joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48a6b9
Capabilities:
Get geographical location

Disassembly:
push 0x14
mov eax, 0x507e94
call fcn.004cc273
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x1c], esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
call fcn.00406bcb
push 0
push 0x521eb8
mov dword [ebp - 4], ebx
push 2
movzx ebx, di
push ebx
mov dword [ebp - 0x14], 1
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov dword [ebp - 0x18], eax
lea ecx, [eax - 1]
push ecx
push 0x78
lea ecx, [ebp - 0x10]
call fcn.004460ce
xor eax, eax
inc eax
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x10]
cmp dword [ecx - 4], eax
jle 0x48a723
push dword [ecx - 0xc]
lea ecx, [ebp - 0x10]
call fcn.00406701
mov ecx, dword [ebp - 0x10]
push dword [ebp - 0x18]
push ecx
push 2
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push dword [ebp - 0x10]
push edi
push str._d__s
push esi
call fcn.00407a35
add esp, 0x10
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004068bc
mov eax, esi
call fcn.004cc23c
ret

Function at 0x48a9f0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x2c
mov eax, dword [0x569078]
xor eax, esp
mov dword [esp + 0x24], eax
push ebp
push esi
mov ebp, ecx
push 2
push dword [ebp + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
xorps xmm0, xmm0
lea eax, [esp + 0x1c]
push eax
push esi
movups xmmword [esp + 0x24], xmm0
call dword [sym.imp.USER32.dll_GetWindowRect]
xor eax, eax
cmp byte [ebp + 0x2c], al
push 5
pop ecx
cmovne eax, ecx
push eax
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x3e9
push dword [ebp + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
lea ecx, [esp + 0xc]
mov dword [esp + 8], eax
push ecx
xorps xmm0, xmm0
push eax
movups xmmword [esp + 0x14], xmm0
call dword [sym.imp.USER32.dll_GetWindowRect]
cmp dword [ebp + 0x30], 0
jne 0x48aa69
mov eax, dword [esp + 0x14]
mov dword [ebp + 0x30], eax
cmp byte [ebp + 0x2c], 0
je 0x48aa74
mov eax, dword [ebp + 0x30]
jmp 0x48aa78
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], eax
lea eax, [esp + 0xc]
push 0x206
push eax
push ecx
lea ecx, [esp + 0x14]
call fcn.0040626c
mov ecx, dword [esp + 0x2c]
pop esi
pop ebp
xor ecx, esp
call fcn.004cb6da
add esp, 0x2c
ret
Function at 0x48ac28
Capabilities:
Terminate thread

Disassembly:
push 0x34
mov eax, 0x507f20
call fcn.004cc273
mov eax, dword [ebp + 8]
xor edi, edi
or dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x24], 0x531f98
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
push edi
push edi
push edi
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], edi
call fcn.00496af4
xor ebx, ebx
inc ebx
jmp 0x48ac89
push ebx
push edi
push edi
push edi
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x48ac89
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 0x5ff
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, ebx
je 0x48ac63
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0x531f98
je 0x48acf2
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp - 0x1c], 0xffffffff
je 0x48ace9
lea eax, [ebp + 8]
mov dword [ebp + 8], edi
push eax
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x48ace9
cmp dword [ebp + 8], 0x103
jne 0x48ace9
push edi
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004cc23c
ret 4
Function at 0x48bb1b
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x569078]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
call fcn.0048f19c
test al, al
jne 0x48bbfe
push str.ProgramFilesFolder
mov ecx, edi
call fcn.00447dcd
mov esi, str.AppDataFolder
test eax, eax
je 0x48bb74
mov edx, str.ProgramFiles
mov ecx, edi
call fcn.0048bc16
test al, al
jne 0x48bb74
push esi
mov ecx, edi
call fcn.00447dcd
test eax, eax
jne 0x48bbfe
push esi
mov ecx, edi
call fcn.00447dcd
neg eax
mov ecx, str.PROGRAMFILES
push 0
sbb al, al
add al, 1
pop eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x210]
push 0x104
push eax
mov eax, str.APPDATA
cmove eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test esi, esi
je 0x48bbbe
push 0x5c
pop eax
mov word [ebp + esi*2 - 0x210], ax
inc esi
lea eax, [esi + esi]
cmp eax, 0x208
jae 0x48bc10
xor ecx, ecx
mov word [ebp + eax - 0x210], cx
cmp word [ebp - 0x210], cx
je 0x48bbf7
lea eax, [ebp - 0x210]
push eax
call fcn.004d163d
pop ecx
push eax
lea eax, [ebp - 0x210]
mov ecx, edi
push eax
call fcn.004099a1
test esi, esi
setne al
jmp 0x48bc00
xor al, al
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004cb6da
mov esp, ebp
pop ebp
ret
call fcn.004cbef6
int3

