joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49a4d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6bc6e8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x7f3784]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
test esi, esi
jne 0x49a521
push esi
push esi
push esi
push 2
call fcn.0049dda0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.00499770
push 2
push 0
push esi
mov dword [edi + 8], 0xffffffff
mov dword [edi + 4], 0xffffffff
call fcn.0065b2eb
push esi
call fcn.0065b992
push 0
push 0
push esi
mov ebx, eax
call fcn.0065b2eb
add esp, 0x1c
test ebx, ebx
jg 0x49a57c
push 0
push 0
push 0
push 0xd
mov ecx, edi
call fcn.0049dda0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [ebp - 0x14], 0x7f9e50
push ebx
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
call fcn.00498c50
lea eax, [ebx + 1]
push eax
call fcn.0063bac9
push esi
push 1
push ebx
push eax
mov dword [ebp - 0x18], eax
mov byte [eax], 0
call fcn.0065aed9
add esp, 0x14
cmp eax, 1
je 0x49a5d5
push dword [ebp - 0x18]
call fcn.0063bad2
add esp, 4
mov ecx, edi
push 0
push 0
push 0
push 2
call fcn.0049dda0
xor bl, bl
jmp 0x49a67f
mov eax, dword [ebp - 0x18]
mov ecx, eax
mov esi, eax
mov byte [eax + ebx], 0
mov al, byte [eax]
test al, al
je 0x49a63d
cmp al, 0xa
jne 0x49a5fe
mov eax, esi
sub eax, ecx
inc eax
push eax
push ecx
lea ecx, [ebp - 0x14]
call fcn.00498b20
inc esi
mov ecx, esi
jmp 0x49a637
cmp al, 0xd
jne 0x49a636
mov eax, esi
sub eax, ecx
test eax, eax
jle 0x49a614
push eax
push ecx
lea ecx, [ebp - 0x14]
call fcn.00498b20
push 1
lea eax, [ebp - 0x10]
mov byte [ebp - 0x10], 0xa
push eax
lea ecx, [ebp - 0x14]
call fcn.00498b20
xor eax, eax
cmp byte [esi + 1], 0xa
sete al
inc eax
add esi, eax
mov ecx, esi
jmp 0x49a637
inc esi
mov al, byte [esi]
test al, al
jne 0x49a5e6
sub esi, ecx
je 0x49a64b
push esi
push ecx
lea ecx, [ebp - 0x14]
call fcn.00498b20
push dword [ebp - 0x18]
call fcn.0063bad2
mov esi, dword [edi]
add esp, 4
mov eax, dword [ebp - 0x14]
add eax, 8
push dword [ebp + 0xc]
mov esi, dword [esi + 0xc]
mov ecx, esi
push 0
push eax
call dword [0x70d5a4]
mov ecx, edi
call esi
cmp byte [edi + 0x2c], 0
je 0x49a67d
xor bl, bl
jmp 0x49a67f
mov bl, 1
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x7f9e50
je 0x49a693
push ecx
call fcn.0063bad2
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4a1150
Capabilities:
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6bd046
mov eax, dword fs:[0]
push eax
mov eax, 0x10040
call fcn.0063c0c0
mov eax, dword [0x7f3784]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor esi, esi
mov ebx, dword [ebp + 0xc]
nop word [eax + eax]
push 0
lea eax, [ebp - 0x10048]
mov dword [ebp - 0x10048], 0
push eax
push 0
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x4a12ae
cmp dword [ebp - 0x10048], 0
jne 0x4a11df
push 0x64
inc esi
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, 0x96
jl 0x4a1190
cmp dword [ebp - 0x10048], 0
je 0x4a12ae
push 0
lea eax, [ebp - 0x1004c]
mov dword [ebp - 0x1004c], 0
push eax
push 0x10000
lea eax, [ebp - 0x10010]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4a12ae
mov eax, dword [ebp - 0x1004c]
and eax, 0xfffffffe
cmp eax, 0x10000
jae 0x4a12cc
xor ecx, ecx
mov word [ebp + eax - 0x10010], cx
lea eax, [ebp - 0x10010]
push eax
lea ecx, [ebp - 0x10028]
call fcn.0049ece0
cmp dword [ebp - 0x10014], 8
lea ecx, [ebp - 0x10028]
mov eax, dword [ebp - 0x10018]
lea edx, [ebp - 0x10028]
cmovae ecx, dword [ebp - 0x10028]
cmovae edx, dword [ebp - 0x10028]
mov dword [ebp - 4], 0
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x10041]
push ecx
push eax
push edx
lea ecx, [ebp - 0x10040]
call fcn.0049e150
lea eax, [ebp - 0x10040]
mov byte [ebp - 4], 1
push eax
mov ecx, ebx
call fcn.0049ef50
lea ecx, [ebp - 0x10040]
call fcn.00489080
lea ecx, [ebp - 0x10028]
call fcn.00488f90
mov al, 1
jmp 0x4a12b0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0063bad7
