joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4adca0
Capabilities:
Set registry value

Disassembly:
mov eax, 0x320c
call fcn.004d3780
push ebx
push ebp
mov ebp, dword [esp + 0x3224]
push esi
cmp ebp, 0xffe
push edi
jle 0x4adcca
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x320c
ret
xor ebx, ebx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
cmp dword [0x4fde48], ebx
je 0x4addad
mov ebp, dword [esp + 0x3220]
cmp ebp, ebx
jne 0x4adcfc
mov ebp, str.Main
push 1
call fcn.004ad800
mov esi, eax
add esp, 4
cmp dword [esi], ebx
je 0x4adda0
mov ecx, 0x400
xor eax, eax
lea edi, [esp + 0x21c]
lea edx, [esp + 0x21c]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x322c]
mov ecx, dword [esp + 0x3228]
push eax
push ecx
push edx
call fcn.004b1950
lea eax, [esp + 0x1228]
push 0x1000
lea ecx, [esp + 0x22c]
push eax
push ecx
call fcn.004afe50
lea edx, [esp + 0x1234]
push edx
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 0x1c
test eax, eax
je 0x4adda0
push 0x6daae0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [esp + 0x3224]
mov edx, dword [esi]
lea eax, [esp + 0x121c]
push eax
push ecx
push ebp
push edx
call fcn.004aced0
add esp, 0x10
mov ebx, eax
push 0x6daae0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x320c
ret
lea eax, [esp + 0x14]
push str.SoftwarePhoenix
push eax
call dword [sym.imp.MSVCRT.dll_wcscpy]
mov edi, dword [esp + 0x3228]
add esp, 8
cmp edi, ebx
je 0x4adde8
mov esi, dword [sym.imp.MSVCRT.dll_wcscat]
lea ecx, [esp + 0x14]
push 0x4ee640
push ecx
call esi
lea edx, [esp + 0x1c]
push edi
push edx
call esi
add esp, 0x10
mov edx, dword [esp + 0x3230]
lea eax, [esp + 0x10]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push ebx
lea ecx, [esp + 0x2c]
push ebx
push ecx
push edx
mov dword [esp + 0x34], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
cmp esi, ebx
jl 0x4ade42
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x4ade42
mov ecx, dword [esp + 0x3228]
mov edx, dword [esp + 0x3224]
push ebp
push ecx
push 3
push ebx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp esi, ebx
pop edi
pop esi
pop ebp
pop ebx
setge al
add esp, 0x320c
ret
Function at 0x4ade60
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [0x4fde48]
mov dword [esp + 8], 1
test eax, eax
je 0x4adefb
push ebx
mov ebx, dword [esp + 0x220]
test ebx, ebx
jne 0x4adea0
mov ebx, str.Main
push 0
call fcn.004ad800
mov esi, eax
add esp, 4
xor edi, edi
cmp dword [esi], 0
je 0x4adeef
push 0x6daae0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esp + 0x22c]
mov ecx, dword [esp + 0x228]
mov edx, dword [esp + 0x224]
push eax
mov eax, dword [esi]
push ecx
push edx
push ebx
push eax
call fcn.004accf0
add esp, 0x14
mov edi, eax
push 0x6daae0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop ebx
pop edi
pop esi
add esp, 0x210
ret
lea ecx, [esp + 0x10]
push str.SoftwarePhoenix
push ecx
call dword [sym.imp.MSVCRT.dll_wcscpy]
mov edi, dword [esp + 0x224]
add esp, 8
test edi, edi
je 0x4adf36
mov esi, dword [sym.imp.MSVCRT.dll_wcscat]
lea edx, [esp + 0x10]
push 0x4ee640
push edx
call esi
lea eax, [esp + 0x18]
push edi
push eax
call esi
add esp, 0x10
mov ecx, dword [esp + 0x228]
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0x224]
lea edx, [ecx + ecx]
mov ecx, dword [esp + 0x228]
mov dword [esp + 0x10], edx
lea edx, [esp + 0xc]
push ecx
push edx
mov edx, dword [esp + 0x238]
lea ecx, [esp + 0x1c]
push eax
push ecx
push edx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
add esp, 0x210
ret
Function at 0x4adf80
Capabilities:
Set registry value

