn.00443e40
mov eax, dword [ebx + 0x3f8]
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push dword [eax + 4]
call fcn.004058d0
push ecx
mov ecx, esp
mov dword [ebp - 4], 0
push 0x5654c8
call fcn.0041e730
mov eax, dword [edi]
mov ecx, edi
mov dword [ebp - 4], 0xffffffff
call dword [eax + 0x10]
mov esi, dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0x1388
push 1
push dword [ebx + 4]
call esi
push 0
push 0xa
push 2
push dword [ebx + 4]
call esi
push 0
push 0x96
push 4
push dword [ebx + 4]
call esi
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x54]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x517dd0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
push 2
lea eax, [ebp - 4]
push eax
call fcn.004059d0
mov esi, dword [ebp - 4]
lea eax, [ebp - 0xc]
push 0
push 0
push eax
push esi
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
cmp dword [ebp - 8], 0
ja 0x517e18
jb 0x517e14
cmp dword [ebp - 0xc], 0x1f400000
jae 0x517e18
xor edi, edi
jmp 0x517e1d
mov edi, 1
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x517e53
mov eax, dword [esi]
push esi
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
cmp ecx, vtable.ATL::CAtlStringMgr.0
jne 0x517e5b
mov ecx, dword [eax + 4]
push 0
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, eax
call edx
jmp 0x517e53

Function at 0x519090
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
push 2
lea eax, [ebp - 4]
push eax
call fcn.004059d0
mov esi, dword [ebp - 4]
lea eax, [ebp - 0xc]
push 0
push 0
push eax
push esi
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
cmp dword [ebp - 8], 0
ja 0x5190d8
jb 0x5190d4
cmp dword [ebp - 0xc], 0x1f400000
jae 0x5190d8
xor edi, edi
jmp 0x5190dd
mov edi, 1
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x519113
mov eax, dword [esi]
push esi
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
cmp ecx, vtable.ATL::CAtlStringMgr.0
jne 0x51911b
mov ecx, dword [eax + 4]
push 0
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, eax
call edx
jmp 0x519113

