joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48a3e0
Capabilities:
Set registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5b96cb
push eax
mov dword fs:[0], esp
sub esp, 0x218
lea eax, [esp + 4]
push esi
mov esi, ecx
push edi
lea ecx, [esp + 8]
push eax
xor edi, edi
push ecx
push edi
push 0xf003f
push edi
push 0x67df58
push edi
push str.SoftwareDownloadManagerListSettings
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x48a477
lea ecx, [esp + 0x10]
call fcn.00481cc0
push 1
push str.Cannot_open__create__registry_listsettings_subkey._n
lea ecx, [esp + 0x18]
mov dword [esp + 0x230], edi
call fcn.00481de0
lea ecx, [esp + 0x10]
mov dword [esp + 0x228], 0xffffffff
call fcn.00481dd0
pop edi
pop esi
mov ecx, dword [esp + 0x218]
mov dword fs:[0], ecx
add esp, 0x224
ret
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
lea ebx, [esi + 0xe0]
mov eax, dword [ebx + 4]
test eax, eax
je 0x48a49c
mov edx, dword [esi + 0x1c]
push 0
push edi
push 0x101d
push edx
call ebp
mov dword [ebx], eax
inc edi
add ebx, 8
cmp edi, 0xb
jl 0x48a485
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea eax, [esi + 0xe0]
push 8
push eax
mov eax, dword [esp + 0x18]
push 0
push 0
push str.FileName
push eax
call edi
mov edx, dword [esp + 0x10]
lea ecx, [esi + 0xe8]
push 8
push ecx
push 0
push 0
push str.DateAdded
push edx
call edi
mov ecx, dword [esp + 0x10]
lea eax, [esi + 0xf0]
push 8
push eax
push 0
push 0
push str.Queue
push ecx
call edi
mov eax, dword [esp + 0x10]
lea edx, [esi + 0xf8]
push 8
push edx
push 0
push 0
push str.Size
push eax
call edi
mov edx, dword [esp + 0x10]
lea ecx, [esi + 0x100]
push 8
push ecx
push 0
push 0
push 0x65a948
push edx
call edi
mov ecx, dword [esp + 0x10]
lea eax, [esi + 0x108]
push 8
push eax
push 0
push 0
push str.Timeleft
push ecx
call edi
mov eax, dword [esp + 0x10]
lea edx, [esi + 0x110]
push 8
push edx
push 0
push 0
push str.TransferRate
push eax
call edi
mov edx, dword [esp + 0x10]
lea ecx, [esi + 0x118]
push 8
push ecx
push 0
push 0
push str.LastTry
push edx
call edi
mov ecx, dword [esp + 0x10]
lea eax, [esi + 0x120]
push 8
push eax
push 0
push 0
push 0x65a250
push ecx
call edi
mov eax, dword [esp + 0x10]
lea edx, [esi + 0x128]
push 8
push edx
push 0
push 0
push str.SaveTo
push eax
call edi
mov edx, dword [esp + 0x10]
lea ecx, [esi + 0x130]
push 8
push ecx
push 0
push 0
push str.Referer
push edx
call edi
lea ebx, [esi + 0x138]
push 0xb
push ebx
mov ecx, esi
call fcn.00598892
test eax, eax
je 0x48a5e5
mov eax, dword [esp + 0x10]
push 0x2c
push ebx
push 0
push 0
push str.Order
push eax
call edi
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x228]
pop ebp
pop ebx
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x224
ret
Function at 0x48bcf0
Capabilities:
Create thread

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5b97e0
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CreateThread]
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SleepEx]
mov eax, dword [esi + 0x55c]
test eax, eax
jne 0x48bdbc
lea eax, [esp + 0x14]
push eax
push 0
push esi
push 0x48be80
push 0
push 0
call ebp
test eax, eax
mov dword [esi + 0x55c], eax
je 0x48bd60
mov eax, dword [esi + 0x564]
test eax, eax
jne 0x48bdbc
push 1
push 0
call edi
mov eax, dword [esi + 0x564]
test eax, eax
je 0x48bd4e
jmp 0x48bdbc
mov ecx, dword [0x679a04]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [esp + 0x10]
push str.Gr_GetWW:CrTh_failed__err__ld_n
push edx
call fcn.00596d08
mov ecx, dword [0x67e680]
add esp, 0xc
test ecx, ecx
je 0x48bda1
mov eax, dword [esp + 0xc]
push 1
push eax
call fcn.00481de0
lea ecx, [esp + 0xc]
mov dword [esi + 0x564], 0
mov dword [esp + 0x24], 0xffffffff
call fcn.0059df40
mov eax, dword [esi + 0x560]
test eax, eax
jne 0x48be5f
lea ecx, [esp + 0x18]
push ecx
push 0
push esi
push 0x48c090
push 0
push 0
call ebp
test eax, eax
mov dword [esi + 0x560], eax
je 0x48be03
mov eax, dword [esi + 0x568]
test eax, eax
jne 0x48be5f
push 1
push 0
call edi
mov eax, dword [esi + 0x568]
test eax, eax
je 0x48bdf1
jmp 0x48be5f
mov edx, dword [0x679a04]
mov dword [esp + 0x10], edx
mov dword [esp + 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x14]
push str.Gr_GetWW:CrTh2_failed__err__ld_n
push eax
call fcn.00596d08
mov ecx, dword [0x67e680]
add esp, 0xc
test ecx, ecx
je 0x48be44
mov edx, dword [esp + 0x10]
push 1
push edx
call fcn.00481de0
lea ecx, [esp + 0x10]
mov dword [esi + 0x568], 0
mov dword [esp + 0x24], 0xffffffff
call fcn.0059df40
mov eax, dword [esi + 0x564]
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x498830
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5ba600
push eax
mov dword fs:[0], esp
sub esp, 0x18
lea eax, [esp + 0x14]
push esi
mov esi, ecx
lea ecx, [esp + 0xc]
push eax
push ecx
push 0
push 0xf003f
push 0
push 0x67df58
push 0
push str.SoftwareDownloadManagerGrabberSts
push reloc.WSOCK32.dll_accept
mov dword [esi + 0x4c8], 1
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x4988e5
mov edx, dword [0x679a04]
mov dword [esp + 4], edx
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 8]
push str.Gr_SetPID:RegCrKey_failed__err_ld_n
push eax
call fcn.00596d08
mov ecx, dword [0x67e680]
add esp, 0xc
test ecx, ecx
je 0x4988c4
mov edx, dword [esp + 4]
push 1
push edx
call fcn.00481de0
lea ecx, [esp + 4]
mov dword [esp + 0x24], 0xffffffff
call fcn.0059df40
pop esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push ecx
push 0
push 0
push str.maxProjectID
push edx
mov dword [esp + 0x28], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x49891c
mov eax, dword [esp + 0x14]
inc eax
mov dword [esi + 0x4c8], eax
jmp 0x49896d
cmp eax, 2
je 0x49896d
mov ecx, dword [0x679a04]
mov dword [esp + 8], ecx
push eax
lea edx, [esp + 0xc]
push str.Gr_SetPID:RegQVE_failed__err_ld_n
push edx
mov dword [esp + 0x30], 1
call fcn.00596d08
mov ecx, dword [0x67e680]
add esp, 0xc
test ecx, ecx
je 0x49895c
mov eax, dword [esp + 8]
push 1
push eax
call fcn.00481de0
lea ecx, [esp + 8]
mov dword [esp + 0x24], 0xffffffff
call fcn.0059df40
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x65ab64]
mov ecx, dword [esi + 0x4c8]
cmp eax, ecx
jl 0x49898e
inc eax
mov dword [esi + 0x4c8], eax
mov edx, dword [esi + 0x4c8]
mov dword [0x65ab64], edx
mov eax, dword [esi + 0x4c8]
push eax
call fcn.0049da70
mov ecx, dword [0x67e69c]
add esp, 4
test ecx, ecx
je 0x4989bf
mov edx, dword [esi + 0x4c8]
push edx
call fcn.00483850
mov ecx, dword [esp + 0x1c]
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x4989d0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5ba618
push eax
mov dword fs:[0], esp
sub esp, 0x14
lea eax, [esp + 0x10]
push esi
mov esi, ecx
lea ecx, [esp + 0xc]
push eax
push ecx
push 0
push 0xf003f
push 0
push 0x67df58
push 0
push str.SoftwareDownloadManagerGrabberSts
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x498a7b
mov edx, dword [0x679a04]