mov esp, ebp
pop ebp
ret
call fcn.0063bfda
int3
Function at 0x4a12e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6bd078
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x7f3784]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
cmp dword [ebp + 0x20], 0x10
lea edx, [ebp + 0xc]
mov ebx, dword [ebp + 0x1c]
lea edi, [ebp + 0xc]
cmovae edx, dword [ebp + 0xc]
lea ecx, [ebp - 0x28]
add ebx, edx
mov dword [ebp - 4], 0
cmp dword [ebp + 0x20], 0x10
mov dword [ebp - 0x18], 0
cmovae edi, dword [ebp + 0xc]
xor eax, eax
mov word [ebp - 0x28], ax
mov eax, ebx
sub eax, edi
mov dword [ebp - 0x14], 7
push eax
call fcn.00491e40
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x28]
push ebx
push edi
call fcn.0049e180
cmp dword [ebp - 0x14], 8
lea edx, [ebp - 0x28]
mov dword [ebp - 0x30], 0
cmovae edx, dword [ebp - 0x28]
mov eax, edx
lea esi, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4a1380
sub eax, esi
lea ecx, [ebp - 0x30]
push 0
sar eax, 1
push ecx
add eax, eax
push eax
push edx
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4a13cd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.IPC_Server_:_Failed_to_send_data.__d
push 0
push 2
push str.IPCXMLUtilityLog
push dword [0x7f9e68]
call fcn.005645a0
add esp, 0x18
xor bl, bl
jmp 0x4a13cf
mov bl, 1
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x4a1405
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4a13fb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a1467
push edx
push ecx
call fcn.0063bb18
add esp, 8
mov edx, dword [ebp + 0x20]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 0x10
jb 0x4a1449
mov ecx, dword [ebp + 0xc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4a143f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a1467
push edx
push ecx
call fcn.0063bb18
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0063bad7
mov esp, ebp
pop ebp
ret
call fcn.0065a824
int3
Function at 0x4a2d10
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe58
mov eax, dword [0x7f3784]
xor eax, ebp
mov dword [ebp - 4], eax
push str.Thread_PerformSelfUpdate_...
push 0
push 4
push 0x718614
push dword [0x7f9e6c]
call fcn.005645a0
xorps xmm0, xmm0
mov dword [ebp - 0xe48], 0x44
push 0x200
lea eax, [ebp - 0x604]
movlpd qword [ebp - 0xe44], xmm0
push 0
push eax
movlpd qword [ebp - 0xe3c], xmm0
movlpd qword [ebp - 0xe34], xmm0
movlpd qword [ebp - 0xe2c], xmm0
movlpd qword [ebp - 0xe24], xmm0
movlpd qword [ebp - 0xe1c], xmm0
movlpd qword [ebp - 0xe14], xmm0
movlpd qword [ebp - 0xe0c], xmm0
movups xmmword [ebp - 0xe58], xmm0
call fcn.00651620
push 0x200
lea eax, [ebp - 0x204]
push 0
push eax
call fcn.00651620
push 0x200
lea eax, [ebp - 0x404]
push 0
push eax
call fcn.00651620
lea eax, [ebp - 0x604]
push 1
push eax
call fcn.004cfcc0
add esp, 0x40
lea eax, [ebp - 0x604]
push str.AdobeGCClient_agshelper.exe
push 0x104
push eax
call fcn.004cfa40
lea eax, [ebp - 0x404]
push 1
push eax
call fcn.004cfcc0
push str.AdobeGCClient
lea eax, [ebp - 0x404]
push 0x104
push eax
call fcn.004cfa40
push 1
push 0x717614
lea eax, [ebp - 0x204]
push 0x104
push eax
call fcn.004cfb80
lea eax, [ebp - 0x604]
push eax
lea eax, [ebp - 0x204]
push 0x104
push eax
call fcn.004cfa40
push 0x717614
lea eax, [ebp - 0x204]
push 0x104
push eax
call fcn.004cfa40
add esp, 0x48
lea eax, [ebp - 0x204]
push 0x7175e4
push 0x104
push eax
call fcn.004cfa40
push 0x717614
lea eax, [ebp - 0x204]
push 0x104
push eax
call fcn.004cfa40
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x204]
push 0x104
push eax
call fcn.004cfa40
push str._temp
lea eax, [ebp - 0x204]
push 0x104
push eax
call fcn.004cfa40
push 0x717614
lea eax, [ebp - 0x204]
push 0x104
push eax
call fcn.004cfa40
push 0x400
lea eax, [ebp - 0xe04]
push 0
push eax
call fcn.00651620
add esp, 0x48
lea eax, [ebp - 0xa04]
push 0x400
push 0
push eax
call fcn.00651620
lea ecx, [ebp - 0x204]
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a2f02