Function at 0x519d90
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [esp + 0x10]
xor esi, esi
push eax
push 0x2001f
push esi
push 0x56f680
push reloc.WS2_32.dll_bind
mov ebx, ecx
mov dword [esp + 0x24], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x519de9
mov esi, dword [esp + 0x10]
test edi, edi
jne 0x519de9
push 4
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
push 4
push edi
push str.AutoStart
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test esi, esi
je 0x519df4
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push str.GameDownload::CMainUICustomBuild_10004::OnAllLocalComponentDone
push str._s:_Close_AppMarket_AutoStart_Result:__d
call fcn.004e78a0
push eax
call fcn.004e76a0
add esp, 0x10
mov ecx, ebx
cmp dword [0x59fbe0], 0
je 0x519e39
cmp dword [0x59fb60], 0
je 0x519e2d
call fcn.004fc4f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004ff230
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00511390
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x51b810
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
push 2
lea eax, [ebp - 4]
push eax
call fcn.004059d0
mov esi, dword [ebp - 4]
lea eax, [ebp - 0xc]
push 0
push 0
push eax
push esi
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
cmp dword [ebp - 8], 0
ja 0x51b858
jb 0x51b854
cmp dword [ebp - 0xc], 0x1f400000
jae 0x51b858
xor edi, edi
jmp 0x51b85d
mov edi, 1
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x51b893
mov eax, dword [esi]
push esi
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
cmp ecx, vtable.ATL::CAtlStringMgr.0
jne 0x51b89b
mov ecx, dword [eax + 4]
push 0
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, eax
call edx
jmp 0x51b893
Function at 0x51dce0
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d1f8
mov eax, dword fs:[0]
push eax
mov eax, dword [0x59a0a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
cmp eax, 0x421
jg 0x51dd58
je 0x51dd47
sub eax, 0x416
cmp eax, 9
ja case.0x51dd25.1047
movzx eax, byte [eax + 0x51ddf4]
jmp dword [eax*4 + 0x51dde0]
push 0x57183c
jmp 0x51ddc2
push 0x571834
jmp 0x51ddc2
push 0x571864
jmp 0x51ddc2
mov ecx, dword [ebp + 8]
push 2
push 0x57185c
call fcn.00402d50
jmp 0x51ddca
sub eax, 0x42a
je 0x51ddbd
sub eax, 0x3da
je 0x51dd83
sub eax, 0x12
je case.0x51dd25.1046
mov ecx, dword [ebp + 8]
push 2
push 0x571854
call fcn.00402d50
jmp 0x51ddca
push 0x571844
jmp 0x51ddc2
mov ecx, dword [ebp + 8]
push 0x5717d0
call fcn.00402e00
mov edx, dword [ebp + 8]
lea ecx, [ebp + 8]
push 0x57184c
call fcn.00401d60
add esp, 4
mov ecx, dword [ebp + 0xc]
push eax
mov dword [ebp - 4], 0
call fcn.00401f90
lea ecx, [ebp + 8]
call fcn.00402ed0
jmp 0x51ddca
push 0x57186c
mov ecx, dword [ebp + 8]
call fcn.00402e00
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x51de00
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d223
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x59a0a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.com.vng.pubgmobile
push dword [ecx + 0x478]
call fcn.004a689d
add esp, 8
test eax, eax
jne 0x51df47
xor edi, edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], edi
call fcn.00401980
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x51de6c
push 0x80004005
call fcn.00401b40
mov eax, dword [edx]
mov esi, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x51de81
lock inc dword [edx + 0x14]
lea eax, [edx + 8]
jmp 0x51de85
mov ecx, edx
call esi
add eax, 0x10
mov dword [ebp - 0x10], eax
push 0x1d
push str.SoftwareTencentMobileGamePC
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00402d50
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push eax
push 0x2001f
push 0
push esi
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x51df07
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x14]
push 4
push eax
push 4
push 0
push str.VNGVersion
push edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x14], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test edi, edi
je 0x51def6
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
mov dword [ebp - 0x20], edi
push 0x5717d8
mov dword [ebp - 0x1c], 0
call fcn.0051e010
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x51df3c
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x51df3a
mov eax, dword [ecx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x51df3c
call edx
test edi, edi
je 0x51df47
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x51e010
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x51e0ba
push esi
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push 0x2001f
push 0
push 0x5716f0
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x51e04e
mov esi, dword [ebp + 8]
jmp 0x51e081
lea eax, [ebp - 8]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push 0x571794
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x51e0b9
mov esi, dword [ebp - 4]
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x51e086
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edi
push 1
push 0
push str.UserLanguage
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test esi, esi
je 0x51e0b9
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x51e4b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d30f
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x59a0a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [ebp - 0x234], edi
mov dword [ebp - 0x220], 0
call fcn.00401980
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x51e513
push 0x80004005
call fcn.00401b40
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x51e528
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
jmp 0x51e52a
call edx
add eax, 0x10
mov dword [edi], eax
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 0x220], 1
push 0
push eax
call fcn.0049e130
add esp, 0xc
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x228], 0
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], 1
push eax
push 0x20019
push 0
push 0x571694
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x21c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x51e651
mov esi, dword [ebp - 0x21c]
mov dword [ebp - 0x22c], eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x230], esi
push eax
lea eax, [ebp - 0x224]
mov dword [ebp - 0x21c], 0x208
push eax
push 0
push 0x571678
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x51e646
mov eax, dword [ebp - 0x224]
cmp eax, 1
je 0x51e5f7
cmp eax, 2
jne 0x51e646
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x51e614
test al, 1
jne 0x51e646
shr eax, 1
cmp word [ebp + eax*2 - 0x21a], 0
je 0x51e61d
jmp 0x51e646
xor eax, eax
mov word [ebp - 0x218], ax
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x51e626
sub ecx, edx
sar ecx, 1
je 0x51e646
push ecx
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
call fcn.00402d50
test esi, esi
je 0x51e651
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049aa22
mov esp, ebp
pop ebp
ret 4

Function at 0x51eb70
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
push 2
lea eax, [ebp - 4]
push eax
call fcn.004059d0
mov esi, dword [ebp - 4]
lea eax, [ebp - 0xc]
push 0
push 0
push eax
push esi
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
cmp dword [ebp - 8], 0
ja 0x51ebb8
jb 0x51ebb4
cmp dword [ebp - 0xc], 0x1f400000
jae 0x51ebb8
xor edi, edi
jmp 0x51ebbd
mov edi, 1
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x51ebf3
mov eax, dword [esi]
push esi
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
cmp ecx, vtable.ATL::CAtlStringMgr.0
jne 0x51ebfb
mov ecx, dword [eax + 4]
push 0
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, eax
call edx
jmp 0x51ebf3
Function at 0x51f9f0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
push 2
lea eax, [ebp - 4]
push eax
call fcn.004059d0
mov esi, dword [ebp - 4]
lea eax, [ebp - 0xc]
push 0
push 0
push eax
push esi
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
cmp dword [ebp - 8], 0
ja 0x51fa38
jb 0x51fa34
cmp dword [ebp - 0xc], 0x1f400000
jae 0x51fa38
xor edi, edi
jmp 0x51fa3d
mov edi, 1
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x51fa73
mov eax, dword [esi]
push esi
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
cmp ecx, vtable.ATL::CAtlStringMgr.0
jne 0x51fa7b
mov ecx, dword [eax + 4]
push 0
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, eax
call edx
jmp 0x51fa73

Function at 0x520580
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov esi, eax
test esi, esi
je 0x5205a5
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
jmp 0x5205b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov ecx, dword [ebp + 8]
or edi, 0xffffffff
add ecx, 0xfffffff0
mov eax, edi
lock xadd dword [ecx + 0xc], eax
dec eax
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
jg 0x5205ed
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov ebx, dword [eax + 4]
mov dword [ebp + 0x10], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x520628
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call ebx
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], edi
dec edi
test edi, edi
jg 0x52061f
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov edi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x52062f
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call ebx
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0xc
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0xc
mov ecx, edx
call dword [ebp + 0x10]
jmp 0x5205ed
mov ecx, edx
call edi
jmp 0x52061f