mov dword [esp + 8], edx
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0xc]
push str.Gr_SetPID:RegCrKey_failed__err_ld_n
push eax
call fcn.00596d08
mov ecx, dword [0x67e680]
add esp, 0xc
test ecx, ecx
je 0x498a5a
mov edx, dword [esp + 8]
push 1
push edx
call fcn.00481de0
lea ecx, [esp + 8]
mov dword [esp + 0x20], 0xffffffff
call fcn.0059df40
pop esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x10]
lea ecx, [esp + 4]
push eax
push ecx
push 0
push 0
push str.maxProjectID
push edx
mov dword [esp + 0x28], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov eax, dword [esi + 0x4c8]
jne 0x498ab1
cmp eax, dword [esp + 4]
jle 0x498ab5
mov dword [esp + 4], eax
mov edx, dword [esp + 0xc]
lea ecx, [esp + 4]
push 4
push ecx
push 4
push 0
push str.maxProjectID
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x18]
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x49b940
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ba95b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
xor edx, edx
mov ecx, dword [ebp + 8]
push edi
cmp ecx, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], edx
jl 0x49ba83
cmp ecx, dword [esi + 0xb0]
jge 0x49ba83
xor ebx, ebx
cmp edx, dword [esi + 0x548]
jge 0x49b9f5
mov eax, dword [esi + 0x544]
lea edi, [edx*8]
add eax, edi
cmp ecx, dword [eax]
jne 0x49ba61
mov ecx, dword [eax + 4]
mov eax, dword [esi + 0x548]
mov dword [ebp + 8], ecx
mov ecx, dword [esi + 0x544]
sub eax, edx
mov ebx, 1
dec eax
add ecx, edi
mov edi, ebx
dec ebx
test edi, edi
je 0x49b9c6
add ecx, 8
jmp 0x49b9ba
test eax, eax
je 0x49b9e5
mov ecx, dword [esi + 0x544]
shl eax, 3
push eax
lea eax, [ecx + edx*8 + 8]
lea ecx, [ecx + edx*8]
push eax
push ecx
call fcn.00582b80
add esp, 0xc
mov eax, dword [esi + 0x548]
mov ebx, dword [ebp + 8]
dec eax
mov dword [esi + 0x548], eax
test ebx, ebx
je 0x49ba83
mov edx, dword [ebx]
push 0
push 0x1442
push 0x111
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp + 8], ebx
mov al, byte [ebx + 0x26]
mov byte [ebp - 4], 1
test al, al
je 0x49ba31
mov eax, dword [ebx + 0x10]
test eax, eax
jne 0x49ba2a
lea eax, [ebx + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebx + 0x10]
call fcn.00401070
lea ecx, [ebx + 0xc]
mov byte [ebp - 4], 0
call fcn.0059df40
push ebx
call fcn.0059a303
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
inc edx
jmp 0x49b97f
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x49baa0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ba986
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], edi
mov eax, dword [ebx + 0x548]
mov dword [ebp - 0x14], edi
cmp edi, eax
jge 0x49bb6b
mov eax, dword [ebx + 0x544]
push 0
push 0x1442
push 0x111
mov ecx, dword [eax + edi*8 + 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [ebx + 0x544]
mov esi, dword [eax + edi*8 + 4]
test esi, esi
mov dword [ebp - 0x1c], esi
je 0x49bb5e
mov al, byte [esi + 0x26]
mov byte [ebp - 4], 2
test al, al
je 0x49bb28
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x49bb21
lea eax, [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esi + 0x10]
call fcn.00401070
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 1
call fcn.0059df40
push esi
call fcn.0059a303
add esp, 4
mov dword [ebp - 4], 0
inc edi
jmp 0x49bacb
mov dword [ebp - 4], 0
inc edi
jmp 0x49bacb
push 0xffffffffffffffff
push 0
lea ecx, [ebx + 0x540]
call fcn.004a4250
mov ecx, ebx
call fcn.004a0c90
mov esi, dword [ebx + 0x554]
test esi, esi
