joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49cd50
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53f7f0
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x579aa4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], 0
push 0
push 1
push 1
push 0
push 0
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax + 0x30]
push ecx
push str.PopWndTrackerShadeWnd.xml
mov ecx, dword [ebp - 0x3c]
add ecx, 0x58
call fcn.00410dd0
movzx edx, al
test edx, edx
jne 0x49cdb6
or eax, 0xffffffff
jmp 0x49cf62
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x3c]
add ecx, 0x60
call fcn.00415be0
mov ecx, eax
call fcn.00425610
push eax
mov ecx, dword [ebp - 0x3c]
add ecx, 0x1ac
call fcn.004a48c0
lea ecx, [ebp - 0x28]
call fcn.00425860
push 0
mov ecx, dword [ebp - 0x3c]
add ecx, 0x60
call fcn.00415be0
mov ecx, eax
call fcn.00425640
push 0
mov ecx, dword [ebp - 0x3c]
push ecx
push ecx
mov esi, esp
push 0x5c2c
mov edx, dword [ebp - 0x3c]
add edx, 0x1ac
push ecx
mov ecx, esp
push edx
call fcn.00417630
push esi
call fcn.0043afc0
add esp, 0xc
mov ecx, dword [ebp - 0x3c]
add ecx, 0x58
call fcn.00411d40
cmp dword [ebp - 0x3c], 0
je 0x49ce3c
mov eax, dword [ebp - 0x3c]
add eax, 0x54
mov dword [ebp - 0x40], eax
jmp 0x49ce43
mov dword [ebp - 0x40], 0
push 0
push 0
push 1
mov ecx, dword [ebp - 0x3c]
push ecx
mov edx, dword [ebp - 0x40]
push edx
push ecx
mov esi, esp
push 0x5c34
mov eax, dword [ebp - 0x3c]
add eax, 0x1ac
push ecx
mov ecx, esp
push eax
call fcn.00417630
push esi
call fcn.0043afc0
add esp, 0xc
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x3c]
add ecx, 0x58
call fcn.00412d00
lea ecx, [ebp - 0x14]
call fcn.00417720
test eax, eax
je 0x49cef7
mov ecx, dword [ebp - 0x3c]
add ecx, 0x30
call fcn.004a0a30
push eax
lea ecx, [ebp - 0x18]
call fcn.004253a0
mov dword [ebp - 0x24], 0
xor edx, edx
mov dword [ebp - 0x20], edx
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x18]
call fcn.00425190
push eax
lea ecx, [ebp - 0x14]
call fcn.00417730
mov ecx, eax
call fcn.0042c0d0
push 0xffffffffffffffff
push 0xa
call fcn.00401780
mov ecx, eax
call fcn.00410440
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x24]
lea eax, [edx + ecx*2]
mov ecx, dword [ebp - 0x3c]
mov dword [ecx + 0x444], eax
lea ecx, [ebp - 0x18]
call fcn.00425380
mov edx, dword [ebp - 0x3c]
mov dword [edx + 0x1a4], 1
lea ecx, [ebp - 0x14]
call fcn.00410830
jmp 0x49cf1b
mov dword [ebp - 4], 0xffffffff
push 0
push 0x80020
push 0
mov ecx, dword [ebp - 0x3c]
add ecx, 0x30
call fcn.004a17f0
push 2
push 0xb4
push 0
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax + 0x30]
push ecx
call dword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
push 0
push 0x1f4
push 0x64
mov ecx, dword [ebp - 0x3c]
add ecx, 0x30
call fcn.004a0cc0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x49fab0
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
lea eax, [ebp - 8]
push eax
call fcn.004a0620
add esp, 4
lea ecx, [ebp - 8]
call fcn.00406010
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x49fae9
push 0
lea ecx, [ebp - 8]
call fcn.00406010
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [ebp - 4]
push ecx
call fcn.004a0750
add esp, 4
lea ecx, [ebp - 4]
call fcn.00406010
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x49fb19
push 0
lea ecx, [ebp - 4]
call fcn.00406010
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [ebp - 4]
call fcn.00406190
lea ecx, [ebp - 8]
call fcn.00406190
mov esp, ebp
pop ebp
ret
Function at 0x4a6790
Capabilities:
Create shortcut via ishelllink
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x4a68f3
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0x555ddc
push 1
push 0
push 0x558c0c
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x4a68f3
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.004a70c0
add esp, 4
mov ecx, eax
call fcn.00406010
push eax
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [eax + 0x50]
call edx
lea ecx, [ebp - 0x18]
call fcn.00406190
lea eax, [ebp - 0xc]
push eax
push 0x557cdc
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [edx]
call ecx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x4a68e5
lea ecx, [ebp - 0x14]
call fcn.00406250
push 0
push 0x10
push 0x104
lea ecx, [ebp - 0x14]
call fcn.004058f0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call fcn.00406060
lea ecx, [ebp - 0x10]
call fcn.00406250
push 0
push 0x550dfc
lea edx, [ebp - 0x34]
push edx
call fcn.0044f420
add esp, 0xc
mov ecx, eax
call fcn.00402b70
push eax
push 0x550e0c
lea eax, [ebp - 0x10]
push eax
call fcn.00403850
add esp, 0xc
lea ecx, [ebp - 0x34]
call fcn.00402ac0
push 0
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x38]
push eax
call fcn.0048c1e0
add esp, 0xc
mov ecx, eax
call fcn.00406010
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [edx + 0x18]
call ecx
lea ecx, [ebp - 0x38]
call fcn.00406190
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [eax + 8]
call edx
lea ecx, [ebp - 0x10]
call fcn.00406190
lea ecx, [ebp - 0x14]
call fcn.00406190
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ecx + 8]
call eax
call dword [sym.imp.ole32.dll_CoUninitialize]
mov esp, ebp
pop ebp
ret
Function at 0x4a6900
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
lea ecx, [ebp - 0x28]
call fcn.00406250
push 0
push 0x10
push 0x104
lea ecx, [ebp - 0x28]
call fcn.004058f0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x28]
call fcn.00406060
push 0
push str.IDS_ALLLNK
lea eax, [ebp - 0x4c]
push eax
call fcn.0044f420
add esp, 0xc
mov ecx, eax
call fcn.00402b70
push eax
lea ecx, [ebp - 0x24]
call fcn.00405520
lea ecx, [ebp - 0x4c]
call fcn.00402ac0
lea ecx, [ebp - 0x18]
call fcn.00436d10
mov dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x2c]
push ecx
push 0x550e34
lea edx, [ebp - 0x20]
push edx
lea ecx, [ebp - 0x24]
call fcn.00402710
lea ecx, [ebp - 0x20]
call fcn.00405620
movzx eax, al
test eax, eax
jne 0x4a69c4
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x18]
call fcn.00424dc0
lea edx, [ebp - 0x2c]
push edx
push 0x550e38
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x24]
call fcn.00402710
push eax
lea ecx, [ebp - 0x20]
call fcn.00404a40
lea ecx, [ebp - 0x50]
call fcn.00406190
jmp 0x4a6981
lea ecx, [ebp - 0x1c]
call fcn.00406250
mov dword [ebp - 0x30], 0
jmp 0x4a69de
mov ecx, dword [ebp - 0x30]
add ecx, 1