Function at 0x5207a0
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
mov dword [esi + 0x3b0], 0
mov eax, dword [0x59fb18]
test eax, eax
je 0x5207e4
push 0
push dword [esi + 4]
push 0x66c
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [0x59fb18]
test eax, eax
je 0x5207e4
push 0
push dword [0x59fbac]
push 0x658
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, esi
pop esi
jmp fcn.00504660
Function at 0x5270b0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
push 2
lea eax, [ebp - 4]
push eax
call fcn.004059d0
mov esi, dword [ebp - 4]
lea eax, [ebp - 0xc]
push 0
push 0
push eax
push esi
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
cmp dword [ebp - 8], 0
ja 0x5270f8
jb 0x5270f4
cmp dword [ebp - 0xc], 0x1f400000
jae 0x5270f8
xor edi, edi
jmp 0x5270fd
mov edi, 1
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x527133
mov eax, dword [esi]
push esi
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
cmp ecx, vtable.ATL::CAtlStringMgr.0
jne 0x52713b
mov ecx, dword [eax + 4]
push 0
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, eax
call edx
jmp 0x527133

Function at 0x527870
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53dc44
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x59a0a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.0050e0b0
cmp dword [esi + 0x4a4], 0
je 0x5278fd
mov eax, dword [esi + 0xa54]
test eax, eax
je 0x5278bc
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [ebp - 0x5c]
call fcn.00448070
lea eax, [ebp - 0x5c]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.00520aa0
or dword [ebp - 0x2c], 0x80
lea eax, [ebp - 0x5c]
push ecx
push eax
call fcn.0044c609
mov ecx, eax
call fcn.00448570
mov ecx, esi
call fcn.0050e390
lea ecx, [ebp - 0x5c]
call fcn.004483c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049aa22
mov esp, ebp
pop ebp
ret
Function at 0x527920
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x64]
test edi, edi
je 0x527935
lea ebx, [edi - 0x24]
jmp 0x527937
xor ebx, ebx
mov eax, dword [ebx + 0x24]
lea ecx, [ebx + 0x24]
push 0x7d
call dword [eax + 0x38]
test eax, eax
jne 0x527970
mov eax, dword [ebx + 0x114]
lea ecx, [ebx + 0x114]
push 0x7d
call dword [eax + 0x38]
test eax, eax
jne 0x527970
mov eax, dword [ebx + 0x204]
lea ecx, [ebx + 0x204]
push 0x7d
call dword [eax + 0x38]
test eax, eax
je 0x52797b
mov ebx, dword [eax + 0x7c]
shr ebx, 2
and ebx, 1
jmp 0x52797d
xor ebx, ebx
test edi, edi
je 0x527986
lea eax, [edi - 0x24]
jmp 0x527988
xor eax, eax
lea ecx, [eax + 0x24]
mov dword [ebp - 4], eax
mov eax, dword [ecx]
push 0x81
call dword [eax + 0x38]
test eax, eax
jne 0x5279ca
mov ecx, dword [ebp - 4]
add ecx, 0x114
push 0x81
mov eax, dword [ecx]
call dword [eax + 0x38]
test eax, eax
jne 0x5279ca
mov ecx, dword [ebp - 4]
add ecx, 0x204
push 0x81
mov eax, dword [ecx]
call dword [eax + 0x38]
test eax, eax
je 0x5279d5
mov eax, dword [eax + 0x7c]
shr eax, 2
and eax, 1
jmp 0x5279d7
xor eax, eax
mov dword [esi + 0x924], eax
test eax, eax
jne 0x527a33
test edi, edi
je 0x5279ea
add edi, 0xffffffdc
jmp 0x5279ec
xor edi, edi
mov eax, dword [edi + 0x24]
lea ecx, [edi + 0x24]
push 0x7a
call dword [eax + 0x38]
test eax, eax
jne 0x527a25
mov eax, dword [edi + 0x114]
lea ecx, [edi + 0x114]
push 0x7a
call dword [eax + 0x38]
test eax, eax
jne 0x527a25
mov eax, dword [edi + 0x204]
lea ecx, [edi + 0x204]
push 0x7a
call dword [eax + 0x38]
test eax, eax
je 0x527a33
and dword [eax + 0x7c], 0xfffffffb
mov ecx, edi
push 1
push eax
call fcn.004458f0
test ebx, ebx
jne 0x527a45
mov ecx, esi
call fcn.0050e390
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0xa50], 0
jne 0x527a58
mov dword [esi + 0x928], 0
mov ecx, esi
mov dword [esi + 0xa4c], 1
call fcn.0050e390
cmp dword [esi + 0xa50], 0
jne 0x527a7d
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret