joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4aa290
Capabilities:
Identify system language via api

Disassembly:
push ecx
mov eax, dword [0x6dcf84]
push esi
push edi
mov esi, ecx
push eax
call fcn.004aa760
lea ecx, [esp + 8]
push reloc.DSOUND.dll_DirectSoundCreate
push ecx
push str.LanguageDefault
push str.Main
mov dword [esp + 0x18], 0
call fcn.004ae0e0
mov eax, dword [esp + 0x18]
add esp, 0x10
test eax, eax
jne 0x4aa384
lea edi, [esi + 0x230]
push reloc.DSOUND.dll_DirectSoundCreate
push 0x104
push edi
push str.LanguageFile
push str.Main
call fcn.004ade60
add esp, 0x14
mov ecx, esi
push edi
call fcn.004aae90
test eax, eax
jne 0x4aa384
mov ecx, esi
mov word [edi], ax
call fcn.004aa390
test eax, eax
jne 0x4aa384
call fcn.004aa420
mov ecx, esi
mov word [esi + 0x22e], ax
call fcn.004aa390
test eax, eax
jne 0x4aa384
call fcn.004aa450
mov ecx, esi
mov word [esi + 0x22e], ax
call fcn.004aa390
test eax, eax
jne 0x4aa384
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov ecx, esi
mov word [esi + 0x22e], ax
call fcn.004aa390
test eax, eax
jne 0x4aa384
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov ecx, esi
mov word [esi + 0x22e], ax
call fcn.004aa390
test eax, eax
jne 0x4aa384
mov dx, word [esi + 0x22c]
mov ecx, esi
mov word [esi + 0x22e], dx
call fcn.004aa390
pop edi
pop esi
pop ecx
ret

Function at 0x4aa450
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x30
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.kernel32.dll
call esi
push str.GetSystemDefaultUILanguage
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4aa478
call eax
pop esi
add esp, 0x30
ret
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x4aa510
lea eax, [esp + 4]
mov dword [esp + 8], 0
push eax
push str.Control_PanelDesktopResourceLocale
push reloc.DSOUND.dll_DirectSoundCreate
mov dword [esp + 0x10], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4aa506
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp + 0x14]
push edx
push eax
push 0
push 0
push ecx
mov dword [esp + 0x24], 0x20
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4aa4fb
cmp dword [esp + 0x10], 1
jne 0x4aa4fb
lea edx, [esp + 8]
lea eax, [esp + 0x14]
push edx
push 0x4ebed8
push eax
call dword [sym.imp.MSVCRT.dll_swscanf]
add esp, 0xc
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ax, word [esp + 8]
pop esi
add esp, 0x30
ret
push str.ntdll.dll
mov dword [esp + 0xc], 0
call esi
test eax, eax
je 0x4aa538
lea edx, [esp + 8]
push edx
push 0x4aa550
push 1
push 0x10
push eax
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesW]
mov ax, word [esp + 8]
pop esi
add esp, 0x30
ret
Function at 0x4aa570
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x10
push esi
mov esi, ecx
mov ax, word [esi + 0x22e]
cmp ax, word [esi + 0x22c]
jne 0x4aa595
call fcn.004aa720
mov eax, 1
pop esi
add esp, 0x10
ret
lea ecx, [esp + 4]
push 4
push ecx
and eax, 0xffff
push 3
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x4aa5b3
pop esi
add esp, 0x10
ret
lea edx, [esp + 4]
push str..dll
push edx
call dword [sym.imp.MSVCRT.dll_wcscat]
add esp, 8
lea eax, [esp + 4]
mov ecx, esi
push 1
push eax
call fcn.004aa770
test ax, ax
jne 0x4aa5e0
xor eax, eax
pop esi
add esp, 0x10
ret
lea ecx, [esp + 4]
push ecx
mov ecx, esi
call fcn.004aae90
pop esi
add esp, 0x10
ret

