joyce8/EMBER2024-capa huggingface dataset:
Function at 0x482be0
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push 0x2c
mov eax, 0x49ecde
call fcn.0049cb8b
xor esi, esi
cmp dword [ebp + 8], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], esi
je 0x482d68
cmp dword [ebp + 0xc], esi
je 0x482d68
push esi
push dword [ebp + 0xc]
call dword [sym.imp.MSVCR80.dll__waccess]
test eax, eax
pop ecx
pop ecx
jne 0x482d63
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
push esi
push 0x80
push 3
push esi
push 1
push SysReAllocStringLen
push dword [ebp + 0xc]
call ebx
cmp eax, 0xffffffff
mov dword [ebp - 0x18], eax
je 0x482d3b
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
je 0x482d3b
push edi
call dword [sym.imp.MSVCR80.dll_malloc]
cmp eax, esi
pop ecx
mov dword [ebp - 0x24], eax
je 0x482d3b
push esi
lea ecx, [ebp - 0x28]
push ecx
push edi
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0x28], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x20], 0x100000
mov dword [ebp - 4], esi
cmp dword [ebp - 0x14], esi
je 0x482c96
push dword [ebp - 0x14]
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
mov eax, dword [ebp - 0x20]
push eax
mov dword [ebp - 0x2c], eax
call dword [sym.imp.MSVCR80.dll_malloc]
mov edx, eax
mov eax, dword [ebp - 0x24]
pop ecx
mov ecx, dword [ebp - 0x28]
lea edi, [ebp - 0x2c]
mov dword [ebp - 0x14], edx
call fcn.00492a10
cmp eax, esi
jne 0x482cfa
push esi
push 0x80
push 2
push esi
xor edi, edi
inc edi
push edi
push 0x40000000
push dword [ebp + 8]
mov dword [ebp - 0x30], esi
call ebx
cmp eax, 0xffffffff
mov dword [ebp - 0x1c], eax
je 0x482d1d
mov ebx, dword [ebp - 0x2c]
push esi
lea ecx, [ebp - 0x30]
push ecx
push ebx
push dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 0x30], ebx
jne 0x482d1d
mov dword [ebp - 0x34], edi
jmp 0x482d1d
mov ecx, dword [ebp - 0x20]
cmp ecx, 0x3200000
ja 0x482d1d
cmp eax, 0xfffffffb
jne 0x482d1d
lea eax, [ecx + ecx]
mov dword [ebp - 0x20], eax
jmp 0x482c87
cmp dword [ebp - 0x24], esi
je 0x482d2c
push dword [ebp - 0x24]
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
cmp dword [ebp - 0x14], esi
je 0x482d3b
push dword [ebp - 0x14]
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
cmp dword [ebp - 0x18], esi
je 0x482d4f
cmp dword [ebp - 0x18], 0xffffffff
je 0x482d4f
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x1c], esi
je 0x482d63
cmp dword [ebp - 0x1c], 0xffffffff
je 0x482d63
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x34]
jmp 0x482d6a
xor eax, eax
call fcn.0049cc30
ret

Function at 0x482db5
Capabilities:
Hash data with md5

Disassembly:
push esi
xor ecx, ecx
push 0x40
lea esi, [eax + 0x58]
push ecx
push esi
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
call sub.MSVCR80.dll_memset
add esp, 0xc
mov byte [esi], 0x80
pop esi
ret
Function at 0x48361f
Capabilities:
Read file on windows