Function at 0x48bc5f
Capabilities:
Read file on windows

Disassembly:
push 0x18
mov eax, 0x50811c
call fcn.004cc273
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
jne 0x48bc80
xor eax, eax
jmp 0x48bd49
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
and dword [ebp - 0x20], 0
mov edi, eax
mov dword [ebp - 0x24], edi
and dword [ebp - 4], 0
push 2
pop esi
cmp edi, 0xffffffff
je 0x48bd34
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x18]
mov ebx, dword [ebp + 0x10]
add eax, esi
and dword [ebp - 0x18], 0
sub ebx, esi
push 0
push ecx
push eax
push edi
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x48bd34
mov eax, ebx
lea ecx, [ebp + 8]
shr eax, 1
push eax
push 0x78
call fcn.004460ce
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 1
jle 0x48bd00
push dword [eax - 0xc]
lea ecx, [ebp + 8]
call fcn.00406701
mov eax, dword [ebp + 8]
push 0
lea ecx, [ebp - 0x10]
push ecx
push ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x48bd28
cmp dword [ebp - 0x10], 0
je 0x48bd28
mov ecx, dword [ebp - 0x14]
lea eax, [ebp + 8]
push eax
call fcn.00491e26
movzx esi, al
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0
call fcn.004068bc
or dword [ebp - 4], 0xffffffff
test edi, edi
je 0x48bd47
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x24], 0
mov eax, esi
call fcn.004cc23c
ret 0xc
Function at 0x48df09
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov edi, edx
push eax
lea eax, [ebp - 8]
mov ebx, ecx
push eax
push 0
push dword [edi]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp esi, 0xea
jne 0x48df6f
push dword [ebp - 4]
mov ecx, dword [ebp + 8]
call fcn.00406800
mov ecx, dword [ebp + 8]
lea eax, [ebp - 4]
mov esi, dword [edi]
push eax
call fcn.00407a1e
push eax
lea eax, [ebp - 8]
push eax
push 0
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp + 8]
mov esi, eax
push 0xffffffffffffffff
call fcn.0040685d
xor eax, eax
test esi, esi
pop edi
pop esi
setne al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48df7d
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
sub esp, 0x264
lea ebp, [esp - 4]
mov eax, dword [0x569078]
xor eax, ebp
mov dword [ebp + 0x264], eax
push 0x28
mov eax, 0x508827
call fcn.004cc273
mov esi, ecx
mov dword [ebp - 0x28], esi
mov eax, dword [ebp + 0x278]
mov edi, dword [ebp + 0x27c]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], edi
and dword [ebp - 4], 0
lea ecx, [ebp + 0x270]
call fcn.00473210
lea ecx, [ebp - 0x1c]
call fcn.00406bcb
lea eax, [ebp - 0x1c]
xor ebx, ebx
push eax
push dword [ebp - 0x20]
inc ebx
lea eax, [ebp + 0x270]
push ecx
mov byte [ebp - 4], bl
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
call fcn.00407175
mov byte [ebp - 4], 2
mov byte [ebp - 4], bl
call fcn.0048e1c3
test al, al
je 0x48e04b
push ecx
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp + 0x250]
call fcn.00469790
push ecx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp + 0x250]
call fcn.00469a20
push eax
mov ecx, edi
mov byte [ebp - 4], 3
call fcn.004717c0
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.004068bc
lea eax, [ebp + 0x250]
mov ecx, esi
push eax
call fcn.0048e2c9
test al, al
je 0x48e04b
xor ebx, ebx
jmp 0x48e055
mov esi, dword [ebp + 0x274]
cmp esi, ebx
jge 0x48e05c
mov esi, ebx
jmp 0x48e14f
lea eax, [ebp + 0x270]
push eax
lea ecx, [ebp - 0x14]
call fcn.00407175
push 0x52c068
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 4
call fcn.0040706a
mov eax, dword [ebp - 0x14]
cmp dword [eax - 4], ebx
jle 0x48e092
push dword [eax - 0xc]
lea ecx, [ebp - 0x14]
call fcn.00406701
mov eax, dword [ebp - 0x14]
lea ecx, [ebp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
and dword [ebp - 0x2c], 0
mov edi, eax
mov dword [ebp - 0x30], edi
lea eax, [ebp]
mov byte [ebp - 4], 5
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp edi, 0xffffffff
setne al
test al, al
je 0x48e12f
lea ecx, [ebp]
call fcn.0048e19a
test al, al
je 0x48e11b
lea eax, [ebp + 0x2c]
push eax
lea edx, [ebp + 0x270]
lea ecx, [ebp - 0x10]
call fcn.004522e9
pop ecx
push dword [ebp - 0x24]
lea eax, [esi - 1]
mov byte [ebp - 4], 6
push dword [ebp - 0x20]
push eax
push ecx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x34], esp
mov ecx, esp
push eax
call fcn.00407175
mov ecx, dword [ebp - 0x28]
mov byte [ebp - 4], 7
mov byte [ebp - 4], 6
call fcn.0048df7d
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x10]
test eax, eax
je 0x48e191
call fcn.004068bc
lea eax, [ebp]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
dec eax
neg eax
sbb al, al
add al, 1
jne 0x48e0bf
mov esi, ebx
mov byte [ebp - 4], 4
test edi, edi
je 0x48e144
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
and dword [ebp - 0x30], 0
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.004068bc
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0
call fcn.004068bc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x270]
call fcn.004068bc
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x264]
xor ecx, ebp
call fcn.004cb6da
lea esp, [ebp + 0x268]
pop ebp
ret 0x10
call fcn.004068bc
xor esi, esi
jmp 0x48e131
Function at 0x48e48f
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc
mov eax, 0x508941
call fcn.004cc273
cmp byte [ebp + 0x10], 0
mov ecx, dword [ebp + 8]
jne 0x48e4e2
mov dl, byte [ebp + 0xc]
call fcn.0048e40f
xor esi, esi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], esi
cmp byte [ebp + 0x14], 0
mov dword [ebp - 4], esi
je 0x48e4c4
test eax, eax
setne bl
jmp 0x48e4c9
test eax, eax
sete bl
or dword [ebp - 4], 0xffffffff
test eax, eax
je 0x48e4db
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], esi
mov al, bl
jmp 0x48e59a
push 0x5c
push dword [ecx]
call fcn.004cf115
pop ecx
pop ecx
mov edi, eax
push 3
pop ebx
test edi, edi
je 0x48e588
mov eax, dword [ebp + 8]
sub edi, dword [eax]
sar edi, 1
js 0x48e588
push edi
xor esi, esi
lea ecx, [ebp + 0x10]
push esi
push ecx
mov ecx, eax
call fcn.00447d38
mov dword [ebp - 4], 1
lea ecx, [ebp + 0x10]
mov dl, byte [ebp + 0xc]
call fcn.0048e40f
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 2
test eax, eax
je 0x48e56a
mov ecx, dword [ebp + 8]
lea edx, [edi + 1]
push edx
lea eax, [ebp + 0xc]
push eax
call fcn.00447b6f
push esi
push esi
push esi
push esi
mov byte [ebp - 4], bl
push dword [ebp + 0xc]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 2
mov ebx, eax
call fcn.004068bc
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 1
test eax, eax
je 0x48e57c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.004068bc
cmp byte [ebp + 0x14], 0
je 0x48e595
test ebx, ebx
sete al
jmp 0x48e59a
test ebx, ebx
setne al
call fcn.004cc23c
ret 0x10
Function at 0x48ea74
Capabilities:
Get disk size