Function at 0x4aa770
Capabilities:
Get file version info

Disassembly:
sub esp, 0x21c
push ebx
mov ebx, dword [esp + 0x224]
lea eax, [esp + 0x10]
push ebp
push eax
mov ebp, ecx
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
mov dword [esp + 8], eax
jne 0x4aa7a2
pop ebp
xor ax, ax
pop ebx
add esp, 0x21c
ret 8
push esi
push edi
push eax
xor edi, edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
add esp, 4
mov esi, eax
push esi
push ecx
push edx
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4aa86c
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push ecx
push str.VarFileInfoTranslation
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4aa86c
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
push eax
mov di, word [edx]
push ecx
push 0x4ee640
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4aa86c
mov eax, dword [esp + 0x18]
xor edx, edx
mov dx, word [eax + 0xc]
mov ecx, dword [eax + 0xc]
push edx
xor edx, edx
mov dx, word [eax + 8]
mov eax, dword [eax + 8]
shr ecx, 0x10
push ecx
push edx
shr eax, 0x10
push eax
push str._d._d._d._d
lea ecx, [esp + 0x38]
push 0x104
push ecx
call dword [sym.imp.MSVCRT.dll__snwprintf]
mov eax, dword [esp + 0x250]
add esp, 0x1c
test eax, eax
mov word [esp + 0x22a], 0
je 0x4aa86c
add ebp, 0x20
lea edx, [esp + 0x24]
push ebp
push edx
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
test eax, eax
je 0x4aa86c
xor edi, edi
push esi
call fcn.004d3765
add esp, 4
mov ax, di
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x21c
ret 8
Function at 0x4aac10
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x3ac
push ebx
push ebp
push esi
mov esi, dword [esp + 0x3c0]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea eax, [esp + 0x18]
push 0xa
and esi, 0xffff
push eax
xor ebx, ebx
push 0x1004
push esi
mov dword [esp + 0x20], ebx
call edi
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.MSVCRT.dll__wtoi]
add esp, 4
lea edx, [esp + 0x2c]
push 0xc8
push edx
push 4
push esi
call edi
cmp eax, ebx
jne 0x4aac8a
lea eax, [esp + 0x2c]
push 0xc8
push eax
push 2
push esi
call edi
test eax, eax
jne 0x4aac8a
push esi
lea ecx, [esp + 0x30]
push str._u______
push ecx
call dword [sym.imp.MSVCRT.dll_swprintf]
add esp, 0xc
mov ebp, dword [esp + 0x3c0]
mov edx, dword [0x4eb4c0]
lea eax, [esp + 0x2c]
test eax, eax
mov dword [ebp], edx
je 0x4aae28
lea ecx, [esp + 0x2c]
shr ecx, 0x10
jne 0x4aadf3
mov ecx, dword [0x6dcf84]
xor edi, edi
lea edx, [esp + 0x2c]
lea eax, [esp + 0x1bc]
mov di, dx
push 0x100
push eax
push edi
push ecx
mov dword [esp + 0x20], edi
call dword [sym.imp.USER32.dll_LoadStringW]
cmp eax, ebx
jne 0x4aace7
mov word [esp + 0x1bc], bx
mov edx, 0x100
sub edx, eax
cmp edx, 1
jle 0x4aad29
lea eax, [esp + 0x1bc]
test eax, eax
je 0x4aad0c
lea ecx, [esp + 0x1bc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [esp + 0x1bc]
mov ecx, ebp
push edx
push eax
call fcn.00407780
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x3ac
ret
mov ebx, 0xff
jmp 0x4aad37
mov ebp, dword [esp + 0x3c0]
mov eax, dword [ebp]
add ebx, 0x100
mov ecx, ebx
mov edx, dword [eax - 0xc]
lea ebp, [eax - 0xc]
cmp edx, 1
jg 0x4aad52
cmp ebx, dword [eax - 4]
jle 0x4aada3
mov esi, dword [eax - 8]
cmp ebx, esi
mov dword [esp + 0x14], esi
jge 0x4aad5f
mov ecx, esi
mov edi, dword [esp + 0x3c0]
push ecx
mov ecx, edi
call fcn.00407580
test eax, eax
je 0x4aaddd
mov edi, dword [edi]
lea ecx, [esi + esi + 2]
mov eax, ecx
lea esi, [ebp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x14]
and ecx, 3
push ebp
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x3c4]
mov edx, dword [ecx]
mov dword [edx - 8], eax
call fcn.00407650
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x3c0]
mov ebp, dword [ecx]
test ebp, ebp
je 0x4aadd6
mov edx, dword [0x6dcf84]
lea esi, [ebx + 1]
push esi
push ebp
push edi
push edx
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x4aadcb
mov word [ebp], ax
sub esi, eax
cmp esi, 1
jle 0x4aad30
mov edi, dword [esp + 0x3c0]
push 0xffffffffffffffff
mov ecx, edi
call fcn.004107f0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3ac
ret
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
cmp esi, ebx
je 0x4aae28
push esi
mov ecx, ebp
call fcn.00407580
test eax, eax
je 0x4aae28
mov edi, dword [ebp]
lea ecx, [esi + esi]
mov edx, ecx
lea esi, [esp + 0x2c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x3ac
ret
Function at 0x4abe60
Capabilities:
Write file on windows

Disassembly:
push ebx
mov eax, dword [esp + 8]
push ebp
push esi
push edi
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push eax
mov esi, 0xfa000
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x4abe94
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
cmp edi, 0xfa000
jae 0x4abea6
mov esi, edi
lea ecx, [esp + 0x14]
push 0
push ecx
push esi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4abec8
cmp esi, edi
je 0x4abed6
sub edi, 0xfa000
add ebx, esi
jmp 0x4abe9c
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x4abfc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4da128
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov ecx, dword [esp + 0x30]
lea eax, [esp]
push eax
push 0
push ecx
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
je 0x4ac00f
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret
mov eax, dword [esp]
test eax, eax
je 0x4ac147
push ebx
push 0x10
call sub.gdiplus.dll_GdipAlloc
mov ebx, eax
test ebx, ebx
je 0x4ac13c
mov eax, dword [esp + 4]
push ebp
push esi
lea ebp, [ebx + 4]
push edi
push ebp
push eax
mov dword [ebx], 0x4dd3bc
mov dword [ebp], 0
call sub.gdiplus.dll_GdipLoadImageFromStream
mov dword [ebx + 8], eax
mov eax, dword [esp + 0x3c]
lea edx, [esp + 0x18]
push edx
push eax
call fcn.004abef0
mov esi, dword [esp + 0x40]
mov ecx, dword [0x4eb4c0]
add esp, 8
mov dword [esp + 0x40], ecx
test esi, esi
je 0x4ac0bb
mov edx, esi
shr edx, 0x10
jne 0x4ac08b
and esi, 0xffff
lea ecx, [esp + 0x40]
push esi
call fcn.00407b70
jmp 0x4ac0bb
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
test edi, edi
je 0x4ac0bb
push edi
lea ecx, [esp + 0x44]
call fcn.00407580
test eax, eax
je 0x4ac0bb
lea ecx, [edi + edi]
mov edi, dword [esp + 0x40]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x40]
xor edi, edi
push ecx
mov dword [esp + 0x34], edi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
cmp esi, edi
je 0x4ac0fa
mov eax, dword [ebp]
lea edx, [esp + 0x18]
push edi
push edx
push esi
push eax
call sub.gdiplus.dll_GdipSaveImageToFile
cmp eax, edi
je 0x4ac0eb
mov dword [ebx + 8], eax
mov edi, eax
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
jne 0x4ac0fa
mov dword [esp + 0x14], edi
mov edx, dword [ebx]
push 1
mov ecx, ebx
call dword [edx]
mov eax, dword [esp + 0x40]
mov edx, dword [0x4eb24c]
pop edi
pop esi
lea ecx, [eax - 0xc]
mov dword [esp + 0x28], 0xffffffff
cmp ecx, edx
pop ebp
je 0x4ac13c
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x4ac13c
mov edx, dword [esp + 0x34]
add edx, 0xfffffff4
push edx
call fcn.004d3765
add esp, 4
mov eax, dword [esp + 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
pop ebx
mov ecx, dword [esp + 4]
xor eax, eax
test ecx, ecx
mov ecx, dword [esp + 0x18]
sete al
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x4ac740
Capabilities:
Move file
Read file on windows

Disassembly:
sub esp, 0x210
push ebx
push ebp
push esi
mov esi, dword [esp + 0x224]
xor ebp, ebp
push edi
push ebp
push esi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], ebp
call fcn.004a7ab0
add esp, 8
test eax, eax
jne 0x4ac7c2
mov ecx, 0x81
lea edi, [esp + 0x1a]
mov word [esp + 0x18], bp
push esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str._s.tmp
lea eax, [esp + 0x20]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
lea ecx, [esp + 0x28]
push ebp
push ecx
call fcn.004a7ab0
add esp, 0x18
test eax, eax
je 0x4ac7c2
lea edx, [esp + 0x18]
push esi
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov ebx, dword [esp + 0x22c]
cmp ebx, 2
jne 0x4ac7c9
mov ebx, 1
jmp 0x4ac7c9
mov ebx, dword [esp + 0x22c]
push 0x214
call dword [sym.imp.MSVCRT.dll_malloc]
mov edi, eax
add esp, 4
cmp edi, ebp
mov dword [esp + 0x10], edi
jne 0x4ac7f1
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x210
ret
mov ecx, 0x85
xor eax, eax
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x10]
mov edi, dword [sym.imp.MSVCRT.dll_wcslen]
push esi
mov dword [eax + 0x208], ebx
call edi
add esp, 4
cmp eax, 0x103
jbe 0x4ac81e
mov eax, 0x103
jmp 0x4ac824
push esi
call edi
add esp, 4
mov ecx, dword [esp + 0x10]
push eax
push esi
push ecx
call dword [sym.imp.MSVCRT.dll_wcsncpy]
mov edx, dword [esp + 0x1c]
add esp, 0xc
cmp dword [edx + 0x208], 2
jne 0x4ac864
push 0x4ec024
push esi
call dword [sym.imp.MSVCRT.dll__wfopen]
mov ecx, dword [esp + 0x18]
mov ebx, eax
mov eax, dword [esp + 0x22c]
add esp, 8
mov dword [eax], ecx
jmp 0x4ac922
push 0x4ec1ec
push esi
call dword [sym.imp.MSVCRT.dll__wfopen]
mov ebx, eax
add esp, 8
cmp ebx, ebp
jne 0x4ac883
mov dword [esp + 0x14], 1
jmp 0x4ac8f9
mov esi, dword [sym.imp.MSVCRT.dll_fseek]
push 2
push ebp
push ebx
call esi
push ebx
call dword [sym.imp.MSVCRT.dll_ftell]
push 0
push 0
push ebx
mov ebp, eax
call esi
add esp, 0x1c
test ebp, ebp
jle 0x4ac913
lea edi, [ebp + 2]
push edi
call dword [sym.imp.MSVCRT.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x4ac8f7
mov ecx, edi
xor eax, eax
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push ebx
and ecx, 3
push 1
push ebp
push esi
rep stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll_fread]
mov eax, dword [esp + 0x20]
push esi
push eax
call fcn.004ac420
mov edi, eax
push esi
mov dword [esp + 0x30], edi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 0x1c
test edi, edi
je 0x4ac913
xor ebp, ebp
cmp dword [esp + 0x10], ebp
je 0x4ac922
lea ecx, [esp + 0x10]
push ebp
push ecx
call fcn.004ac940
add esp, 8
mov dword [esp + 0x10], ebp
jmp 0x4ac922
mov edx, dword [esp + 0x224]
mov eax, dword [esp + 0x10]
xor ebp, ebp
mov dword [edx], eax
cmp ebx, ebp
je 0x4ac930
push ebx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x210
ret
Function at 0x4ad1b0
Capabilities:
Delete file
Get file attributes
Move file
Set file attributes
Write file on windows

Disassembly:
sub esp, 0x210
push ebx
push esi
mov esi, dword [esp + 0x21c]
push edi
test esi, esi
jne 0x4ad1d0
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x210
ret
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
test bl, 1
mov dword [esp + 0xc], ebx
je 0x4ad1ee
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x210
ret
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x224]
push esi
test eax, eax
je 0x4ad22a
push str._s.tmp
lea eax, [esp + 0x1c]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
jmp 0x4ad24e
push 0x4eb504
lea ecx, [esp + 0x1c]
push 0x103
push ecx
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea edx, [esp + 0x14]
push 0x4ee540
push edx
call dword [sym.imp.MSVCRT.dll__wfopen]
mov edi, eax
add esp, 8
test edi, edi
jne 0x4ad271
pop edi
pop esi
pop ebx
add esp, 0x210
ret
push ebp
push edi
push 1
lea eax, [esp + 0x1c]
push 2
push eax
mov dword [esp + 0x24], 0xfeff
call dword [sym.imp.MSVCRT.dll_fwrite]
mov ebp, dword [esi + 0x20c]
add esp, 0x10
test ebp, ebp
je 0x4ad2da
mov ebx, dword [sym.imp.MSVCRT.dll_fwprintf]
mov ecx, dword [ebp]
push ecx
push str._r_n_s_r_n
push edi
call ebx
mov esi, dword [ebp + 0xc]
add esp, 0xc
test esi, esi
je 0x4ad2c8
mov edx, dword [esi]
push edx
push str._s_r_n
push edi
call ebx
mov esi, dword [esi + 4]
add esp, 0xc
test esi, esi
jne 0x4ad2b3
mov ebp, dword [ebp + 8]
test ebp, ebp
jne 0x4ad29d
mov esi, dword [esp + 0x224]
mov ebx, dword [esp + 0x10]
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x22c]
add esp, 4
test eax, eax
pop ebp
je 0x4ad328
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [0x6dbf1c]
test eax, eax
je 0x4ad31a
lea eax, [esp + 0x14]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x4ad328
push 1
lea ecx, [esp + 0x18]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x210
ret
Function at 0x4ad700
Capabilities:
Move file

Disassembly:
sub esp, 0x208
push esi
push edi
call fcn.004ad620
mov esi, eax
push 0
push esi
call fcn.004a7ab0
add esp, 8
test eax, eax
jne 0x4ad77b
mov eax, dword [esp + 0x214]
test eax, eax
je 0x4ad730
mov edi, 2
jmp 0x4ad780
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push esi
push str._s.tmp
lea eax, [esp + 0x10]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
lea ecx, [esp + 0x18]
push 0
push ecx
call fcn.004a7ab0
add esp, 0x18
test eax, eax
je 0x4ad7a5
lea edx, [esp + 8]
push esi
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov edi, 1
push 0x6daae0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push edi
push esi
push 0x6dad00
call fcn.004ac740
add esp, 0xc
push 0x6daae0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
add esp, 0x208
ret

Function at 0x4ad8a0
Capabilities:
Delete registry value

Disassembly:
sub esp, 0x410
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [0x4fde48]
test eax, eax
je 0x4ad964
push ebx
mov ebx, dword [esp + 0x420]
test ebx, ebx
jne 0x4ad8dc
mov ebx, str.Main
push 1
call fcn.004ad800
mov esi, eax
add esp, 4
xor edi, edi
cmp dword [esi], 0
je 0x4ad958
mov word [esp + 0x214], di
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x216]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
push str.__s_
lea eax, [esp + 0x21c]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
push 0x6daae0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [esp + 0x424]
mov eax, dword [esi]
lea edx, [esp + 0x214]
push ecx
push edx
push eax
call fcn.004ad440
add esp, 0xc
mov edi, eax
push 0x6daae0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop ebx
pop edi
pop esi
add esp, 0x410
ret
lea ecx, [esp + 8]
push str.SoftwarePhoenix
push ecx
call dword [sym.imp.MSVCRT.dll_wcscpy]
mov edi, dword [esp + 0x424]
add esp, 8
test edi, edi
je 0x4ad99f
mov esi, dword [sym.imp.MSVCRT.dll_wcscat]
lea edx, [esp + 8]
push 0x4ee640
push edx
call esi
lea eax, [esp + 0x10]
push edi
push eax
call esi
add esp, 0x10
mov ecx, dword [esp + 0x420]
mov eax, dword [esp + 0x424]
lea edx, [esp + 8]
push ecx
push edx
push eax
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
add esp, 0x410
ret
Function at 0x4ad9d0
Capabilities:
Delete registry key

Disassembly:
sub esp, 0x410
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [0x4fde48]
test eax, eax
je 0x4ada8c
push ebx
mov ebx, dword [esp + 0x420]
test ebx, ebx
jne 0x4ada0c
mov ebx, str.Main
push 1
xor edi, edi
call fcn.004ad800
mov esi, eax
add esp, 4
cmp dword [esi], 0
je 0x4ada80
mov word [esp + 0x214], di
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x216]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
push str.__s_
lea eax, [esp + 0x21c]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
push 0x6daae0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [esi]
lea ecx, [esp + 0x214]
push ecx
push edx
call fcn.004ad340
add esp, 8
mov edi, eax
push 0x6daae0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop ebx
pop edi
pop esi
add esp, 0x410
ret
lea eax, [esp + 8]
push str.SoftwarePhoenix
push eax
call dword [sym.imp.MSVCRT.dll_wcscpy]
mov edi, dword [esp + 0x424]
add esp, 8
test edi, edi
je 0x4adac7
mov esi, dword [sym.imp.MSVCRT.dll_wcscat]
lea ecx, [esp + 8]
push 0x4ee640
push ecx
call esi
lea edx, [esp + 0x10]
push edi
push edx
call esi
add esp, 0x10
mov ecx, dword [esp + 0x420]
lea eax, [esp + 8]
push eax
push ecx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
add esp, 0x410
ret
Function at 0x4adaf0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x320c
call fcn.004d3780
push ebx
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
mov dword [esp + 0xc], 3
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [0x4fde48]
test eax, eax
je 0x4adc22
mov ebx, dword [esp + 0x321c]
test ebx, ebx
jne 0x4adb38
mov ebx, str.Main
push 0
call fcn.004ad800
mov esi, eax
add esp, 4
cmp dword [esi], 0
je 0x4adc16
mov ecx, 0x7ff
xor eax, eax
lea edi, [esp + 0x121a]
mov word [esp + 0x1218], 0
rep stosd dword es:[edi], eax
push 0x6daae0
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [esp + 0x3220]
mov edx, dword [esi]
lea eax, [esp + 0x1218]
push 0xfff
push eax
push ecx
push ebx
push edx
call fcn.004accf0
add esp, 0x14
mov esi, eax
push 0x6daae0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test esi, esi
je 0x4adc16
lea eax, [esp + 0x1218]
push eax
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
test eax, eax
je 0x4adc16
mov esi, dword [esp + 0x3228]
cdq
mov ecx, dword [esi]
sub eax, edx
sar eax, 1
dec eax
cmp ecx, eax
jae 0x4adbd0
mov eax, ecx
lea ecx, [esp + 0x218]
push 0x1000
lea edx, [esp + 0x121c]
push ecx
push edx
mov dword [esi], eax
call fcn.004afe00
mov eax, dword [esi]
mov edx, dword [esp + 0x3230]
lea ecx, [esp + 0x224]
push eax
push ecx
push edx
call fcn.004b18f0
add esp, 0x18
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x320c
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x320c
ret
lea eax, [esp + 0x10]
push str.SoftwarePhoenix
push eax
call dword [sym.imp.MSVCRT.dll_wcscpy]
mov edi, dword [esp + 0x3224]
add esp, 8
test edi, edi
je 0x4adc5d
mov esi, dword [sym.imp.MSVCRT.dll_wcscat]
lea ecx, [esp + 0x10]
push 0x4ee640
push ecx
call esi
lea edx, [esp + 0x18]
push edi
push edx
call esi
add esp, 0x10
mov eax, dword [esp + 0x3228]
mov ecx, dword [esp + 0x3224]
push eax
mov eax, dword [esp + 0x3224]
lea edx, [esp + 0x10]
push ecx
push edx
mov edx, dword [esp + 0x3238]
lea ecx, [esp + 0x1c]
push eax
push ecx
push edx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
neg eax
sbb eax, eax
pop edi
pop esi
inc eax
pop ebx
add esp, 0x320c
ret