joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47f9d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50c
mov eax, dword [0x5714dc]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x47fb4f
cmp dword [ebp + 0xc], 0x20
jb 0x47fb4f
push 0x400
lea eax, [ebp - 0x504]
mov dword [ebp - 0x50c], 1
push 0
push eax
mov dword [ebp - 0x508], 0x400
call fcn.004a7250
add esp, 0xc
lea eax, [ebp - 0x508]
push eax
lea eax, [ebp - 0x504]
push eax
lea eax, [ebp - 0x50c]
push eax
push 0x542954
push str.SoftwareMaster2Liveup
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x47fb4f
lea ecx, [ebp - 0x504]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x47fa60
sub ecx, edx
cmp ecx, 0x40
jne 0x47fb4f
lea edx, [ecx + 0x40]
push esi
lea ecx, [ebp - 0x84]
lea esi, [ebp - 0x504]
mov eax, ecx
sub esi, eax
lea eax, [edx - 0x60]
test eax, eax
je 0x47fa9c
mov al, byte [esi + ecx]
test al, al
je 0x47fa9c
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x47fa86
test edx, edx
lea eax, [ecx - 1]
lea esi, [ebp - 0x4e4]
mov edx, 0x80
cmovne eax, ecx
lea ecx, [ebp - 0x104]
mov byte [eax], 0
mov eax, ecx
sub esi, eax
nop dword [eax]
lea eax, [edx + 0x7fffff7e]
test eax, eax
je 0x47fad9
mov al, byte [esi + ecx]
test al, al
je 0x47fad9
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x47fac0
test edx, edx
lea eax, [ecx - 1]
push 0x400
cmovne eax, ecx
push 0
mov byte [eax], 0
lea eax, [ebp - 0x504]
push eax
call fcn.004a7250
push 0x400
lea eax, [ebp - 0x504]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.0047fb60
add esp, 0x18
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x504]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
pop esi
test eax, eax
jne 0x47fb4f
lea eax, [ebp - 0x84]
push eax
push dword [ebp + 0xc]
push edi
call fcn.00480d30
neg eax
pop edi
sbb eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00477c28
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop edi
call fcn.00477c28
mov esp, ebp
pop ebp
ret
Function at 0x4808d0
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2c10
call fcn.00478050
mov eax, dword [0x5714dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c10], eax
test eax, eax
je 0x480a3d
cmp dword [ebp + 0xc], 0
je 0x480a3d
push ebx
push esi
xor ebx, ebx
xor esi, esi
push edi
nop dword [eax]
push esi
push str..PhysicalDrive_d
lea eax, [ebp - 0x104]
push 0x100
push eax
call fcn.0047c4b0
add esp, 0x10
lea eax, [ebp - 0x104]
push 0
push 0
push 3
push 0
push 3
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x480a20
push 0x2710
xorps xmm0, xmm0
mov dword [ebp - 0x2c0c], 0
lea eax, [ebp - 0x2bfc]
movq qword [ebp - 0x2c08], xmm0
push 0
push eax
mov dword [ebp - 0x2c00], 0
mov dword [ebp - 0x2c08], 0
mov dword [ebp - 0x2c04], 0
call fcn.004a7250
add esp, 0xc
lea eax, [ebp - 0x2c0c]
push 0
push eax
push 0x2710
lea eax, [ebp - 0x2bfc]
push eax
push 0xc
lea eax, [ebp - 0x2c08]
push eax
push 0x2d1400
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x480a15
push 0x3e8
lea eax, [ebp - 0x4ec]
push 0
push eax
call fcn.004a7250
lea eax, [ebp - 0x4ec]
push eax
push 1
push dword [ebp - 0x2be4]
lea eax, [ebp - 0x2bfc]
push eax
call fcn.00481bf0
add esp, 0x1c
lea eax, [ebp - 0x4ec]
push eax
push dword [ebp + 0xc]
push dword [ebp - 0x2c10]
call fcn.00480d30
test eax, eax
mov eax, 1
cmove ebx, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x480a2a
inc esi
cmp esi, 0x10
jl 0x480910
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00477c28
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.00477c28
mov esp, ebp
pop ebp
ret
Function at 0x480a50
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5714dc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
test ebx, ebx
je 0x480b38
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004a7250
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, eax
test edx, edx
je 0x480b38
mov ecx, ebx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x480aa7
sub ecx, esi
mov eax, 0x103
sar ecx, 1
sub eax, ecx
cmp edx, eax
jae 0x480b38
push edi
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x480ad0
mov eax, dword [0x542798]
mov esi, ebx
mov dword [edi], eax
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x480ae5
lea edi, [ebp - 0x20c]
sub ebx, esi
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x480b00
mov ecx, ebx
lea eax, [ebp - 0x20c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00477c28
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.00477c28
mov esp, ebp
pop ebp
ret
Function at 0x480b50
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x290
mov eax, dword [0x5714dc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x84]