Disassembly:
sub esp, 0x20c
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [0x4fde48]
test eax, eax
je 0x4ae00b
push ebx
mov ebx, dword [esp + 0x21c]
test ebx, ebx
jne 0x4adfb8
mov ebx, str.Main
push 1
call fcn.004ad800
mov esi, eax
add esp, 4
xor edi, edi
cmp dword [esi], 0
je 0x4adfff
push 0x6daae0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esp + 0x224]
mov ecx, dword [esp + 0x220]
mov edx, dword [esi]
push eax
push ecx
push ebx
push edx
call fcn.004aced0
add esp, 0x10
mov edi, eax
push 0x6daae0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop ebx
pop edi
pop esi
add esp, 0x20c
ret
lea eax, [esp + 0xc]
push str.SoftwarePhoenix
push eax
call dword [sym.imp.MSVCRT.dll_wcscpy]
mov edi, dword [esp + 0x220]
add esp, 8
test edi, edi
je 0x4ae046
mov esi, dword [sym.imp.MSVCRT.dll_wcscat]
lea ecx, [esp + 0xc]
push 0x4ee640
push ecx
call esi
lea edx, [esp + 0x14]
push edi
push edx
call esi
add esp, 0x10
mov edx, dword [esp + 0x228]
lea eax, [esp + 8]
push 0
push eax
push 0
push 0xf003f
push 0
push 0
lea ecx, [esp + 0x24]
push 0
push ecx
push edx
mov dword [esp + 0x2c], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
test edi, edi
jl 0x4ae0ca
mov eax, dword [esp + 8]
test eax, eax
je 0x4ae0ca
mov eax, dword [esp + 0x224]
mov esi, dword [esp + 0x220]
cmp eax, 0xffffffff
jne 0x4ae0a4
push esi
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
shl eax, 1
jmp 0x4ae0a6
add eax, eax
mov ecx, dword [esp + 8]
push eax
mov eax, dword [esp + 0x220]
push esi
push 1
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test edi, edi
pop edi
pop esi
setge al
add esp, 0x20c
ret
Function at 0x4ae0e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x418
push ebx
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, 4
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov eax, dword [0x4fde48]
test eax, eax
je 0x4ae1e1
mov ebx, dword [esp + 0x428]
test ebx, ebx
jne 0x4ae129
mov ebx, str.Main
push 0
call fcn.004ad800
mov esi, eax
add esp, 4
cmp dword [esi], 0
je 0x4ae1d5
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x21e]
mov word [esp + 0x21c], 0
rep stosd dword es:[edi], eax
push 0x6daae0
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [esp + 0x42c]
mov edx, dword [esi]
lea eax, [esp + 0x21c]
push 0x103
push eax
push ecx
push ebx
push edx
call fcn.004accf0
add esp, 0x14
mov esi, eax
push 0x6daae0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test esi, esi
je 0x4ae1d5
lea eax, [esp + 0x21c]
push eax
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
test eax, eax
je 0x4ae1d5
lea ecx, [esp + 0x21c]
push ecx
call dword [sym.imp.MSVCRT.dll__wtoi]
mov edx, dword [esp + 0x434]
add esp, 4
pop edi
mov dword [edx], eax
pop esi
mov eax, 1
pop ebx
add esp, 0x418
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x418
ret
lea eax, [esp + 0x14]
push str.SoftwarePhoenix
push eax
call dword [sym.imp.MSVCRT.dll_wcscpy]
mov edi, dword [esp + 0x430]
add esp, 8
test edi, edi
je 0x4ae21c
mov esi, dword [sym.imp.MSVCRT.dll_wcscat]
lea ecx, [esp + 0x14]
push 0x4ee640
push ecx
call esi
lea edx, [esp + 0x1c]
push edi
push edx
call esi
add esp, 0x10
mov ecx, dword [esp + 0x430]
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x430]
lea edx, [esp + 0x10]
push ecx
push edx
mov edx, dword [esp + 0x440]
lea ecx, [esp + 0x20]
push eax
push ecx
push edx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
neg eax
sbb eax, eax
pop edi
pop esi
inc eax
pop ebx
add esp, 0x418
ret
Function at 0x4ae2c0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x414
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [0x4fde48]
test eax, eax
je 0x4ae38b
push ebx
mov ebx, dword [esp + 0x424]
test ebx, ebx
jne 0x4ae2fc
mov ebx, str.Main
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x21a]
mov word [esp + 0x218], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x42c]
lea ecx, [esp + 0x218]
push eax
push 0x4f20cc
push 0x103
push ecx
call dword [sym.imp.MSVCRT.dll__snwprintf]
push 1
call fcn.004ad800
mov esi, eax
add esp, 0x14
xor edi, edi
cmp dword [esi], 0
je 0x4ae37f
push 0x6daae0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esp + 0x428]
mov ecx, dword [esi]
lea edx, [esp + 0x218]
push edx
push eax
push ebx
push ecx
call fcn.004aced0
add esp, 0x10
mov edi, eax
push 0x6daae0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop ebx
pop edi
pop esi
add esp, 0x414
ret
lea edx, [esp + 0xc]
push str.SoftwarePhoenix
push edx
call dword [sym.imp.MSVCRT.dll_wcscpy]
mov edi, dword [esp + 0x428]
add esp, 8
test edi, edi
je 0x4ae3c6
mov esi, dword [sym.imp.MSVCRT.dll_wcscat]
lea eax, [esp + 0xc]
push 0x4ee640
push eax
call esi
lea ecx, [esp + 0x14]
push edi
push ecx
call esi
add esp, 0x10
mov ecx, dword [esp + 0x42c]
lea edx, [esp + 8]
push 0
push edx
push 0
push 0xf003f
push 0
push 0
lea eax, [esp + 0x24]
push 0
push eax
push ecx
mov dword [esp + 0x2c], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
jl 0x4ae42b
mov eax, dword [esp + 8]
test eax, eax
je 0x4ae42b
mov ecx, dword [esp + 0x424]
lea edx, [esp + 0x428]
push 4
push edx
push 4
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
test esi, esi
setge al
pop esi
add esp, 0x414
ret

