joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c15b0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x503743
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x53f030]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0x11
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0xa
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x10], 0x3f400000
mov dword [esi + 0x14], 0x3e800000
mov dword [esi + 0x18], 0x40100000
mov dword [esi + 0x1c], 0x26
mov dword [esi + 0x20], 0
mov dword [esi], vtable.APNU::CConfig.0
mov dword [ebp - 4], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0x11
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0xa
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x40], 0x3f400000
mov dword [esi + 0x44], 0x3e800000
mov dword [esi + 0x48], 0x40100000
mov dword [esi + 0x4c], 0x26
mov dword [esi + 0x50], 0
mov eax, dword [ebp + 8]
mov dword [esi + 0x64], 1
mov byte [ebp - 4], 1
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.0043a9d0
add esp, 4
add eax, 0x10
mov dword [esi + 0x68], eax
call fcn.0043ae40
mov ecx, eax
test ecx, ecx
jne 0x4c16c5
push 0x80004005
call fcn.0043a9b0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x6c], eax
call fcn.0043ae40
mov ecx, eax
test ecx, ecx
jne 0x4c16e5
push 0x80004005
call fcn.0043a9b0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x70], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4c19b0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fff78
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x53f030]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
je 0x4c1b8d
mov edi, dword [ebp + 0xc]
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
je 0x4c1b8d
push 1
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 0x5c
push eax
mov ecx, esi
call fcn.0044b6c0
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
push ecx
mov ecx, eax
call fcn.0043aa40
mov edx, dword [ebp - 0x1c]
test eax, eax
mov dword [ebp - 4], 0xffffffff
setne byte [ebp - 0xd]
add edx, 0xfffffff0
or ebx, 0xffffffff
mov eax, ebx
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4c1a48
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0xd], 0
je 0x4c1a59
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
call fcn.004558b0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
push eax
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0043b9e0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], 1
mov ecx, dword [eax - 0xc]
test ecx, ecx
je 0x4c1b5b
push ecx
push eax
mov ecx, esi
call fcn.00452320
lea eax, [ebp - 0x14]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4c1a97
sub eax, edx
mov ecx, esi
sar eax, 1
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00452320
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0043b9e0
mov ecx, dword [eax]
mov esi, dword [ebp - 0x18]
add esi, 0xfffffff0
mov byte [ebp - 4], 2
lea edx, [ecx - 0x10]
cmp edx, esi
je 0x4c1b2a
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x4c1b1b
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x4c1b1b
push edx
call fcn.0043a9d0
add esp, 4
mov dword [ebp - 0x20], eax
mov ecx, ebx
lock xadd dword [edi], ecx
dec ecx
test ecx, ecx
jg 0x4c1b13
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x20]
add eax, 0x10
mov dword [ebp - 0x18], eax
jmp 0x4c1b27
push dword [ecx - 0xc]
push ecx
lea ecx, [ebp - 0x18]
call fcn.0043b750
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp - 0x24]
mov ecx, ebx
add edx, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4c1b4a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp + 8]
mov ecx, dword [eax - 0xc]
test ecx, ecx
jne 0x4c1a88
lea edx, [eax - 0x10]
mov dword [ebp - 4], 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x4c1b79
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x80070057
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c2c40
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x503918
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x53f030]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 0x1c], 0
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
jne 0x4c2ca9
push esi
push edi
push ebx
push dword [ebp + 8]
call fcn.004c3520
add esp, 0x10
test eax, eax
je 0x4c2ca9
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x18]
mov ecx, edi
push 7
push str.0.0.0.0
mov dword [eax], 1
mov dword [esi], 0
call fcn.0043b750
call fcn.0043ae40
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x4c2ce2
push 0x80004005
call fcn.0043a9b0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
push dword [eax]
lea eax, [ebp - 0x10]
push dword [0x53eb64]
push dword [0x53eb60]
push 0x508008
push eax
call fcn.0043ad30
add esp, 0x14
call fcn.0043ae40
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x4c2d34
push 0x80004005
call fcn.0043a9b0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 0x1c], eax
lea eax, [ebp + 0x1c]
mov byte [ebp - 4], 1
push eax
push 0x2a
call fcn.0049d4c0
add esp, 8
or esi, 0xffffffff
test eax, eax
jns 0x4c2d80
lea eax, [ebp + 0x1c]
push eax
push 0x26
call fcn.0049d4c0
add esp, 8
test eax, eax
jns 0x4c2d80
push edi
mov ecx, edi
call fcn.0043a620
mov eax, dword [ebx]
xor ebx, ebx
cmp dword [eax - 0xc], ebx
setne bl
jmp 0x4c2dd9
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 0x1c]
push eax
call fcn.004c19b0
push dword [0x53eb8c]
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004592f0
add esp, 0x14
push eax
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.0043a620
mov edx, dword [ebp - 0x14]
mov ecx, esi
add edx, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4c2dcf
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebx, eax
mov edi, dword [ebp + 0x1c]
mov edx, esi
add edi, 0xfffffff0
mov byte [ebp - 4], 0
lea ecx, [edi + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4c2df9
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x4c2e1a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c3330
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x53f030]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x418], eax
xor ebx, ebx
push 0x208
lea eax, [ebp - 0x414]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x4c3375
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d89fb
mov esp, ebp
pop ebp
ret
push edi
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x414]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
jne 0x4c339f
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d89fb
mov esp, ebp
pop ebp
ret
lea eax, [edi + 1]
push esi
push eax
call fcn.004d7faf
add esp, 4
mov esi, eax
lea eax, [ebp - 0x414]
push esi
push edi
push dword [ebp - 0x420]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4c3419
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x41c]
push eax
push 0x509c8c
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4c3419
mov ecx, dword [ebp - 0x41c]
test ecx, ecx
je 0x4c3419
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push str._u._u._u._u
push dword [ebp - 0x418]
call fcn.0043ad30
add esp, 0x18
mov ebx, 1
push esi
call fcn.004d89f6
mov ecx, dword [ebp - 4]
add esp, 4
mov eax, ebx
xor ecx, ebp
pop esi
pop edi
pop ebx
call fcn.004d89fb
mov esp, ebp
pop ebp
ret
Function at 0x4c82a0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50440c
mov eax, dword fs:[0]
push eax
sub esp, 0x278
mov eax, dword [0x53f030]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x27c]
xorps xmm0, xmm0
push eax
movdqu xmmword [ebp - 0x27c], xmm0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x27c]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.0048f680
lea eax, [ebp - 0x27c]
push eax
lea ecx, [ebp - 0x26c]
call fcn.004c61d0
lea eax, [ebp - 0x27c]
mov byte [ebp - 4], 1
push eax
mov ecx, esi
call fcn.0048f6c0
lea eax, [ebp - 0x27c]
push eax
lea ecx, [ebp - 0x268]
call fcn.004c61d0
push dword [ebp - 0x26c]
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or edi, 0xffffffff
cmp eax, edi
je 0x4c840a
test al, 0x10
je 0x4c840a
lea eax, [ebp - 0x268]
push 0x51e9b0
push eax
lea esi, [edi + 2]
call fcn.00451150
add esp, 8
test al, al
je 0x4c840c
mov eax, dword [ebp - 0x268]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x280], esp
mov esi, esp
push eax
call fcn.0043a9d0
add eax, 0x10
mov dword [esi], eax
mov eax, dword [ebp - 0x26c]
mov esi, esp
add eax, 0xfffffff0
mov byte [ebp - 4], 3
push eax
call fcn.0043a9d0
add eax, 0x10
add esp, 4
mov dword [esi], eax
lea eax, [ebp - 0x264]
mov byte [ebp - 4], 2
push eax
call fcn.004c4580
add esp, 0xc
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x264]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, edi
jne 0x4c83dd
xor esi, esi
jmp 0x4c83e9
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, 1
mov edx, dword [ebp - 0x264]
mov ecx, edi