Disassembly:
push esi
xor esi, esi
cmp dword [edi + 0x58], esi
jne 0x48364e
push 0x98
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, esi
pop ecx
je 0x48363e
push eax
call fcn.00482da5
jmp 0x483640
xor eax, eax
cmp eax, esi
mov dword [edi + 0x58], eax
jne 0x48364e
xor eax, eax
jmp 0x4836d1
push ebp
push 0x4be1e8
push dword [esp + 0x10]
call dword [sym.imp.MSVCR80.dll__wfopen]
mov ebp, eax
cmp ebp, esi
pop ecx
pop ecx
mov dword [esp + 0xc], ebp
jne 0x48366e
xor eax, eax
jmp 0x4836d0
cmp dword [edi + 0x5c], esi
push ebx
mov ebx, 0xff
jne 0x483683
push ebx
call fcn.0049555c
pop ecx
mov dword [edi + 0x5c], eax
push ebp
mov ebp, dword [sym.imp.MSVCR80.dll_fread]
push ebx
push 1
push dword [edi + 0x5c]
call ebp
add esp, 0x10
cmp eax, esi
je 0x4836b7
push dword [edi + 0x5c]
mov esi, dword [edi + 0x58]
call fcn.00482ded
push dword [esp + 0x10]
push ebx
push 1
push dword [edi + 0x5c]
call ebp
add esp, 0x10
test eax, eax
jne 0x483699
push dword [esp + 0x10]
call dword [sym.imp.MSVCR80.dll_fclose]
pop ecx
mov ecx, dword [edi + 0x58]
lea ebx, [edi + 4]
call fcn.00482e84
mov eax, ebx
pop ebx
pop ebp
pop esi
ret 4
Function at 0x483778
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
xor ebx, ebx
cmp dword [esi], ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jne 0x483797
push str.wintrust.dll
call edi
cmp eax, ebx
mov dword [esi], eax
je 0x4838b5
cmp dword [esi + 4], ebx
jne 0x4837ae
push str.Crypt32.dll
call edi
cmp eax, ebx
mov dword [esi + 4], eax
je 0x4838b5
cmp dword [esi + 8], ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
jne 0x4837cd
push str.CryptCATAdminAcquireContext
push dword [esi]
call edi
cmp eax, ebx
mov dword [esi + 8], eax
je 0x4838b5
cmp dword [esi + 0xc], ebx
jne 0x4837e6
push str.CryptCATAdminReleaseContext
push dword [esi]
call edi
cmp eax, ebx
mov dword [esi + 0xc], eax
je 0x4838b5
cmp dword [esi + 0x14], ebx
jne 0x4837ff
push str.CryptCATCatalogInfoFromContext
push dword [esi]
call edi
cmp eax, ebx
mov dword [esi + 0x14], eax
je 0x4838b5
cmp dword [esi + 0x10], ebx
jne 0x483818
push str.CryptCATAdminReleaseCatalogContext
push dword [esi]
call edi
cmp eax, ebx
mov dword [esi + 0x10], eax
je 0x4838b5
cmp dword [esi + 0x18], ebx
jne 0x483831
push str.CryptCATAdminCalcHashFromFileHandle
push dword [esi]
call edi
cmp eax, ebx
mov dword [esi + 0x18], eax
je 0x4838b5
cmp dword [esi + 0x1c], ebx
jne 0x483846
push str.CryptCATAdminEnumCatalogFromHash
push dword [esi]
call edi
cmp eax, ebx
mov dword [esi + 0x1c], eax
je 0x4838b5
cmp dword [esi + 0x20], ebx
jne 0x48385b
push str.WinVerifyTrustEx
push dword [esi]
call edi
cmp eax, ebx
mov dword [esi + 0x20], eax
je 0x4838b5
cmp dword [esi + 0x24], ebx
jne 0x483870
push str.WTHelperProvDataFromStateData
push dword [esi]
call edi
cmp eax, ebx
mov dword [esi + 0x24], eax
je 0x4838b5
cmp dword [esi + 0x28], ebx
jne 0x483885
push str.WTHelperGetProvSignerFromChain
push dword [esi]
call edi
cmp eax, ebx
mov dword [esi + 0x28], eax
je 0x4838b5
cmp dword [esi + 0x2c], ebx
jne 0x48389a
push str.WTHelperGetProvCertFromChain
push dword [esi]
call edi
cmp eax, ebx
mov dword [esi + 0x2c], eax
je 0x4838b5
cmp dword [esi + 0x30], ebx
jne 0x4838b0
push str.CertNameToStrW
push dword [esi + 4]
call edi
cmp eax, ebx
mov dword [esi + 0x30], eax
je 0x4838b5
xor ebx, ebx
inc ebx
jmp 0x4838f4
mov eax, dword [esi]
cmp eax, ebx
mov edi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
je 0x4838e7
push eax
call edi
mov dword [esi], ebx
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x4838f4
push eax
call edi
mov dword [esi + 4], ebx
pop edi
mov eax, ebx
pop ebx
ret
Function at 0x484bb2
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a431d
mov eax, dword fs:[0]
push eax
sub esp, 0x300
mov eax, dword [0x4db020]
xor eax, esp
mov dword [esp + 0x2f8], eax
push ebx
push esi
push edi
mov eax, dword [0x4db020]
xor eax, esp
push eax
lea eax, [esp + 0x310]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor esi, esi
push 0xd2
mov dword [esp + 0x14], eax
lea eax, [esp + 0x22]
push esi
push eax
mov word [esp + 0x28], si
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [esp + 0x1c]
push eax
push 0x69
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
cmp eax, esi
jne 0x484c2b
xor eax, eax
jmp 0x484d13
cdq
and edx, 3
add eax, edx
mov edi, eax
push 0x208
lea eax, [esp + 0xfa]
push esi
push eax
sar edi, 2
mov word [esp + 0x100], si
call sub.MSVCR80.dll_memset
mov word [esp + 0x308], si
mov esi, dword [esp + 0x1c]
add esp, 0xc
add esi, 4
lea ebx, [esp + 0x1c]
call fcn.0041d34a
test edi, edi
jle 0x484d10
mov dword [esp + 0x10], edi
and word [ebx + 4], 0
push 0x104
lea eax, [esp + 0xf8]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x484d03
lea eax, [esp + 0xf4]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.00401506
and dword [esp + 0x318], 0
lea eax, [esp + 0x14]
push eax
mov edi, esi
call fcn.0041d2ee
or dword [esp + 0x318], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
call fcn.00401291
push ebx
lea eax, [esp + 0x1c]
push eax
call fcn.00401506
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x31c], 1
call fcn.0041d2ee
or dword [esp + 0x318], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
call fcn.00401291
add ebx, 8
dec dword [esp + 0x10]
jne 0x484c78
xor eax, eax
inc eax
mov ecx, dword [esp + 0x310]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2f8]
xor ecx, esp
call fcn.00495616
mov esp, ebp
pop ebp
ret 4