je 0x49bbd1
mov dword [ebp - 0x1c], esi
mov al, byte [esi + 0x26]
mov byte [ebp - 4], 4
test al, al
je 0x49bbaa
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x49bba3
lea eax, [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esi + 0x10]
call fcn.00401070
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 0
call fcn.0059df40
push esi
call fcn.0059a303
add esp, 4
mov dword [ebx + 0x554], 0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49f9a0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x5bac3b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov al, byte [esi + 0x26]
mov dword [esp + 0x10], 0
test al, al
je 0x49f9dd
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x49f9d6
lea eax, [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esi + 0x10]
call fcn.00401070
lea ecx, [esi + 0xc]
mov dword [esp + 0x10], 0xffffffff
call fcn.0059df40
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4a0c90
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bad6b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esp
mov eax, dword [edi + 0x554]
mov dword [ebp - 4], ebx
cmp eax, ebx
je 0x4a0d3b
mov eax, dword [eax]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4a0ce9
mov ecx, dword [edi + 0x554]
push ebx
push 0x1442
push 0x111
mov edx, dword [ecx]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, edi
call fcn.0049a560
mov esi, dword [edi + 0x554]
cmp esi, ebx
mov dword [ebp - 0x14], esi
je 0x4a0d35
mov al, byte [esi + 0x26]
mov byte [ebp - 4], 1
cmp al, bl
je 0x4a0d19
mov eax, dword [esi + 0x10]
cmp eax, ebx
jne 0x4a0d12
lea eax, [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esi + 0x10]
call fcn.00401070
lea ecx, [esi + 0xc]
mov byte [ebp - 4], bl
call fcn.0059df40
push esi
call fcn.0059a303
add esp, 4
mov dword [edi + 0x554], ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a78b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bbb88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 4], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], esi
mov word [ebp - 0x1c], si
mov bl, 1
lea ecx, [edi + 0x8b0]
mov byte [ebp - 4], bl
call fcn.004d82f0
mov ecx, dword [ebp + 8]
cmp ecx, eax
jge 0x4a794c
mov edx, dword [edi + ecx*4 + 0x8b4]
mov esi, dword [0x67e518]
mov byte [ebp - 0x11], bl
mov ebx, dword [0x67e51c]
xor eax, eax
cmp eax, ebx
jge 0x4a7942
lea ecx, [eax + eax*2]
cmp edx, dword [esi + ecx*4]
lea ecx, [esi + ecx*4]
jne 0x4a7977
mov ecx, dword [ecx + 8]
push ecx
lea ecx, [ebp - 0x20]
call fcn.00401fc0
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x4a7936
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4a797a
mov al, byte [ebp - 0x11]
test al, al
je 0x4a797a
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [edi + 0x8b0]
call fcn.004d8500
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0
call fcn.00401070
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
inc eax
jmp 0x4a7911
lea ecx, [edi + 0x738]
call fcn.0048d980
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x4a798f
lea eax, [ebp - 0x1c]
push eax
mov ecx, edi
call fcn.004a9560
jmp 0x4a7958
Function at 0x4aad38
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5bc16b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x38]
mov eax, dword [esi + 0x34]
cmp eax, edi
jne 0x4aae08
add edi, 0x64
mov dword [esi + 0x38], edi
lea eax, [edi*8 + 4]
push eax
call fcn.0059a2da
add esp, 4
mov dword [esp + 0x10], eax
xor ebp, ebp
cmp eax, ebp
mov dword [esp + 0x1c], ebp
je 0x4aad8c
push fcn.004aa620
push fcn.004aa610
lea ebx, [eax + 4]
push edi
push 8
push ebx
mov dword [eax], edi
call fcn.00582693
mov dword [esp + 0x10], ebx
jmp 0x4aad92
mov dword [esp + 0x10], ebp
mov ebx, ebp
cmp ebx, ebp
mov dword [esp + 0x1c], 0xffffffff
jne 0x4aadb5
lea ecx, [esp + 0x24]
push 0x626528
push ecx
mov dword [esp + 0x2c], 0xc0000017
call int.00583592
mov eax, dword [esi + 0x34]
xor edi, edi
cmp eax, ebp
jle 0x4aade1
mov edx, dword [esi + 0x30]
mov ecx, ebx
lea ebp, [edx + edi*8]
push ebp
call fcn.0059e079
mov eax, dword [ebp + 4]
inc edi
mov dword [ebx + 4], eax
mov eax, dword [esi + 0x34]
add ebx, 8
cmp edi, eax
jl 0x4aadbe
mov ebx, dword [esp + 0x10]
mov eax, dword [esi + 0x30]
test eax, eax
je 0x4aae05
mov ecx, dword [eax - 4]
lea edi, [eax - 4]
push fcn.004aa620
push ecx
push 8
push eax
call fcn.005815a1
push edi
call fcn.0059a303
add esp, 4
mov dword [esi + 0x30], ebx
mov edx, dword [esi + 0x34]
mov eax, dword [esi + 0x30]
mov ebx, dword [esp + 0x24]
lea edi, [eax + edx*8]
push ebx
mov ecx, edi
call fcn.0059e079
mov ecx, dword [ebx + 4]
mov dword [edi + 4], ecx
mov eax, dword [esi + 0x34]
mov ecx, dword [esp + 0x14]
inc eax
mov dword [esi + 0x34], eax
mov esi, eax
pop edi
mov dword fs:[0], ecx
lea eax, [esi - 1]
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
Function at 0x4b4d10
Capabilities:
Identify system language via api

Disassembly:
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
and eax, 0xffff
mov ecx, esi
push eax
call fcn.004aea80
cmp ax, 9
jne 0x4b4d31
xor ax, ax
pop esi
ret
push ebx
push edi
mov edi, dword [esi + 0x58]
xor edx, edx
test edi, edi
jle 0x4b4d56
mov ecx, dword [esi + 0x54]
mov ebx, eax
and ebx, 0xffff
add ecx, 8
cmp dword [ecx], ebx
je 0x4b4d5f
inc edx
add ecx, 0x20
cmp edx, edi
jl 0x4b4d4a
pop edi
pop ebx
and eax, 0xffff
pop esi
ret
pop edi
pop ebx
xor eax, eax
pop esi
ret
Function at 0x4b6cb0
Capabilities:
Get file system object information

Disassembly:
push 0xffffffffffffffff
push 0x5bc646
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x174
push ebp
push edi
mov edi, ecx
push 0
mov dword [esp + 0xc], edi
call dword [sym.imp.ole32.dll_CoInitialize]
mov eax, dword [0x679a04]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov ebp, dword [edi + 0x14]
mov dword [esp + 0x184], 0
neg ebp
sbb ebp, ebp
test ebp, ebp
je 0x4b6e32
push ebx
push esi
cmp ebp, 0xffffffff
mov ecx, ebp
jne 0x4b6d25
mov esi, dword [edi + 0x10]
xor eax, eax
test esi, esi
jbe 0x4b6d25
mov edx, dword [edi + 0xc]
mov ecx, dword [edx]
test ecx, ecx
jne 0x4b6d25
inc eax
add edx, 4
cmp eax, esi
jb 0x4b6d17
mov ebp, dword [ecx]
test ebp, ebp
jne 0x4b6d4d
mov eax, dword [ecx + 4]
mov esi, dword [edi + 0x10]
lea edx, [edi + 8]
inc eax
cmp eax, esi
jae 0x4b6d4d
mov edx, dword [edx + 4]
lea edx, [edx + eax*4]
mov ebp, dword [edx]
test ebp, ebp
jne 0x4b6d4d
inc eax
add edx, 4
cmp eax, esi
jb 0x4b6d3f
mov ebx, dword [ecx + 8]
lea esi, [ecx + 0xc]
push esi
lea ecx, [esp + 0x18]
call fcn.0059e079
lea eax, [esi + 4]
lea ecx, [esp + 0x18]
push eax
call fcn.0059e079
mov esi, dword [esi + 8]
cmp esi, 0xffffffff
mov dword [esp + 0x1c], esi
jne 0x4b6e24
mov edx, dword [esp + 0x14]
mov ecx, 0x58
xor eax, eax
lea edi, [esp + 0x24]
rep stosd dword es:[edi], eax
push 0x4411
lea ecx, [esp + 0x28]
push 0x160
push ecx
push 0x80
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x20]
mov dword [esp + 0x1c], eax
lea esi, [edx + 8]
push ecx
push ebx
mov ecx, esi
call fcn.004b75b0
test eax, eax
jne 0x4b6e01
mov eax, dword [esi + 4]
test eax, eax
jne 0x4b6dda
mov eax, dword [esi + 8]
push 1
push eax
mov ecx, esi
call fcn.004a4580
mov ecx, esi
call fcn.004b7660
mov ecx, dword [esp + 0x20]
mov dword [eax + 8], ebx
mov dword [eax + 4], ecx
mov edx, dword [esi + 4]
mov ecx, dword [esp + 0x20]
mov edx, dword [edx + ecx*4]
mov dword [eax], edx
mov ecx, dword [esi + 4]
mov edx, dword [esp + 0x20]
mov dword [ecx + edx*4], eax
lea esi, [eax + 0xc]
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call fcn.0059e079
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esi + 4]
call fcn.0059e079
mov edx, dword [esp + 0x1c]
mov dword [esi + 8], edx
mov edi, dword [esp + 0x10]
test ebp, ebp
jne 0x4b6d04
pop esi
pop ebx
call dword [sym.imp.ole32.dll_CoUninitialize]
mov edi, dword [edi + 4]
test edi, edi
je 0x4b6e52
push 0
push 0x1446
push 0x111
push edi
call dword [sym.imp.USER32.dll_PostMessageA]
lea ecx, [esp + 0x10]
mov dword [esp + 0x184], 1
call fcn.0059df40
lea ecx, [esp + 0xc]
mov dword [esp + 0x184], 0xffffffff
call fcn.0059df40
mov ecx, dword [esp + 0x17c]
pop edi
pop ebp
mov dword fs:[0], ecx
add esp, 0x180
ret
Function at 0x4b88d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5bc839
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x5de870
lea ebx, [esi + 8]
push 0xffffffffffffffff
push 0
mov ecx, ebx
mov dword [esp + 0x24], 2
call fcn.00417bc0
lea edi, [esi + 0x1c]
push 0xffffffffffffffff
push 0
mov ecx, edi
call fcn.00417bc0
add esi, 0x30
push 0xffffffffffffffff
push 0
mov ecx, esi
call fcn.00417bc0
mov dword [esp + 0x10], esi
mov dword [esi], method.CCommandLineInfo.virtual_0
mov esi, dword [esi + 4]
mov byte [esp + 0x1c], 3
test esi, esi
je 0x4b8948
push esi
call fcn.0059a303
add esp, 4
mov dword [esp + 0x10], edi
mov dword [edi], method.CCommandLineInfo.virtual_0
mov edi, dword [edi + 4]
mov byte [esp + 0x1c], 4
test edi, edi
je 0x4b8967
push edi
call fcn.0059a303
add esp, 4
mov dword [esp + 0x10], ebx
mov dword [ebx], method.CCommandLineInfo.virtual_0
mov ebx, dword [ebx + 4]
mov dword [esp + 0x1c], 5
test ebx, ebx
je 0x4b8989
push ebx
call fcn.0059a303
add esp, 4
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x4bd910
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x5bced8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x64
mov edx, dword [0x67e58c]
lea eax, [esp + 4]
lea ecx, [esp]
push eax
push ecx
push 0
push 0
push str.bShTtRIT
push edx
mov dword [esp + 0x1c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4bd9a9
mov ecx, dword [0x67e58c]
lea eax, [esp]
push 4
push eax
push 4
push 0
push str.bShTtRIT
push ecx
mov dword [esp + 0x18], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x4bd9a9
push eax
lea ecx, [esp + 0xc]
call fcn.004fb510
lea ecx, [esp + 8]
mov dword [esp + 0x6c], 0
call fcn.00599ed3
lea ecx, [esp + 8]
mov dword [esp + 0x6c], 0xffffffff
call fcn.00599b14
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
add esp, 0x70
ret

Function at 0x4c0170
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov edx, dword [0x67e58c]
lea eax, [esp]
push esi
lea ecx, [esp + 8]
xor esi, esi
push eax
push ecx
push esi
push esi
push str.FSSettingsChecked
push edx
mov dword [esp + 0x1c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov eax, dword [esp + 8]
je 0x4c01a6
mov eax, esi
pop esi
add esp, 8
ret