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x18]
call fcn.004240e0
cmp dword [ebp - 0x30], eax
jae 0x4a6a20
mov edx, dword [ebp - 0x30]
push edx
lea ecx, [ebp - 0x18]
call fcn.0042fe00
mov eax, dword [eax]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
push 0x550e3c
lea edx, [ebp - 0x1c]
push edx
call fcn.00403850
add esp, 0x10
lea ecx, [ebp - 0x1c]
call fcn.00406010
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4a69d5
lea ecx, [ebp - 0x1c]
call fcn.00406190
lea ecx, [ebp - 0x20]
call fcn.00406190
lea ecx, [ebp - 0x18]
call fcn.00436bc0
lea ecx, [ebp - 0x24]
call fcn.00406190
lea ecx, [ebp - 0x28]
call fcn.00406190
mov esp, ebp
pop ebp
ret
Function at 0x4a6a50
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov dword [ebp - 0x3c], 0
mov byte [ebp - 9], 0
lea ecx, [ebp - 0x10]
call fcn.00406250
push 0
push 0x10
push 0x104
lea ecx, [ebp - 0x10]
call fcn.004058f0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.00406060
lea ecx, [ebp - 8]
call fcn.00406250
push 0
push 0x550e50
lea eax, [ebp - 0x2c]
push eax
call fcn.0044f420
add esp, 0xc
mov ecx, eax
call fcn.00402b70
push eax
push 0x550e60
lea ecx, [ebp - 8]
push ecx
call fcn.00403850
add esp, 0xc
lea ecx, [ebp - 0x2c]
call fcn.00402ac0
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 4]
push ecx
call fcn.0048c1e0
add esp, 0xc
lea ecx, [ebp - 4]
call fcn.00406010
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4a6b29
lea edx, [ebp - 0x34]
push edx
call fcn.004a70c0
add esp, 4
or dword [ebp - 0x3c], 1
mov ecx, eax
call fcn.00406010
push eax
lea ecx, [ebp - 4]
call fcn.00406010
push eax
call fcn.004a6b80
add esp, 8
movzx eax, al
test eax, eax
je 0x4a6b29
mov dword [ebp - 0x40], 1
jmp 0x4a6b30
mov dword [ebp - 0x40], 0
mov cl, byte [ebp - 0x40]
mov byte [ebp - 0x2d], cl
mov edx, dword [ebp - 0x3c]
and edx, 1
je 0x4a6b4a
and dword [ebp - 0x3c], 0xfffffffe
lea ecx, [ebp - 0x34]
call fcn.00406190
movzx eax, byte [ebp - 0x2d]
test eax, eax
je 0x4a6b56
mov byte [ebp - 9], 1
mov cl, byte [ebp - 9]
mov byte [ebp - 0x35], cl
lea ecx, [ebp - 4]
call fcn.00406190
lea ecx, [ebp - 8]
call fcn.00406190
lea ecx, [ebp - 0x10]
call fcn.00406190
mov al, byte [ebp - 0x35]
mov esp, ebp
pop ebp
ret
Function at 0x4a6d00
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 0x38], 0
lea ecx, [ebp - 0xc]
call fcn.00406250
push 0
push 0x10
push 0x104
lea ecx, [ebp - 0xc]
call fcn.004058f0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0xffffffffffffffff
lea ecx, [ebp - 0xc]
call fcn.00406060
lea ecx, [ebp - 8]
call fcn.00406250
push 0
push str.IDS_LNK
lea eax, [ebp - 0x28]
push eax
call fcn.0044f420
add esp, 0xc
mov ecx, eax
call fcn.00402b70
push eax
push str._s.lnk
lea ecx, [ebp - 8]
push ecx
call fcn.00403850
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.00402ac0
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 4]
push ecx
call fcn.0048c1e0
add esp, 0xc
lea ecx, [ebp - 4]
call fcn.00406010
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4a6dd5
lea edx, [ebp - 0x30]
push edx
call fcn.004a70c0
add esp, 4
or dword [ebp - 0x38], 1
mov ecx, eax
call fcn.00406010
push eax
lea ecx, [ebp - 4]
call fcn.00406010
push eax
call fcn.004a6b80
add esp, 8