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4c840c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4c840c
xor esi, esi
mov edx, dword [ebp - 0x268]
mov ecx, edi
add edx, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4c842f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x26c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
mov dword [ebp - 0x264], ecx
lea eax, [ecx + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x4c845b
mov ecx, dword [ecx]
push dword [ebp - 0x264]
mov edx, dword [ecx]
call dword [edx + 4]
lea eax, [ebp - 0x27c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d89fb
mov esp, ebp
pop ebp
ret 4
Function at 0x4c8e20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
or edx, 0xffffffff
push ebx
push esi
push edi
mov eax, dword [eax + 8]
mov ebx, ecx
mov edi, dword [ebp + 8]
test eax, eax
mov ecx, 0x7d0
mov byte [ebp - 1], 0
cmove ecx, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], ecx
mov esi, dword [edi + 4]
mov dword [ebp + 8], esi
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
jne 0x4c9012
cmp dword [edi + 4], 0
jle 0x4c8f9e
push ecx
push 0
push dword [edi]
push esi
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov esi, eax
cmp esi, 0x102
je 0x4c8fe4
cmp esi, 0xffffffff
je 0x4c8fc6
mov edx, dword [ebx]
mov ecx, ebx
push 0
call dword [edx + 0xc]
test eax, eax
jne 0x4c8fd5
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax + 0x10]
test eax, eax
jne 0x4c8faf
mov ecx, dword [ebp + 8]
lea eax, [ecx - 2]
cmp esi, eax
jae 0x4c8f8d
xor esi, esi
test eax, eax
je 0x4c8f8d
test esi, esi
js 0x4c8f9e
cmp esi, dword [edi + 4]
jge 0x4c8f9e
mov eax, dword [edi]
cmp dword [eax + esi*4], 0
je 0x4c8f81
push 0
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4c8f7e
mov ecx, dword [ebp + 0xc]
push esi
call fcn.004c6970
mov ecx, dword [ebp + 0xc]
cmp dword [eax + 0x24], 0
je 0x4c8f37
lea eax, [ebp - 8]
push eax
push esi
call fcn.004c6970
mov ecx, eax
call fcn.00493510
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4c8f29
test al, 0x10
jne 0x4c8f2d
mov byte [ebp - 1], 1
lea ecx, [ebp - 8]
call fcn.00441080
jmp 0x4c8f6e
push esi
call fcn.004c6970
push eax
mov ecx, ebx
call fcn.004c6c80
test eax, eax
je 0x4c8f6e
mov ecx, dword [ebp + 0xc]
push esi
call fcn.004c6970
push eax
push 0xa
push ecx
mov ecx, dword [ebp + 0xc]
push esp
push esi
call fcn.004c6970
mov ecx, eax
call fcn.004c7d30
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x18]
push esi
mov ecx, edi
call fcn.0043c390
push dword [eax]
call dword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
mov ecx, dword [ebp + 8]
inc esi
lea eax, [ecx - 2]
cmp esi, eax
jb 0x4c8ec4
cmp byte [ebp - 1], 0
jne 0x4c9012
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp + 8]
jmp 0x4c8e51
push 0
push 0
push 1
push 0xc000008c
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov eax, dword [ebx + 0x20]
test eax, eax
je 0x4c9012
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push str.Wait_failure_in_DirectoryMonitor
push 8
call fcn.0045d420
add esp, 8
mov eax, dword [ebp + 0x10]
mov byte [eax], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
xor esi, esi
cmp dword [ebp - 0xc], esi
jle 0x4c9012
xor edi, edi
lea ecx, [ecx]
test esi, esi
js 0x4c8f9e
mov eax, dword [ebp + 0x14]
cmp esi, dword [eax + 8]
jge 0x4c8f9e
mov eax, dword [eax + 4]
mov ecx, ebx
mov edx, dword [ebx]
add eax, edi
push eax
call dword [edx + 0x38]
inc esi
add edi, 0x4c
cmp esi, dword [ebp - 0xc]
jl 0x4c8ff0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4cbfc0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fdc08
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x53f030]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
test esi, esi
jne 0x4cc001
mov eax, 0x80070057
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x513928
lea ecx, [ebp + 8]
call fcn.0043a420
push 0x50a78c
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0
call fcn.00481560
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4cc027
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp + 8]
call fcn.00452320
mov esi, dword [ebp + 0xc]
mov ecx, 1
mov eax, dword [esi]
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, 0xa28
or eax, ecx
jge 0x4cc065
push 0xa28
mov ecx, esi
call fcn.0043b5a0
push dword [esi]
push dword [ebp + 8]
push 0
push 0
push 0x8023
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathAndSubDirW]
mov ecx, dword [esi]
mov edi, eax
test ecx, ecx
je 0x4cc095
push dword [ecx - 8]
push ecx
call fcn.004d9e5f
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x4cc0de
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x4cc0de
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [esi]
mov dword [ebp - 4], 0xffffffff
mov word [eax + ecx*2], dx
or ecx, 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4cc0cb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.0043a9b0
int3

Function at 0x4cca00
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x53f030]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x210]
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push edi
push edx
push 0x20019
push 0
push eax
push ecx
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x210], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x4ccadb
push eax
push eax
push eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x214]
push eax
push edi
push edi
push edi
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, eax
test edi, edi
jne 0x4ccadb
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x4ccadb
push esi
xor esi, esi
test eax, eax
je 0x4ccada
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x218]
mov dword [ebp - 0x218], 0x104
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, eax
test edi, edi
jne 0x4ccad1
lea eax, [ebp - 0x20c]
mov ecx, ebx
push eax
call fcn.0043a770
inc esi
cmp esi, dword [ebp - 0x214]
jb 0x4cca90
pop esi
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop ebx
call fcn.004d89fb
mov esp, ebp
pop ebp
ret
Function at 0x4ce470
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x53f030]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x23c]
mov esi, ecx
push eax
call fcn.004ce9d0
test eax, eax
je 0x4ce51f
xor eax, eax
mov dword [ebp - 0x120], 0x11c
push 0xfe
push eax
mov word [ebp - 0x10c], ax
lea eax, [ebp - 0x10a]
push eax
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x110], 0
call fcn.004d9060
xor eax, eax
add esp, 0xc
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4ce51f
cmp dword [ebp - 0x11c], 0xa
jne 0x4ce51f
cmp dword [ebp - 0x238], 0xa
jae 0x4ce51f
mov dword [esi + 0x128], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004d89fb
mov esp, ebp
pop ebp
ret

Function at 0x4ce530
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x504e08
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x53f030]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.0043ae40
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x4ce574
push 0x80004005
call fcn.0043a9b0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
call fcn.00455a90
mov eax, dword [0x53e914]
lea ecx, [ebp - 0x20]
mov ebx, dword [ebp - 0x10]
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
push 2
push dword [0x53e788]
mov dword [ebp - 0x18], 0
push reloc.WS2_32.dll_accept
call fcn.0043b290
mov esi, dword [ebp - 0x20]
mov edi, eax
test edi, edi
jne 0x4ce5ed
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push ebx
push 1
push 0
push dword [ebp - 0x14]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test esi, esi
je 0x4ce5f8
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x10]
xor ebx, ebx
test edi, edi
mov dword [ebp - 4], 0xffffffff
sete bl
add esi, 0xfffffff0
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4ce623
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ce640
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x53f030]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
mov dword [ebp - 0x120], 0x11c
push 0xfe
push eax
mov word [ebp - 0x10c], ax
lea eax, [ebp - 0x10a]
push eax
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x110], 0
call fcn.004d9060
xor eax, eax
add esp, 0xc
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4ce74e
push 0x2001f
push dword [0x53e788]
lea ecx, [ebp - 0x12c]
mov dword [ebp - 0x12c], 0
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x124], 0
call fcn.0043b290
mov esi, dword [ebp - 0x12c]
test eax, eax
jne 0x4ce743
push 0x11c
lea eax, [ebp - 0x120]
push eax
push 3
push 0
push 0x513b0c
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4ce743
test esi, esi
je 0x4ce72f
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d89fb
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x4ce74e
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.004d89fb
mov esp, ebp
pop ebp
ret