Function at 0x484d5f
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
xor ebx, ebx
cmp dword [esi + 0x14], ebx
jne 0x484de0
push 0x4be398
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
mov dword [esi + 0x18], eax
je 0x484de0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.EnumProcessModules
push eax
call edi
push str.EnumProcesses
push dword [esi + 0x18]
mov dword [esi + 8], eax
call edi
push str.GetModuleBaseNameW
push dword [esi + 0x18]
mov dword [esi], eax
call edi
push str.GetModuleFileNameExW
push dword [esi + 0x18]
mov dword [esi + 4], eax
call edi
push str.GetProcessImageFileNameW
push dword [esi + 0x18]
mov dword [esi + 0xc], eax
call edi
cmp dword [esi], ebx
mov dword [esi + 0x10], eax
pop edi
je 0x484ddb
cmp dword [esi + 4], ebx
je 0x484ddb
cmp dword [esi + 8], ebx
je 0x484ddb
cmp dword [esi + 0xc], ebx
je 0x484ddb
cmp eax, ebx
je 0x484ddb
xor eax, eax
inc eax
jmp 0x484ddd
xor eax, eax
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0x14]
pop ebx
ret
Function at 0x48525c
Capabilities:
Acquire debug privileges

Disassembly:
push 0x28
push 0x4c8c18
call fcn.00495bc0
xor esi, esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x28], esi
xor eax, eax
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
mov dword [ebp - 0x38], esi
lea edi, [ebp - 0x34]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 4], esi
lea eax, [ebp - 0x1c]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp eax, esi
je 0x4852e1
lea eax, [ebp - 0x28]
push eax
push 0x4b9e0c
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
cmp eax, esi
je 0x4852e1
xor edi, edi
inc edi
mov dword [ebp - 0x38], edi
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 2
push esi
push esi
push esi
lea eax, [ebp - 0x38]
push eax
push esi
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
cmp eax, esi
je 0x4852e1
mov dword [ebp - 0x20], edi
mov dword [ebp - 4], 0xfffffffe
call fcn.004852f8
mov eax, dword [ebp - 0x20]
call fcn.00495c05
ret
Function at 0x48530a
Capabilities:
Query environment variable

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x4db020]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x1c
mov eax, 0x4a0cb4
call fcn.0049cb58
xor esi, esi
push 0x206
lea eax, [ebp + 2]
push esi
push eax
mov edi, ecx
mov dword [ebp - 0x1c], esi
mov word [ebp], si
call sub.MSVCR80.dll_memset
xor ecx, ecx
add esp, 0xc
inc ecx
lea edx, [ebp - 0x14]
mov eax, edi
call fcn.00414d80
push 0x4ab2c0
push eax
mov dword [ebp - 4], esi
call fcn.0040cc33
mov ebx, eax
neg ebx
sbb bl, bl
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
inc bl
call fcn.00401291
test bl, bl
je 0x4854e4
mov ebx, dword [sym.imp.MSVCR80.dll_wcslen]
mov esi, 0x4be3e4
push esi
call ebx
mov dword [ebp - 0x18], eax
mov dword [esp], str.SystemRoot_
call ebx
pop ecx
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x10]
mov eax, edi
call fcn.00414d80
push esi
push eax
mov dword [ebp - 4], 1
call fcn.0040cc33
mov ebx, eax
neg ebx
sbb bl, bl
or esi, 0xffffffff
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
inc bl
call fcn.00401291
test bl, bl
je 0x485405
mov eax, dword [edi]
mov ecx, dword [eax - 0xc]
sub ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x10]
push eax
mov eax, edi
call fcn.0040912f
mov dword [ebp - 4], 2
call fcn.00408098
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0x10]
jmp 0x4854b3
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
mov eax, edi
call fcn.00414d80
push str.SystemRoot_
push eax
mov dword [ebp - 4], 3
call fcn.0040cc33
mov ebx, eax
neg ebx
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0x10]
sbb bl, bl
add eax, 0xfffffff0
inc bl
call fcn.00401291
test bl, bl
je 0x4854bb
push 0x104
lea eax, [ebp]
push eax
push str._SystemRoot_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov eax, dword [edi]
mov ecx, dword [eax - 0xc]
sub ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x24]
push eax
inc ecx
mov eax, edi
call fcn.0040912f
mov ebx, eax
lea eax, [ebp]
push eax
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 4], 4
call fcn.00401506
lea ecx, [ebp - 0x20]
push ebx
push ecx
mov ecx, eax
mov byte [ebp - 4], 5
call fcn.00407f2b
pop ecx
pop ecx
mov byte [ebp - 4], 6
call fcn.00408098
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
call fcn.00401291
mov eax, dword [ebp - 0x28]
add eax, 0xfffffff0
call fcn.00401291
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff0
call fcn.00401291
mov eax, dword [edi]
mov ecx, dword [eax - 0xc]
cmp ecx, 3
jg 0x4854ce
mov esi, edi
call fcn.00401341
jmp 0x4854eb
cmp ecx, 1
jge 0x4854dd
push 0x80070057
call fcn.004016fb
cmp word [eax + 2], 0x3a
jne 0x4854c5
mov dword [ebp - 0x1c], 1
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.00495616
add ebp, 0x20c
leave
ret
Function at 0x485e5f
Capabilities:
Check mutex on windows
Read file via mapping

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
xor edi, edi
cmp dword [esp + 0x24], edi
push 2
pop esi
je 0x485fa1
push 4
pop esi
push str.Global4AD5C1B1_C922_46dc_87EB_EEEEA805350C
push edi
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
cmp eax, edi
mov dword [esp + 0x18], eax
je 0x485fa1
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 5
pop esi
push 0x1388
push eax
call ebp
cmp eax, 0x102
je 0x485f8d
push 4
pop esi
push str.Global9911015F_D698_48d7_BB1B_040EA452E003
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenEventW]
mov ebx, 0x1f0003
push ebx
call edi
test eax, eax
mov dword [esp + 0x14], eax
je 0x485f8d
push str.Global689DC529_FC99_42cc_9ADD_E879C5B7B9DE
push 0
push ebx
call edi
mov ebx, eax
test ebx, ebx
je 0x485f83
push str.Global25290102_9898_4d43_8199_61F3DF41832E
push 0
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
test eax, eax
mov dword [esp + 0x1c], eax
je 0x485f7c
mov edi, 0x1000
push edi
push 0
push 0
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esp + 0x10], eax
je 0x485f72
push 3
pop esi
push dword [esp + 0x24]
mov ecx, eax
call fcn.00485d05
cmp eax, edi
ja 0x485f68
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 5
pop esi
push 0x1388
push ebx
call ebp
cmp eax, 0x102
je 0x485f68
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x24]
xor esi, esi
inc esi
call fcn.00485c3f
test eax, eax
jne 0x485f68
push ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
xor esi, esi
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4