movzx eax, al
test eax, eax
je 0x4a6dd5
mov dword [ebp - 0x3c], 1
jmp 0x4a6ddc
mov dword [ebp - 0x3c], 0
mov cl, byte [ebp - 0x3c]
mov byte [ebp - 0x29], cl
mov edx, dword [ebp - 0x38]
and edx, 1
je 0x4a6df6
and dword [ebp - 0x38], 0xfffffffe
lea ecx, [ebp - 0x30]
call fcn.00406190
movzx eax, byte [ebp - 0x29]
test eax, eax
je 0x4a6e1f
mov byte [ebp - 0x31], 1
lea ecx, [ebp - 4]
call fcn.00406190
lea ecx, [ebp - 8]
call fcn.00406190
lea ecx, [ebp - 0xc]
call fcn.00406190
mov al, byte [ebp - 0x31]
jmp 0x4a6e3e
mov byte [ebp - 0x32], 0
lea ecx, [ebp - 4]
call fcn.00406190
lea ecx, [ebp - 8]
call fcn.00406190
lea ecx, [ebp - 0xc]
call fcn.00406190
mov al, byte [ebp - 0x32]
mov esp, ebp
pop ebp
ret
Function at 0x4a9320
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x579aa4]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
push str.360leakfixer.exe
lea eax, [ebp - 8]
push eax
call fcn.00497640
add esp, 8
lea ecx, [ebp - 8]
call fcn.00406010
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4a9429
lea ecx, [ebp - 0x10]
call fcn.00406250
push 0x551024
lea ecx, [ebp - 0xc]
push ecx
call fcn.00497640
add esp, 8
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebp - 0xc]
call fcn.00406010
push eax
call fcn.0048be50
add esp, 8
test eax, eax
je 0x4a9419
xor eax, eax
mov word [ebp - 0x220], ax
push 0x206
push 0
lea ecx, [ebp - 0x21e]
push ecx
call fcn.0050c770
add esp, 0xc
push 0x103
lea edx, [ebp - 0x220]
push edx
push str.8.9.0.0
push str.safe_minver
push str.Installer
call fcn.0049aa90
add esp, 0x14
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x10]
call fcn.00406010
push eax
call fcn.0048bc90
add esp, 8
test eax, eax
jge 0x4a9419
lea ecx, [ebp - 0x220]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0xc]
push eax
push str.IsSafeNeedUpdate__s__s__s
call fcn.004a9810
add esp, 0x10
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xc]
call fcn.00406190
lea ecx, [ebp - 0x10]
call fcn.00406190
lea ecx, [ebp - 8]
call fcn.00406190
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0050c75f
mov esp, ebp
pop ebp
ret
Function at 0x4a9450
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x579aa4]
xor eax, ebp
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x220]
push eax
call fcn.0049aa70
add esp, 4
mov ecx, eax
call fcn.00406010
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0x219], al
lea ecx, [ebp - 0x220]
call fcn.00406190
movzx ecx, byte [ebp - 0x219]
test ecx, ecx
je 0x4a94aa
xor eax, eax
jmp 0x4a95b9
lea ecx, [ebp - 8]
call fcn.00406250
push str.deepscandeepscan.dll
lea edx, [ebp - 4]
push edx
call fcn.00497640
add esp, 8
lea ecx, [ebp - 4]
call fcn.00406010
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4a9586
call fcn.004a95d0
test eax, eax
je 0x4a9586
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
call fcn.00406010
push eax
call fcn.0048be50
add esp, 8
test eax, eax
je 0x4a9584
xor ecx, ecx
mov word [ebp - 0x218], cx
push 0x206
push 0
lea edx, [ebp - 0x216]
push edx
call fcn.0050c770
add esp, 0xc
push 0x103
lea eax, [ebp - 0x218]
push eax
push str.3.5.0.1020
push str.scan_minver
push str.Installer
call fcn.0049aa90
add esp, 0x14
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 8]
call fcn.00406010
push eax
call fcn.0048bc90
add esp, 8
test eax, eax
jl 0x4a9584
mov dword [ebp - 0x224], 1
lea ecx, [ebp - 4]
call fcn.00406190
lea ecx, [ebp - 8]
call fcn.00406190
mov eax, dword [ebp - 0x224]
jmp 0x4a95b9
jmp 0x4a9599
call fcn.004a95d0
push eax
push str.IsClousSec3Available__d
call fcn.004a9810
add esp, 8
mov dword [ebp - 0x228], 0
lea ecx, [ebp - 4]
call fcn.00406190
lea ecx, [ebp - 8]
call fcn.00406190
mov eax, dword [ebp - 0x228]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0050c75f
mov esp, ebp
pop ebp
ret

Function at 0x4a95d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push eax
call fcn.00482f60
add esp, 4
push str.deepscancloudsec3.dll
lea ecx, [ebp - 4]
call fcn.00405a70
lea ecx, [ebp - 4]
call fcn.00406010
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [ebp - 8], eax
lea ecx, [ebp - 4]
call fcn.00406190
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x4a9840
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea ecx, [ebp - 4]
call fcn.00406250
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 4]
call fcn.00402870
push 0x551150
lea ecx, [ebp - 4]
call fcn.00405a70
lea edx, [ebp - 4]
push edx
push 0x55cd84
lea eax, [ebp - 8]
push eax
call fcn.0048c240
add esp, 0xc
mov ecx, eax
call fcn.00406010
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 8]
call fcn.00406190
lea ecx, [ebp - 4]
call fcn.00406190
mov esp, ebp
pop ebp
ret
Function at 0x4b0dc0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.0050c860
mov eax, dword [0x579aa4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1014], ecx
mov eax, dword [ebp - 0x1014]
cmp dword [eax + 0xf0], 0
jne 0x4b0f31
xor ecx, ecx
mov word [ebp - 0x808], cx
push 0x7fe
push 0
lea edx, [ebp - 0x806]
push edx
call fcn.0050c770
add esp, 0xc
xor eax, eax
mov word [ebp - 0x1010], ax
push 0x7fe
push 0
lea ecx, [ebp - 0x100e]
push ecx
call fcn.0050c770
add esp, 0xc
lea edx, [ebp - 0x80c]
push edx
call fcn.004a0660
add esp, 4
lea ecx, [ebp - 0x80c]
call fcn.00406010
push eax
push 0x400
lea eax, [ebp - 0x808]
push eax
push 0x551290
push str.system
push 0x5512a4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x80c]
call fcn.00406010
push eax
push 0x400
lea ecx, [ebp - 0x1010]
push ecx
push 0x5512b8
push 0x5512bc
push str.NoPopWnd
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x80c]
call fcn.00406010
push eax
push 0x1f4
push str.sleeptime
push 0x5512f8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, dword [ebp - 0x1014]
mov dword [edx + 0xe8], eax
lea eax, [ebp - 0x808]
push eax
mov ecx, dword [ebp - 0x1014]
add ecx, 0xec
call fcn.004057e0
lea ecx, [ebp - 0x1010]
push ecx
mov ecx, dword [ebp - 0x1014]
add ecx, 0xe4
call fcn.004057e0
mov ecx, dword [ebp - 0x1014]
add ecx, 0xec
call fcn.0044f460
mov ecx, dword [ebp - 0x1014]
add ecx, 0xe4
call fcn.0044f460
mov edx, dword [ebp - 0x1014]
mov dword [edx + 0xf0], 1
lea ecx, [ebp - 0x80c]
call fcn.00406190
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050c75f
mov esp, ebp
pop ebp
ret
Function at 0x4b1010
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x579aa4]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x228], ecx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 8]
call fcn.00405520
lea ecx, [ebp - 8]
push ecx
push 0x551318
lea edx, [ebp - 0x21c]
push edx
call fcn.0048c240
add esp, 0xc
push eax
lea ecx, [ebp - 8]
call fcn.00404a40
lea ecx, [ebp - 0x21c]
call fcn.00406190
push 0x55131c
lea ecx, [ebp - 8]
call fcn.00405a70
push 0x551328
lea ecx, [ebp - 8]
call fcn.00405a70
lea ecx, [ebp - 8]
call fcn.0044f460
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0xc]
call fcn.00405520
lea ecx, [ebp - 0xc]
call fcn.0044f460
xor ecx, ecx
mov word [ebp - 0x218], cx
push 0x206
push 0
lea edx, [ebp - 0x216]
push edx
call fcn.0050c770
add esp, 0xc
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 4]
call fcn.00405520
lea ecx, [ebp - 4]
call fcn.0044f460
push 0
lea ecx, [ebp - 4]
call fcn.00406010
push eax
lea ecx, [ebp - 0xc]
call fcn.00402830
cmp eax, 0xffffffff
je 0x4b1144
push 0
lea ecx, [ebp - 8]
call fcn.00406010
push eax
mov ecx, dword [ebp - 0x228]
add ecx, 0xec
call fcn.00402830
cmp eax, 0xffffffff
je 0x4b1144
mov dword [ebp - 0x220], 1
lea ecx, [ebp - 4]
call fcn.00406190
lea ecx, [ebp - 0xc]
call fcn.00406190
lea ecx, [ebp - 8]
call fcn.00406190
mov eax, dword [ebp - 0x220]
jmp 0x4b1186
mov dword [ebp - 0x224], 0
lea ecx, [ebp - 4]
call fcn.00406190
lea ecx, [ebp - 0xc]
call fcn.00406190
lea ecx, [ebp - 8]
call fcn.00406190
mov eax, dword [ebp - 0x224]
jmp 0x4b1186
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050c75f
mov esp, ebp
pop ebp
ret 8
Function at 0x4b1d60
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
mov eax, dword [0x579aa4]
xor eax, ebp
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 4]
call fcn.00406250
lea eax, [ebp - 8]
push eax
call fcn.004b2ca0
add esp, 4
cmp dword [ebp + 0xc], 1
je 0x4b1d93
cmp dword [ebp + 0xc], 4
jne 0x4b1dae
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
push str._s_s_.bmp
lea eax, [ebp - 4]
push eax
call fcn.00403850
add esp, 0x10
jmp 0x4b1de8
cmp dword [ebp + 0xc], 2
jne 0x4b1dcf
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
push str._s_s__m_.bmp
lea eax, [ebp - 4]
push eax
call fcn.00403850
add esp, 0x10
jmp 0x4b1de8
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
push str._s_s__w_.bmp
lea eax, [ebp - 4]
push eax
call fcn.00403850
add esp, 0x10
push 0x250
push 0
lea ecx, [ebp - 0x260]
push ecx
call fcn.0050c770
add esp, 0xc
lea edx, [ebp - 0x260]
push edx
lea ecx, [ebp - 4]
call fcn.00406010
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 0xffffffff
jne 0x4b1e45
mov byte [ebp - 0x269], 0
lea ecx, [ebp - 8]
call fcn.00406190
lea ecx, [ebp - 4]
call fcn.00406190
mov al, byte [ebp - 0x269]
jmp 0x4b1f43
cmp dword [ebp + 0xc], 1
jne 0x4b1f19
mov eax, 1
test eax, eax
je 0x4b1f19
push 0x5514c0
lea ecx, [ebp - 0x234]
push ecx
call fcn.0044de30
add esp, 8
test eax, eax
jne 0x4b1e8c
push 0x5514c8
lea edx, [ebp - 0x234]
push edx
call fcn.0044de30
add esp, 8
test eax, eax
je 0x4b1ee8
lea eax, [ebp - 0x260]
push eax
mov ecx, dword [ebp - 0x264]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 0
je 0x4b1eba
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x4b1ee6
mov edx, dword [ebp - 0x264]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [ebp - 0x26a], 0
lea ecx, [ebp - 8]
call fcn.00406190
lea ecx, [ebp - 4]
call fcn.00406190
mov al, byte [ebp - 0x26a]
jmp 0x4b1f43
jmp 0x4b1f14
mov eax, dword [ebp - 0x264]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [ebp - 0x26b], 1
lea ecx, [ebp - 8]
call fcn.00406190
lea ecx, [ebp - 4]
call fcn.00406190
mov al, byte [ebp - 0x26b]
jmp 0x4b1f43
jmp 0x4b1e4f
mov ecx, dword [ebp - 0x264]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [ebp - 0x26c], 1
lea ecx, [ebp - 8]
call fcn.00406190
lea ecx, [ebp - 4]
call fcn.00406190
mov al, byte [ebp - 0x26c]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0050c75f
mov esp, ebp
pop ebp
ret
Function at 0x4b2580
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
push str.SoftMgrSoftMgr.exe
lea eax, [ebp - 4]
push eax
call fcn.00497640
add esp, 8
lea ecx, [ebp - 4]
call fcn.00406010
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4b2660
lea ecx, [ebp - 4]
call fcn.00406010
push eax
call fcn.004a85c0
add esp, 4
test eax, eax
je 0x4b2660
lea ecx, [ebp - 0xc]
call fcn.00406250
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 0x10c], 1
je 0x4b25ea
mov edx, dword [ebp - 0x14]
cmp dword [edx + 0x10c], 2
jne 0x4b25fd
mov eax, dword [ebp - 0x14]
add eax, 0x84
push eax
lea ecx, [ebp - 0xc]
call fcn.00404a40
jmp 0x4b260f
mov ecx, dword [ebp - 0x14]
add ecx, 0xf8
push ecx
lea ecx, [ebp - 0xc]
call fcn.00404a40
lea ecx, [ebp - 8]
call fcn.00406250
mov edx, dword [ebp - 0xc]
push edx
push str._Uninstall__s_
lea eax, [ebp - 8]
push eax
call fcn.00403850
add esp, 0xc
push 1
push 0
push 0
push 0
lea ecx, [ebp - 8]
call fcn.00406010
push eax
lea ecx, [ebp - 4]
call fcn.00406010
push eax
push 0
call fcn.0048ebf0
add esp, 0x1c
lea ecx, [ebp - 8]
call fcn.00406190
lea ecx, [ebp - 0xc]
call fcn.00406190
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 4]
call fcn.00406190
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4b2690
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x579aa4]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x218], ecx
cmp dword [ebp + 0x10], 0x64
je 0x4b26b6
xor eax, eax
jmp 0x4b2793
push 0x55169c
lea ecx, [ebp - 4]
call fcn.00405520
mov eax, dword [ebp - 0x218]
cmp dword [eax + 0x10c], 1
je 0x4b26e1
mov ecx, dword [ebp - 0x218]
cmp dword [ecx + 0x10c], 2
jne 0x4b26f8
mov edx, dword [ebp - 0x218]
add edx, 0x84
push edx
lea ecx, [ebp - 4]
call fcn.00404a40
jmp 0x4b270c
mov eax, dword [ebp - 0x218]
add eax, 0xf8
push eax
lea ecx, [ebp - 4]
call fcn.00404a40
lea ecx, [ebp - 4]
call fcn.00406010
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4b277b
xor ecx, ecx
mov word [ebp - 0x210], cx
push 0x206
push 0
lea edx, [ebp - 0x20e]
push edx
call fcn.0050c770
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
push str._select____s_
push 0x104
lea ecx, [ebp - 0x210]
push ecx
call fcn.004532b0
add esp, 0x10
push 5
push 0x5516bc
lea edx, [ebp - 0x210]
push edx
push str.Explorer.exe
push 0x5516dc
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x214], 0
lea ecx, [ebp - 4]
call fcn.00406190
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050c75f
mov esp, ebp
pop ebp
ret 0x10