Function at 0x4ae440
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 8
mov eax, dword [0x4fde48]
mov dword [esp + 4], 0
test eax, eax
je 0x4ae476
push 0
call fcn.004ad800
mov eax, dword [eax]
add esp, 4
test eax, eax
je 0x4ae4c4
mov ecx, dword [esp + 0xc]
push ecx
push eax
call fcn.004ad590
add esp, 8
add esp, 8
ret
mov eax, dword [esp + 0xc]
lea edx, [esp]
push edx
push eax
push reloc.DSOUND.dll_DirectSoundCreate
mov dword [esp + 0xc], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov eax, dword [esp]
test eax, eax
je 0x4ae4c4
lea ecx, [esp + 4]
push 0
push ecx
push 0
push 0
push eax
call dword [sym.imp.SHLWAPI.dll_SHQueryInfoKeyW]
test eax, eax
je 0x4ae4b9
mov dword [esp + 4], 0
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 4]
add esp, 8
ret
Function at 0x4ae5c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 0x24]
sub esp, 0x208
test eax, eax
je 0x4ae5dd
mov ecx, dword [0x4fde48]
xor eax, eax
test ecx, ecx
sete al
jmp 0x4ae5e2
mov eax, dword [0x4fde48]
push esi
push edi
test eax, eax
je 0x4ae679
push ebx
mov ebx, dword [esp + 0x21c]
test ebx, ebx
jne 0x4ae5fd
mov ebx, str.Main
push 0
mov esi, 1
call fcn.004ad800
mov edi, eax
add esp, 4
cmp dword [edi], 0
je 0x4ae66d
mov eax, dword [esp + 0x22c]
push 0x6daae0
mov dword [eax], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [esp + 0x234]
mov edx, dword [esp + 0x230]
mov eax, dword [esp + 0x228]
push ecx
mov ecx, dword [esp + 0x228]
push edx
mov edx, dword [esp + 0x228]
push eax
mov eax, dword [edi]
push ecx
push ebx
push edx
push eax
call fcn.004acb90
mov esi, eax
add esp, 0x1c
neg esi
sbb esi, esi
push 0x6daae0
inc esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebx
mov eax, esi
pop edi
pop esi
add esp, 0x208
ret
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 8]
push str.SoftwarePhoenix
push ecx
stosw word es:[edi], ax
call dword [sym.imp.MSVCRT.dll_wcscpy]
mov edi, dword [esp + 0x220]
add esp, 8
test edi, edi
je 0x4ae6ca
mov esi, dword [sym.imp.MSVCRT.dll_wcscat]
lea edx, [esp + 8]
push 0x4ee640
push edx
call esi
lea eax, [esp + 0x10]
push edi
push eax
call esi
add esp, 0x10
mov ecx, dword [esp + 0x230]
mov edx, dword [esp + 0x22c]
mov eax, dword [esp + 0x228]
push ecx
mov ecx, dword [esp + 0x228]
push edx
mov edx, dword [esp + 0x228]
push eax
mov eax, dword [esp + 0x228]
push ecx
mov ecx, dword [esp + 0x224]
push edx
push eax
push ecx
call dword [sym.imp.SHLWAPI.dll_SHEnumValueW]
pop edi
pop esi
add esp, 0x208
ret

Function at 0x4ae720
Capabilities:
Delete registry key

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
push edi
je 0x4ae7b8
push ebx
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
test eax, eax
je 0x4ae7b8
mov eax, dword [0x6dbf24]
test eax, eax
je 0x4ae7ac
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x4ae7b8
push esi
push str.RegDeleteTreeW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4ae7a1
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push 0xf003f
push 0
push 0
push ecx
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4ae79a
push ebx
push eax
call esi
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
pop edi
pop ebx
ret
mov edx, dword [esp + 0xc]
push ebx
push edx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
pop edi
pop ebx
ret
Function at 0x4ae7c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0xc]
push ebx
push esi
push edi
mov edi, dword [esp + 0x1c]
and ecx, 0xffff
push eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x4ae812
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x4ae812
push ebp
mov ebp, dword [esp + 0x18]
test ebp, ebp
je 0x4ae806
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp], eax
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
pop ebp
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x4aeb70
Capabilities:
Get common file path

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, ecx
test esi, esi
mov dword [esp + 8], 0
je 0x4aebba
push esi
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
test eax, eax
je 0x4aebba
mov ecx, edi
call fcn.004aeb50
mov ecx, dword [eax]
lea edx, [esp + 8]
push 0
push edx
push 0
push esi
push 0
push 0
push eax
call dword [ecx + 0xc]
test eax, eax
je 0x4aebd8
pop edi
xor eax, eax
pop esi
pop ecx
ret 8
mov ecx, dword [esp + 0x14]
lea eax, [esp + 8]
push eax
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
je 0x4aebd8
pop edi
xor eax, eax
pop esi
pop ecx
ret 8
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 8

Function at 0x4af5b0
Capabilities:
Get file system object information

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x2b4
test edx, edx
push esi
je 0x4af64f
push edi
mov ecx, 0xad
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x2c4]
mov eax, 8
test ecx, ecx
pop edi
je 0x4af5e7
mov eax, 9
mov esi, dword [esp + 0x2cc]
test esi, esi
je 0x4af5f7
or ah, 0x40
jmp 0x4af5fa
or ah, 1
mov ecx, dword [esp + 0x2c4]
test ecx, ecx
je 0x4af607
or al, 2
mov ecx, dword [esp + 0x2c8]
test ecx, ecx
je 0x4af617
or eax, 0x10000
push eax
lea eax, [esp + 8]
push 0x2b4
push eax
push 0
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x4af64f
test esi, esi
je 0x4af641
mov eax, dword [esp + 8]
pop esi
add esp, 0x2b4
ret 0x14
mov eax, dword [esp + 4]
pop esi
add esp, 0x2b4
ret 0x14
xor eax, eax
pop esi
add esp, 0x2b4
ret 0x14

Function at 0x4af8d0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x208
mov ax, word [0x4ffec0]
mov edx, ecx
push edi
mov word [esp + 4], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 6]
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x214]
lea ecx, [esp + 8]
push ecx
push eax
mov ecx, edx
call fcn.004aefe0
test eax, eax
pop edi
je 0x4af937
push 1
push 0
lea ecx, [esp + 8]
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, 1
add esp, 0x208
ret 4
xor eax, eax
add esp, 0x208
ret 4
Function at 0x4b0460
Capabilities:
Check os version