Function at 0x4868c6
Capabilities:
Hash data with md5

Disassembly:
xor ecx, ecx
mov byte [eax + 0x68], cl
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x487a1c
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov ebx, eax
xor esi, esi
cmp ebx, esi
push edi
mov edi, ecx
jne 0x487a3c
push esi
push esi
push 2
xor ecx, ecx
pop eax
call fcn.0048923f
xor al, al
jmp 0x487ac4
push ebp
call fcn.00487330
mov ebp, dword [sym.imp.MSVCR80.dll_fseek]
or dword [edi + 8], 0xffffffff
or dword [edi + 4], 0xffffffff
push 2
push esi
push ebx
call ebp
push ebx
call dword [sym.imp.MSVCR80.dll_ftell]
push 0
push 0
push ebx
mov esi, eax
call ebp
add esp, 0x1c
test esi, esi
jne 0x487a73
push esi
push esi
push 0xd
jmp 0x487aa2
lea eax, [esi + 1]
push eax
call fcn.0049555c
push ebx
push 1
mov ebp, eax
push esi
push ebp
mov byte [ebp], 0
call dword [sym.imp.MSVCR80.dll_fread]
add esp, 0x14
cmp eax, 1
je 0x487aae
push ebp
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
pop ecx
push 0
push 0
push 2
xor ecx, ecx
pop eax
call fcn.0048923f
xor al, al
jmp 0x487ac3
push edi
mov edi, esi
mov ecx, ebp
call fcn.00487ac8
push ebp
mov bl, al
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
pop ecx
mov al, bl
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x48a781
Capabilities:
Print debug messages

Disassembly:
push 0xc
mov eax, 0x49eb9d
call fcn.0049cb58
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
add eax, 0x54
push eax
lea edi, [ebp - 0x10]
call fcn.0048ce90
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x48a852
lea edx, [ebp - 0x14]
push edx
push 0x4aadcc
mov dword [ebp - 0x14], ebx
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
jl 0x48a84f
mov eax, dword [ebp - 0x14]
lea edx, [ebp + 8]
push edx
push 0x4aaddc
push 0x4aad1c
mov dword [ebp + 8], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x48a846
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x18]
push edx
mov dword [ebp - 0x18], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x48a83d
push 0x4bed70
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov esi, dword [sym.imp.USER32.dll_FindWindowExW]
push ebx
push str.Shell_DocObject_View
push ebx
push dword [ebp - 0x18]
call esi
cmp eax, ebx
je 0x48a83d
push ebx
push str.Internet_Explorer_Server
push ebx
push eax
call esi
cmp word [ebp + 0xc], bx
push ebx
jge 0x48a830
push 1
jmp 0x48a831
push ebx
push 0x115
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
cmp eax, ebx
je 0x48a860
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
call fcn.0049cc30
ret 8
Function at 0x48b867
Capabilities:
Read .ini file

Disassembly:
push ebp
sub esp, 0x618
lea ebp, [esp - 4]
mov eax, dword [0x4db020]
xor eax, ebp
mov dword [ebp + 0x618], eax
push 0x10
mov eax, 0x4a0acf
call fcn.0049cb58
mov eax, dword [ebp + 0x624]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x628]
xor ebx, ebx
push 0x40e
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 2]
push ebx
push eax
mov dword [ebp - 0x14], 0x80004005
mov word [ebp], bx
call sub.MSVCR80.dll_memset
push 0x206
lea eax, [ebp + 0x412]
push ebx
push eax
mov word [ebp + 0x410], bx
call sub.MSVCR80.dll_memset
add esp, 0x18
mov edi, 0x104
push edi
lea eax, [ebp]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jbe 0x48b9e6
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.ressrc
lea eax, [ebp]
push eax
call esi
mov eax, dword [0x4dff94]
mov ecx, 0x4dff94
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
push 0x4bd4b4
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 4], ebx
call fcn.004012a9
mov ebx, dword [ebp - 0x18]
push ebx
lea eax, [ebp]
push eax
call esi
push str.kismain.ini
lea eax, [ebp]
push eax
call esi
or dword [ebp - 4], 0xffffffff
lea eax, [ebx - 0x10]
call fcn.00401291
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp]
push eax
push edi
lea eax, [ebp + 0x410]
push eax
mov ebx, 0x4ab8a8
push ebx
push str.version
push str.infos
call esi
test eax, eax
jbe 0x48b9e6
lea eax, [ebp + 0x410]
push eax
push dword [ebp - 0x1c]
call fcn.004012a9
lea eax, [ebp]
push eax
push edi
lea eax, [ebp + 0x410]
push eax
push ebx
push str.Version
push str.DisplayVersions
call esi
test eax, eax
jbe 0x48b9e6
lea eax, [ebp + 0x410]
push eax
push dword [ebp - 0x10]
call fcn.004012a9
mov edi, dword [ebp - 0x1c]
mov eax, dword [edi]
mov eax, dword [eax - 0xc]
push 6
pop ecx
cmp eax, ecx
jle 0x48b9e2
lea eax, [ebp - 0x10]
push eax
mov eax, edi
call fcn.0040912f
mov dword [ebp - 4], 1
call fcn.00408098
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401291
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x618]
xor ecx, ebp
call fcn.00495616
add ebp, 0x61c
leave
ret 8