push edi
push 0x80
push 0
push eax
call fcn.004a7250
push 0x80
lea eax, [ebp - 0x84]
push eax
push esi
call fcn.0047fb60
lea ecx, [ebp - 0x188]
mov edi, esi
mov eax, ecx
add esp, 0x18
mov edx, 0x104
sub edi, eax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x480bba
mov al, byte [edi + ecx]
test al, al
je 0x480bba
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x480ba1
lea eax, [ecx - 1]
test edx, edx
cmovne eax, ecx
mov ecx, 0x104
mov byte [eax], 0
lea eax, [ebp - 0x188]
cmp byte [eax], 0
je 0x480bdb
inc eax
sub ecx, 1
jne 0x480bd0
mov edx, 0x104
mov edi, ecx
mov eax, edx
sub eax, ecx
neg edi
sbb edi, edi
and edi, eax
test ecx, ecx
je 0x480c30
lea ecx, [ebp - 0x188]
lea ecx, [ecx + edi]
sub edx, edi
je 0x480c25
lea edi, [ebp - 0x84]
mov eax, SysReAllocString
sub edi, ecx
push ebx
nop dword [eax + eax]
test eax, eax
je 0x480c24
mov bl, byte [edi + ecx]
test bl, bl
je 0x480c24
mov byte [ecx], bl
dec eax
inc ecx
sub edx, 1
jne 0x480c10
pop ebx
test edx, edx
lea eax, [ecx - 1]
cmovne eax, ecx
mov byte [eax], 0
push 0x100
lea eax, [ebp - 0x288]
mov dword [ebp - 0x290], 1
push 0
push eax
call fcn.004a7250
add esp, 0xc
mov dword [ebp - 0x28c], 0x100
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x290]
push eax
push 0x542954
push str.SoftwareMaster2Liveup
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
jne 0x480cea
lea eax, [ebp - 0x288]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x480cb4
test cl, cl
je 0x480cb0
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x480cb4
add eax, 2
add esi, 2
test cl, cl
jne 0x480c94
xor eax, eax
jmp 0x480cb9
sbb eax, eax
or eax, 1
test eax, eax
je 0x480cea
lea ecx, [ebp - 0x288]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x480cc6
sub ecx, edx
lea eax, [ebp - 0x288]
push ecx
push eax
push 1
push str.mid_old
push str.SoftwareMaster2Liveup
push reloc.OLEAUT32.dll_SysReAllocString
call edi
lea ecx, [ebp - 0x188]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x480cf3
sub ecx, edx
lea eax, [ebp - 0x188]
push ecx
push eax
push 1
push 0x542954
push str.SoftwareMaster2Liveup
push reloc.OLEAUT32.dll_SysReAllocString
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00477c28
mov esp, ebp
pop ebp
ret

Function at 0x488f7d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x4dfcaf
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004df8b4

Function at 0x4dfcba
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004dfa35
Function at 0x4e66bb
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004e5e95

Function at 0x4e66c6
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004e60d0

Function at 0x4e6d03
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004e6a8a
Function at 0x4f5350
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5287ca
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5714dc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.LogUtils::LogAppender.0
lea edi, [esi + 0x14]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [esi + 0xc], 1
mov dword [esi + 0x10], 0
call fcn.00417180
mov ecx, eax
test ecx, ecx
je 0x4f5514
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0
lea ebx, [esi + 0x18]
call fcn.00417180
mov ecx, eax
test ecx, ecx
je 0x4f551e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 1
call fcn.00417180
mov ecx, eax
test ecx, ecx
je 0x4f5528
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0xffffffff
lea eax, [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 5
mov dword [esi + 0x10], eax
test edx, edx
jne 0x4f5432
xor ecx, ecx
jmp 0x4f5450
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4f5440
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.00405a30
push edi
mov ecx, ebx
call fcn.0040af90
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x4f546c
xor ecx, ecx
jmp 0x4f5484
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4f5474
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
lea ecx, [esi + 0x1c]
call fcn.00405a30
push ebx
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
call fcn.004f6150
push eax
mov ecx, ebx
mov byte [ebp - 4], 6
call fcn.0040af90
mov edx, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 5
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4f54c5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
je 0x4f54fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4f54fe
cmp dword [esi + 0x10], 0
je 0x4f54f5
push dword [edi]
call fcn.00519285
add esp, 4
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.00404620
push 0x80004005
call fcn.00404620
push 0x80004005
call fcn.00404620
int3
Function at 0x4f5f50
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x528908
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x5714dc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
test esi, esi
je 0x4f6124
push 0x54fb7c
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x4f5fa5
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 4]
jmp 0x4f6124
push 0x54fb9c
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x4f5fc3
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax + 4]
jmp 0x4f6124
push 0x54fbbc
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x4f5fe1
mov eax, dword [edi]
mov ecx, edi
push 2
call dword [eax + 4]
jmp 0x4f6124
push 0x54fbdc
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x4f5fff
mov eax, dword [edi]
mov ecx, edi
push 3
call dword [eax + 4]
jmp 0x4f6124
push 0x54fbfc
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x4f6124
lea eax, [edi + 4]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x4f6024
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [edi + 0x2c]
mov dword [edi + 0x1c], 3
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x30], ecx
jb 0x4f6057
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
cmp ecx, 8
jae 0x4f606f
movups xmm0, xmmword [eax]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 7
movups xmmword [ebp - 0x28], xmm0
jmp 0x4f60ad
mov esi, ecx
mov eax, SysReAllocString
or esi, 7
lea ecx, [ebp - 0x28]
cmp esi, eax
cmova esi, eax
lea eax, [esi + 1]
push eax
call fcn.004156b0
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
lea ecx, [ecx*2 + 2]
push ecx
push dword [ebp - 0x2c]
push eax
call fcn.004a7940
mov eax, dword [ebp - 0x30]
add esp, 0xc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], esi
push 0x54fb0c
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.004f7da0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4f60db
mov dword [edi + 0x1c], 0
cmp dword [edi + 0x28], 0
je 0x4f6114
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x4f6114
push 0x54fc24
lea ecx, [ebp - 0x4c]
call fcn.00411950
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x4c]
push edx
mov byte [ebp - 4], 2
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x4c]
call fcn.00411c90
lea ecx, [ebp - 0x28]
call fcn.00411c90
lea ecx, [ebp - 0x34]
call fcn.004f5640
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00477c28
mov esp, ebp
pop ebp
ret 4
Function at 0x4f69e0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x528aa7
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x5714dc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
lea esi, [edi + 4]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], esi
test esi, esi
je 0x4f6a2a
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, ebx
mov dword [ebp - 4], 0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4f6a36
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [edi + 0x2c]
call fcn.00427b30
cmp dword [edi + 0x28], 0
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x44], eax
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x24], eax
jne 0x4f6aa3
push 0x48
call fcn.004326e0
mov ebx, eax
add esp, 4
mov dword [ebp - 0x38], ebx
mov byte [ebp - 4], 1
test ebx, ebx
je 0x4f6a97
push 0x48
push 0
push ebx
call fcn.004a7250
add esp, 0xc
mov ecx, ebx
push dword [ebp + 0x14]
push dword [ebp - 0x30]
push dword [ebp - 0x2c]
call fcn.004f5350
jmp 0x4f6a99
xor eax, eax
mov ebx, dword [ebp - 0x2c]
mov byte [ebp - 4], 0
mov dword [edi + 0x28], eax
xor eax, eax
mov dword [ebp - 0x18], 0
cmp dword [ebp + 0x10], eax
mov ecx, ebx
mov dword [ebp - 0x14], 7
sete al
lea edx, [ecx + 2]
lea eax, [eax*2 + 1]
mov dword [edi + 0x1c], eax
xor eax, eax
mov word [ebp - 0x28], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4f6ad0
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x28]
call fcn.00427b30
push 3
push 0x54fb0c
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.00415880
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4f6b1f
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], eax
cmp dword [edi + 0x28], 0
je 0x4f6b6e
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x4f6b6e
push 0x10
xor eax, eax
mov dword [ebp - 0x40], 0
push 0x54fb14
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x3c], 7
mov word [ebp - 0x50], ax
call fcn.00427b30
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x50]
push edx
mov byte [ebp - 4], 3
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x50]
call fcn.00411c90
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x4f6ba4
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4f6b9a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4f6be1
push edx
push ecx
call fcn.00477c39