Disassembly:
sub esp, 0x424
mov eax, dword [0x569078]
xor eax, esp
mov dword [esp + 0x41c], eax
push ebx
push ebp
push esi
push edi
test ecx, ecx
jne 0x48ea97
xor al, al
jmp 0x48eb9f
movzx edx, word [ecx]
lea esi, [esp + 0x28]
push 2
pop ebp
test dx, dx
je 0x48eaba
mov eax, esi
sub ecx, eax
mov word [esi], dx
add esi, ebp
movzx eax, word [ecx + esi]
mov edx, eax
test ax, ax
jne 0x48eaaa
xor eax, eax
xor cl, cl
mov word [esi], ax
sub esi, ebp
push 0x5c
xor al, al
pop edx
mov byte [esp + 0x17], al
cmp word [esp + 0x28], dx
jne 0x48eae9
cmp word [esp + 0x2a], dx
jne 0x48eae9
xor ebx, ebx
inc ebx
cmp word [esi], dx
mov byte [esp + 0x17], bl
setne cl
jmp 0x48eaf5
xor ebx, ebx
movzx eax, al
inc ebx
cmp word [esi], dx
cmove eax, ebx
lea edi, [esp + 0x2c]
cmp word [esp + 0x2c], dx
je 0x48eb07
add edi, ebp
cmp word [edi], dx
jne 0x48eb00
test cl, cl
jne 0x48eb11
test al, al
je 0x48eb1f
jmp 0x48eb18
add esi, ebp
mov word [esi], dx
add esi, ebp
xor eax, eax
mov word [esi], ax
sub esi, ebp
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
lea eax, [esp + 0x20]
push eax
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x48eb7f
push 0x5c
pop ecx
cmp word [esi], cx
lea eax, [esi - 2]
cmovne eax, esi
mov esi, eax
jmp 0x48eb59
cmp word [esi], cx
je 0x48eb61
sub esi, ebp
lea eax, [esp + 0x28]
cmp esi, eax
ja 0x48eb52
cmp esi, edi
jb 0x48ea90
cmp byte [esp + 0x17], 0
jne 0x48eb74
cmp esi, edi
jne 0x48eb76
add esi, ebp
xor eax, eax
mov word [esi], ax
sub esi, ebp
jmp 0x48eb28
mov eax, dword [esp + 0x43c]
cmp eax, dword [esp + 0x1c]
ja 0x48eb9b
jb 0x48eb9d
mov eax, dword [esp + 0x438]
cmp eax, dword [esp + 0x18]
jb 0x48eb9d
xor ebx, ebx
mov al, bl
mov ecx, dword [esp + 0x42c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004cb6da
add esp, 0x424
ret
Function at 0x48f3f2
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x508bb4
call fcn.004cc273
mov edi, edx
mov ebx, ecx
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0xc8
push eax
jmp 0x48f419
add dword [ebp - 0x10], 2
push esi
call fcn.004cbcfc
and dword [ebp - 0x14], 0
pop ecx
push dword [ebp - 0x10]
lea ecx, [ebp - 0x14]
call fcn.00481ad2
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push eax
push esi
lea eax, [ebp - 0x18]
push eax
push 0
push dword [edi]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 0xea
je 0x48f414
test eax, eax
je 0x48f454
xor bl, bl
jmp 0x48f4d1
mov eax, dword [ebp - 0x18]
xor ebx, ebx
inc ebx
cmp eax, ebx
je 0x48f481
cmp eax, 2
je 0x48f481
cmp eax, 7
je 0x48f481
cmp eax, 4
jne 0x48f450
push dword [esi]
push 0x52f9f0
push dword [ebp + 8]
call fcn.00407a35
add esp, 0xc
jmp 0x48f4d1
mov eax, dword [ebp - 0x10]
xor ecx, ecx
shr eax, 1
mov dword [ebp - 0x10], eax
mov word [esi + eax*2], cx
xor eax, eax
mov edi, dword [ebp - 0x10]
jmp 0x48f49a
dec edi
mov dword [ebp - 0x10], edi
cmp word [esi + edi*2], ax
je 0x48f496
inc edi
mov dword [ebp - 0x10], edi
call fcn.00406ab4
push eax
push edi
push esi
lea ecx, [ebp - 0x1c]
call fcn.00447e12
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 2
call fcn.00446083
xor eax, eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], al
call fcn.004068bc
or dword [ebp - 4], 0xffffffff
push esi
call fcn.004cbcfc
xor eax, eax
mov dword [ebp - 0x14], eax
mov al, bl
pop ecx
call fcn.004cc23c
ret