Disassembly:
sub esp, 0x31c
lea eax, [esp]
push esi
push eax
mov dword [esp + 8], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [esp + 0x14]
xor ecx, ecx
cmp eax, 2
mov dword [0x6dbf1c], ecx
mov dword [0x6dbf28], ecx
mov dword [0x6dbf20], ecx
mov dword [0x6dbf24], ecx
mov esi, 1
jne 0x4b04e0
mov eax, dword [esp + 8]
cmp eax, 5
jne 0x4b04c7
mov eax, dword [esp + 0xc]
cmp eax, ecx
jne 0x4b04bb
mov dword [0x6dbf28], esi
jmp 0x4b04ea
cmp eax, esi
jne 0x4b04ea
mov dword [0x6dbf20], esi
jmp 0x4b04ea
cmp eax, 6
jne 0x4b04ea
mov eax, dword [esp + 0xc]
cmp eax, ecx
je 0x4b04d8
cmp eax, esi
jne 0x4b04ea
mov dword [0x6dbf24], esi
jmp 0x4b04ea
cmp eax, esi
jne 0x4b04ea
mov dword [0x6dbf1c], esi
mov cx, word [0x4ffec0]
push edi
mov word [esp + 0x11c], cx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x11e]
rep stosd dword es:[edi], eax
lea edx, [esp + 0x11c]
push 0x103
push edx
stosw word es:[edi], ax
call fcn.004b1160
mov ax, word [esp + 0x124]
add esp, 8
cmp ax, 0x37
pop edi
jne 0x4b053e
mov dword [0x6dbf2c], esi
pop esi
add esp, 0x31c
ret
cmp ax, 0x36
jne 0x4b0552
mov dword [0x6dbf30], esi
pop esi
add esp, 0x31c
ret
cmp ax, 0x38
jne 0x4b055e
mov dword [0x6dbf34], esi
pop esi
add esp, 0x31c
ret

Function at 0x4b0570
Capabilities:
Check os version

Disassembly:
sub esp, 0x114
lea eax, [esp]
mov dword [esp], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ecx, dword [esp + 0x10]
mov eax, 2
cmp ecx, eax
jne 0x4b05af
cmp dword [esp + 4], 5
jne 0x4b05af
cmp dword [esp + 8], eax
jne 0x4b05af
mov eax, 1
add esp, 0x114
ret
xor eax, eax
add esp, 0x114
ret

Function at 0x4b05c0
Capabilities:
Check os version

Disassembly:
sub esp, 0x114
lea eax, [esp]
mov dword [esp], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x10], 2
jne 0x4b05fb
cmp dword [esp + 4], 6
jne 0x4b05fb
mov eax, dword [esp + 8]
test eax, eax
jne 0x4b05fb
mov eax, 1
add esp, 0x114
ret
xor eax, eax
add esp, 0x114
ret

Function at 0x4b0630
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push edi
push 0xd
xor edi, edi
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x4b069d
push edi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4b069d
push esi
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x4b0692
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x4b0692
mov edi, dword [esp + 0x10]
push ebx
mov ebx, dword [esp + 0x10]
push eax
push 0x4eb504
push edi
push ebx
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
mov word [ebx + edi*2 - 2], 0
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
pop ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, edi
pop esi
pop edi
ret
mov eax, edi
pop edi
ret
Function at 0x4b06b0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
xor esi, esi
push ebp
mov dword [esp + 0x10], esi
call dword [sym.imp.MSVCRT.dll_wcslen]
mov edi, eax
add esp, 4
test edi, edi
jle 0x4b0759
push esi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4b0759
push ebx
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea esi, [edi + edi + 2]
push esi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x4b0749
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x4b0742
mov ecx, esi
mov edi, eax
mov eax, ecx
mov esi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x4b0742
mov dword [esp + 0x10], 1
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [esp + 0x10]
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [esp + 0x10]
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret
mov eax, esi
pop edi
pop esi
pop ebp
pop ecx
ret

Function at 0x4b0bf0
Capabilities:
Delete file
Move file

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
test eax, eax
jne 0x4b0c24
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, 1
jne 0x4b0c0d
xor eax, eax
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x4b0c24
cmp eax, 0x20
je 0x4b0c24
mov eax, 1
pop esi
ret
mov eax, dword [0x6dbf1c]
test eax, eax
je 0x4b0c41
push 0
push esi
call fcn.004b0c60
add esp, 8
neg eax
sbb eax, eax
pop esi
neg eax
inc eax
ret
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov eax, 2
pop esi
ret

Function at 0x4b0e60
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
lea eax, [esp]
push 0x207
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x4b0ee9
cmp eax, 0x207
ja 0x4b0ee9
lea ecx, [esp]
push ecx
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
cmp word [esp + eax*2 - 2], 0x5c
je 0x4b0eaa
lea edx, [esp]
push 0x4ee640
push edx
call dword [sym.imp.MSVCRT.dll_wcscat]
add esp, 8
push esi
mov esi, dword [esp + 0x214]
push edi
mov edi, dword [esp + 0x214]
lea eax, [esp + 8]
push str.wininit.ini
push eax
push 0x4ec998
push esi
push edi
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x14
mov word [edi + esi*2 - 2], 0
mov eax, 1
pop edi
pop esi
add esp, 0x208
ret
xor eax, eax
add esp, 0x208
ret