sub ecx, edx
lea eax, [ebp - 0x204]
push ecx
push eax
lea eax, [ebp - 0xe04]
push eax
call fcn.006656a6
lea eax, [ebp - 0x404]
add esp, 0xc
lea edx, [eax + 1]
nop dword [eax + eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4a2f30
sub eax, edx
push eax
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0xa04]
push eax
call fcn.006656a6
add esp, 0xc
lea eax, [ebp - 0xe58]
push eax
lea eax, [ebp - 0xe48]
push eax
lea eax, [ebp - 0xa04]
push eax
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xe04]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4a2f97
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x204]
push eax
push str.Launch_Failed__s_d
jmp 0x4a2faa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x204]
push eax
push str.Launched__s_d
push 0
push 4
push 0x718614
push dword [0x7f9e6c]
call fcn.005645a0
mov ecx, dword [ebp - 4]
add esp, 0x1c
xor ecx, ebp
call fcn.0063bad7
mov esp, ebp
pop ebp
ret
Function at 0x4a9580
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6bfb76
mov eax, dword fs:[0]
push eax
sub esp, 0x25c
mov eax, dword [0x7f3784]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24c], ecx
lea ecx, [ebp - 0x218]
push 0x104
push ecx
push eax
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x4a97e7
xor eax, eax
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.004c7e40
add esp, 8
test al, al
je 0x4a97ab
cmp dword [ebp - 0x21c], 8
lea edx, [ebp - 0x230]
mov eax, dword [ebp - 0x220]
lea edi, [ebp - 0x230]
cmovae edx, dword [ebp - 0x230]
lea ecx, [ebp - 0x248]
cmovae edi, dword [ebp - 0x230]
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0xf
lea eax, [edx + eax*2]
mov byte [ebp - 0x248], 0
mov dword [ebp - 0x250], eax
sub eax, edi
sar eax, 1
push eax
call fcn.004ac230
push dword [ebp - 0x24c]
lea ecx, [ebp - 0x248]
push dword [ebp - 0x250]
push edi
call fcn.0049e300
mov ecx, dword [ebp - 0x24c]
mov edx, dword [ebp - 0x234]
mov byte [ebp - 4], 1
cmp dword [ecx + 0x14], edx
jae 0x4a975a
movups xmm0, xmmword [ebp - 0x248]
movq xmm1, qword [ecx + 0x10]
movups xmm2, xmmword [ecx]
movups xmmword [ecx], xmm0
movq xmm0, qword [ebp - 0x238]
movq qword [ebp - 0x258], xmm1
mov edx, dword [ebp - 0x254]
movq qword [ecx + 0x10], xmm0
movq qword [ebp - 0x238], xmm1
movups xmmword [ebp - 0x268], xmm2
movups xmmword [ebp - 0x248], xmm2
cmp edx, 0x10
jb 0x4a9713
mov ecx, dword [ebp - 0x268]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4a9709
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a9803
push edx
push ecx
call fcn.0063bb18
add esp, 8
mov edx, dword [ebp - 0x21c]
cmp edx, 8
jb 0x4a9753
mov ecx, dword [ebp - 0x230]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4a9749
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a9808
push edx
push ecx
call fcn.0063bb18
add esp, 8
mov al, 1
jmp 0x4a97e9
push dword [ebp - 0x238]
cmp edx, 0x10
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push eax
call fcn.0049f3b0
mov edx, dword [ebp - 0x234]
cmp edx, 0x10
jb 0x4a9713
mov ecx, dword [ebp - 0x248]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4a9709
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a9803
jmp 0x4a9709
mov edx, dword [ebp - 0x21c]
cmp edx, 8
jb 0x4a97e7
mov ecx, dword [ebp - 0x230]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4a97dd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a9808
push edx
push ecx
call fcn.0063bb18
add esp, 8
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0063bad7
mov esp, ebp
pop ebp
ret
call fcn.0065a824
call fcn.0065a824
int3
Function at 0x4abeb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6bfe18
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x7f3784]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push 8
mov dword [ebx + 0x30], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0x201
mov dword [ebx + 0x18], 6
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0xc], 0
call fcn.0063bae8
mov esi, eax
add esp, 4
test esi, esi
je 0x4abf4d
push 1
mov dword [ebp - 4], 0
call fcn.0063d9a4
add esp, 4
mov dword [esi + 4], eax
jmp 0x4abf4f
xor esi, esi
mov eax, dword [ebp + 8]
mov dword [ebx + 0x30], esi
mov dword [ebx + 0x38], eax
mov dword [ebx + 0x3c], 0
mov edi, dword [esi + 4]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x70d5a4]
mov ecx, edi
call esi
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 1
push eax
call fcn.004a8060
mov edi, eax
add esp, 4
mov ecx, dword [edi]
push 0x20
mov esi, dword [ecx + 0x20]
mov ecx, esi
call dword [0x70d5a4]
mov ecx, edi
call esi
mov edi, dword [ebp - 0x14]
mov byte [ebp - 0xd], al
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x4abfde
mov edx, dword [edi]
mov esi, dword [edx + 8]
mov ecx, esi
call dword [0x70d5a4]
mov ecx, edi
call esi
mov edi, eax
test edi, edi
je 0x4abfdb
mov ecx, dword [edi]
push 1
mov esi, dword [ecx]
mov ecx, esi
call dword [0x70d5a4]
mov ecx, edi
call esi
mov al, byte [ebp - 0xd]
cmp dword [ebx + 0x38], 0
mov byte [ebx + 0x40], al
jne 0x4abffa
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx + 0x10]
and eax, 0x13
or eax, 4
mov dword [ebx + 0xc], eax
and ecx, eax
jne 0x4ac01d
cmp byte [ebp + 0xc], 0
je 0x4ac009
push ebx
call fcn.0063df20
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x4ac029
mov esi, 0x71a400
jmp 0x4ac039
test cl, 2
mov esi, 0x71a418
mov eax, 0x71a430
cmove esi, eax
lea eax, [ebp - 0x1c]
push 1
push eax
call fcn.0048a9a0
add esp, 8
lea ecx, [ebp - 0x30]
push eax
push esi
call fcn.0048ae70
push 0x7a9cd4
lea eax, [ebp - 0x30]
push eax
call fcn.006511fe
int3
Function at 0x4b3960
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x7f3784]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x4b3a38
cmp byte [ebx + 0x3d], 0
je 0x4b3a38
mov eax, dword [ebx]
push esi
push 0xffffffffffffffff
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x70d5a4]
mov ecx, ebx
call esi
cmp eax, 0xffffffff
je 0x4b3a26
push edi
mov edi, dword [ebx + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov esi, dword [edi]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebx + 0x40]
push eax
mov esi, dword [esi + 0x20]
mov ecx, esi
call dword [0x70d5a4]
mov ecx, edi
call esi
pop edi
sub eax, 0
je 0x4b39ee
sub eax, 1
je 0x4b39f2
sub eax, 2
jne 0x4b3a26
mov byte [ebx + 0x3d], al
mov al, 1
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0063bad7
mov esp, ebp
pop ebp
ret
mov byte [ebx + 0x3d], 0
mov esi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub esi, eax
je 0x4b3a0f
push dword [ebx + 0x4c]
push esi
push 1
push eax
call fcn.006663c0
add esp, 0x10
cmp esi, eax
jne 0x4b3a26
cmp byte [ebx + 0x3d], 0
pop esi
sete al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0063bad7
mov esp, ebp
pop ebp
ret
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0063bad7
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop ebx
call fcn.0063bad7
mov esp, ebp
pop ebp
ret
Function at 0x4b42a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x7f3784]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, ecx
cmp ebx, 0xffffffff
jne 0x4b42d0
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0063bad7
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi + 0x20]
push esi
mov ecx, dword [eax]
test ecx, ecx
je 0x4b430c
mov edx, dword [edi + 0x30]
mov esi, dword [edx]
lea eax, [esi + ecx]
cmp ecx, eax
jae 0x4b430c
lea ecx, [esi - 1]
mov dword [edx], ecx
mov edx, dword [edi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop edi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0063bad7
mov esp, ebp
pop ebp
ret 4
cmp dword [edi + 0x4c], 0
je 0x4b4401
mov esi, dword [edi + 0xc]
lea eax, [edi + 0x3c]
cmp dword [esi], eax
jne 0x4b4334
mov edx, dword [edi + 0x54]
mov ecx, dword [edi + 0x50]
sub edx, ecx
mov dword [esi], ecx
mov eax, dword [edi + 0x1c]
mov dword [eax], ecx
mov eax, dword [edi + 0x2c]
mov dword [eax], edx
mov eax, dword [edi + 0x38]
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x4b436a
push dword [edi + 0x4c]
movsx eax, bl
push eax
call fcn.0065abe9
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop esi
pop edi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0063bad7
mov esp, ebp
pop ebp
ret 4
mov byte [ebp - 0x28], bl
mov esi, dword [eax]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 4]
push eax
mov esi, dword [esi + 0x1c]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
mov ecx, esi
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [edi + 0x40]
push eax
call dword [0x70d5a4]
mov ecx, dword [ebp - 0x2c]
call esi
test eax, eax
js 0x4b4401
cmp eax, 1
jle 0x4b43d4
cmp eax, 3
jne 0x4b4401
push dword [edi + 0x4c]
push dword [ebp - 0x28]
call fcn.004aed80
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop esi
pop edi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0063bad7
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ebp - 0x30]
lea eax, [ebp - 0x24]
sub esi, eax
je 0x4b43f1
push dword [edi + 0x4c]
push esi
push 1
push eax
call fcn.006663c0
add esp, 0x10
cmp esi, eax
jne 0x4b4401
lea eax, [ebp - 0x28]
mov byte [edi + 0x3d], 1
cmp dword [ebp - 0x34], eax
jne 0x4b42f7
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop esi
pop edi
xor ecx, ebp
pop ebx
call fcn.0063bad7
mov esp, ebp
pop ebp
ret 4
Function at 0x4b4f30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
je 0x4b5011
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
test esi, esi
jl 0x4b5000
jg 0x4b4f68
test edx, edx
je 0x4b5000
call fcn.0048fdf0
mov esi, eax
mov eax, edx
mov dword [ebp - 0xc], eax
test eax, eax
jl 0x4b4fb6
jg 0x4b4f7e
test esi, esi
je 0x4b4fb6
cmp ebx, eax
jg 0x4b4f8d
jl 0x4b4f88
cmp edi, esi
jae 0x4b4f8d
mov esi, edi
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp - 8]
push esi
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20]
push dword [eax]
call fcn.00650660
mov ecx, dword [ebp - 4]
add esp, 0xc
sub edi, esi
sbb ebx, dword [ebp - 0xc]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x4b4fe5
mov eax, dword [ebp - 8]
movzx ecx, byte [eax]
mov eax, dword [ebp - 4]
push ecx
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x70d5a4]
mov ecx, dword [ebp - 4]
call esi
cmp eax, 0xffffffff
je 0x4b4ffa
mov ecx, dword [ebp - 4]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [ebp - 8], esi
test ebx, ebx
jg 0x4b4f68
jl 0x4b4ffa
test edi, edi
jne 0x4b4f68
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
pop edi
sbb esi, ebx
mov eax, edx
mov edx, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x10], esi
mov eax, dword [eax]
mov dword [ebp - 0x14], edi
mov dword [ebp - 8], eax
test eax, eax
je 0x4b5030
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x4b5032
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [ebp - 0xc], eax
test edi, edi
jl 0x4b50ab
jg 0x4b5044
test esi, esi
je 0x4b50ab
test eax, eax
jl 0x4b5085
jg 0x4b504e
test ebx, ebx
je 0x4b5085
cmp edi, eax
jg 0x4b505d
jl 0x4b5058
cmp esi, ebx
jae 0x4b505d
mov ebx, esi
mov dword [ebp - 0xc], edi
push ebx
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.00650660
mov ecx, dword [ebp - 4]
add esp, 0xc
mov edx, dword [ebp + 8]
add edx, ebx
sub esi, ebx
mov eax, dword [ecx + 0x30]
sbb edi, dword [ebp - 0xc]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
jmp 0x4b5088
mov edx, dword [ebp + 8]
test edi, edi
jl 0x4b50ab
jg 0x4b5092
test esi, esi
je 0x4b50ab
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x4b50ab
push eax
push esi
push 1
push edx
call fcn.006663c0
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4bfaa0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x102
push 0
push 0x71be38
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4bfad4
cmp eax, 2
sete al
mov esp, ebp
pop ebp
ret
push esi
push str.newInstall
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
sete al
mov esp, ebp
pop ebp
ret