Function at 0x48f4e9
Capabilities:
Delete registry key

Disassembly:
push 0x10
mov eax, 0x508be7
call fcn.004cc273
push edx
lea ecx, [ebp - 0x10]
call fcn.00407175
and dword [ebp - 4], 0
xor ebx, ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x5c
push dword [ebp - 0x10]
call fcn.004cf115
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x48f5d7
sub esi, dword [ebp - 0x10]
sar esi, 1
js 0x48f5d7
lea eax, [esi + 1]
push eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.00447b6f
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax - 0xc]
sub eax, esi
push eax
push esi
call fcn.0046a060
and dword [ebp - 0x1c], 0
and dword [ebp - 0x18], 0
mov byte [ebp - 4], 2
cmp dword [ebp - 0x1c], 0
je 0x48f56c
push dword [ebp - 0x1c]
call edi
and dword [ebp - 0x1c], 0
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x10]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
cmp dword [ebp - 0x1c], 0
je 0x48f5b8
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov byte [ebp - 4], 1
test eax, eax
jne 0x48f5bc
inc ebx
cmp dword [ebp - 0x1c], eax
je 0x48f5a7
push dword [ebp - 0x1c]
call edi
and dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call fcn.004068bc
jmp 0x48f50a
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x48f5cb
push dword [ebp - 0x1c]
call edi
and dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call fcn.004068bc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004068bc
mov eax, ebx
call fcn.004cc23c
ret
Function at 0x48f7fe
Capabilities:
Get file size

Disassembly:
push 8
mov eax, 0x504dd8
call fcn.004cc273
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push ebx
push 0x80000000
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], ebx
cmp esi, 0xffffffff
jne 0x48f837
mov edi, ebx
jmp 0x48f841
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x48f853
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x14], ebx
mov eax, edi
call fcn.004cc23c
ret

Function at 0x48f85b
Capabilities:
Create process on windows

Disassembly:
push 0x5c
mov eax, 0x508c4e
call fcn.004cc273
mov esi, edx
mov edi, ecx
push 0x40
xor ebx, ebx
mov dword [ebp - 0x68], 0x44
lea eax, [ebp - 0x64]
push ebx
push eax
call fcn.004cd4d0
xorps xmm0, xmm0
mov dword [ebp - 0x14], ebx
add esp, 0xc
mov byte [ebp - 0x10], bl
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 4], ebx
cmp byte [ebp + 0x10], bl
je 0x48f8a0
lea ecx, [ebp - 0x14]
call fcn.0049417d
mov ecx, dword [esi]
xor eax, eax
cmp dword [ecx - 0xc], eax
cmove ecx, eax
mov eax, dword [edi]
xor edx, edx
cmp dword [eax - 0xc], edx
cmove eax, edx
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x68]
push edx
push ebx
push ebx
push dword [ebp + 0xc]
push ebx
push ebx
push ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x48f8e1
mov esi, dword [ebp + 8]
test esi, esi
je 0x48f909
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
jmp 0x48f909
cmp dword [ebp + 8], 0
je 0x48f8fe
push 0xffffffffffffffff
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp + 8]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0049412d
mov al, bl
call fcn.004cc23c
ret
Function at 0x48f91d
Capabilities:
Create process on windows

Disassembly:
push 0x48
mov eax, 0x508ca3
call fcn.004cc273
mov dword [ebp - 0x14], edx
mov edi, ecx
mov dword [ebp - 0x10], edi
xor ebx, ebx
lea eax, [ebp - 0x50]
push 0x38
push ebx
push eax
mov dword [ebp - 0x18], ebx
call fcn.004cd4d0
mov esi, dword [ebp + 0xc]
mov eax, 0x400
mov edi, dword [edi]
add esp, 0xc
test esi, esi
mov dword [ebp - 0x54], 0x3c
lea ecx, [eax + 0x40]
cmovne eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x50], eax
call fcn.00474b40
test al, al
je 0x48f970
add edi, 8
mov ecx, dword [ebp - 0x14]
xor eax, eax
cmp byte [ebp + 0x10], al
mov dword [ebp - 0x44], edi
sete al
mov dword [ebp - 0x48], str.open
mov ecx, dword [ecx]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x40]
cmp dword [ecx - 0xc], ebx
cmovne eax, ecx
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0x40], eax
mov eax, dword [ecx]
cmp dword [eax - 0xc], ebx
jne 0x48f9b3
mov edx, dword [ebp - 0x10]
lea ecx, [ebp + 0x18]
call fcn.00473740
mov dword [ebp - 4], ebx
xor ebx, ebx
inc ebx
jmp 0x48f9c6
push ecx
lea ecx, [ebp + 0x10]
call fcn.00407175
push 2
mov dword [ebp - 4], 1
pop ebx
push eax
lea ecx, [ebp + 0xc]
call fcn.00407175
mov dword [ebp - 4], 3
test bl, 2
je 0x48f9e6
lea ecx, [ebp + 0x10]
and ebx, 0xfffffffd
call fcn.004068bc
mov byte [ebp - 4], 4
test bl, 1
je 0x48f9f7
lea ecx, [ebp + 0x18]
call fcn.004068bc
mov edi, dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.00474b40
test al, al
je 0x48fa09
add edi, 8
lea eax, [ebp - 0x54]
mov dword [ebp - 0x3c], edi
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x48fa2a
test esi, esi
je 0x48fa26
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
xor ebx, ebx
jmp 0x48fa5a
test esi, esi
je 0x48fa49
cmp dword [ebp - 0x1c], 0
je 0x48fa58
push 0xffffffffffffffff
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 0x1c], 0
je 0x48fa58
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.004068bc
mov al, bl
call fcn.004cc23c
ret