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
test esi, esi
je 0x4f6bc3
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00477c28
mov esp, ebp
pop ebp
ret 0x14
call fcn.004c24f3
int3
Function at 0x4f8aa0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x528d48
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x5714dc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.004326e0
mov edi, eax
add esp, 4
test edi, edi
je 0x4f8b43
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.004fe283
add esp, 4
mov dword [edi + 4], eax
jmp 0x4f8b45
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov ecx, dword [edi + 4]
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 2
push eax
call fcn.004843d0
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
call dword [edx + 0x30]
movzx edi, ax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 3
test ecx, ecx
je 0x4f8ba5
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
je 0x4f8ba5
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov word [esi + 0x40], di
jne 0x4f8bc9
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x4f8beb
cmp byte [ebp + 0xc], 0
je 0x4f8bd8
push esi
call fcn.004fe53b
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x4f8bf7
mov esi, 0x53eb5c
jmp 0x4f8c07
test cl, 2
mov esi, 0x53eb74
mov eax, 0x53eb8c
cmove esi, eax
lea eax, [ebp - 0x1c]
push 1
push eax
call fcn.0045ed00
add esp, 8
lea ecx, [ebp - 0x30]
push eax
push esi
call fcn.0045aa30
push 0x562fc4
lea eax, [ebp - 0x30]
push eax
call fcn.004a744c
int3
Function at 0x4fb410
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [ebp + 8]
call fcn.004fba20
add esp, 8
test al, al
je 0x4fb435
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4fb435
mov al, 1
pop ebp
ret
xor al, al
pop ebp
ret

Function at 0x4fba20
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
pop ebp
ret

Function at 0x4fced0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4fcefb
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4fcefb
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
pop esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x889058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x8891a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x88907e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x88906a
add dl, dl
jne 0x889089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8890dc
xor eax, eax
add dl, dl
jne 0x889096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x88917d
add dl, dl
jne 0x8890a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8890b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8890bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8890c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8890d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x889075
mov eax, 1
add dl, dl
jne 0x8890ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8890f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8890e1
sub eax, ebx
mov ebx, 1
jne 0x889128
mov ecx, 1
add dl, dl
jne 0x88910e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x889119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x889105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x889075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x88913f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x88914a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x889136
cmp eax, 0x7d00
jae 0x88916d
cmp eax, 0x500
jb 0x889168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x889075
cmp eax, 0x7f
ja 0x889170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x889075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x88919e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x889075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x405c5d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, ecx
push eax
push 0x20019
push 0
push 0x43683c
push Ordinal_1
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x405cf4
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push ebx
push dword [ebp - 8]
call edi
test eax, eax
jne 0x405ce9
push 4
pop edi
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], edi
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push str.InsecureQI
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x405ce9
cmp dword [ebp - 0xc], edi
jne 0x405ce9
mov edi, dword [ebp - 0x10]
cmp edi, 3
ja 0x405ce9
cmp dword [ebp - 4], eax
je 0x405cf6
push dword [ebp - 4]
call esi
jmp 0x405cf6
cmp dword [ebp - 4], 0
je 0x405cf4
push dword [ebp - 4]
call esi
xor edi, edi
cmp dword [ebp - 8], 0
je 0x405d01
push dword [ebp - 8]
call esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret