joyce8/EMBER2024-capa huggingface dataset:
Function at 0x492d70
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
cmp dword [ebp + 8], 0
je 0x492d8e
cmp dword [ebp + 0xc], 0
je 0x492d8e
cmp dword [ebp + 0x10], 0
je 0x492d8e
cmp dword [ebp + 0x14], 0
jne 0x492d95
xor eax, eax
jmp 0x492eec
push 0
mov eax, dword [ebp + 8]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x492db0
xor eax, eax
jmp 0x492eec
mov ecx, dword [ebp - 4]
push ecx
call fcn.0050da48
add esp, 4
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x10], 0
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x492df0
jmp 0x492ed7
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x18]
push eax
push 0x54e144
mov ecx, dword [ebp - 0xc]
push ecx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x492e0f
jmp 0x492ed7
lea ecx, [ebp - 0x14]
call fcn.00406250
mov dword [ebp - 0x1c], 0
jmp 0x492e29
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp + 0xc]
jae 0x492ec0
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp + 0x10]
mov eax, dword [edx + ecx*4]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp + 0x14]
lea eax, [edx + ecx*4]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [edx]
shr eax, 0x10
and eax, 0xffff
movzx ecx, ax
push ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [edx]
and eax, 0xffff
movzx ecx, ax
push ecx
push str.StringFileInfo_04x_04x_s
lea edx, [ebp - 0x14]
push edx
call fcn.00403850
add esp, 0x14
mov dword [ebp - 0x28], 0
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00406180
push eax
lea ecx, [ebp - 0x14]
call fcn.004058f0
push eax
mov edx, dword [ebp - 0xc]
push edx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x492ebb
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x24]
call fcn.004057e0
jmp 0x492e20
mov dword [ebp - 8], 1
lea ecx, [ebp - 0x14]
call fcn.00406190
xor ecx, ecx
jne 0x492dc6
cmp dword [ebp - 0xc], 0
je 0x492ee9
mov edx, dword [ebp - 0xc]
push edx
call fcn.0050cb86
add esp, 4
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x493370
Capabilities:
Copy file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x878
mov eax, dword [0x579aa4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
push 0x104
lea ecx, [ebp - 0x460]
push ecx
call fcn.00405e80
push 0x54e260
push 0x104
lea edx, [ebp - 0x460]
push edx
call fcn.00405fa0
lea eax, [ebp - 0x258]
push eax
lea ecx, [ebp - 0x460]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x464], eax
cmp dword [ebp - 0x464], 0xffffffff
jne 0x4933d6
jmp 0x49353a
mov edx, dword [ebp + 0xc]
push edx
call fcn.0048fa00
add esp, 4
mov eax, dword [ebp + 0xc]
push eax
push 0x104
lea ecx, [ebp - 0x878]
push ecx
call fcn.00405e80
lea edx, [ebp - 0x878]
push edx
call fcn.0050c71f
add esp, 4
movzx eax, word [ebp + eax*2 - 0x878]
cmp eax, 0x5c
je 0x493429
push 0x54e26c
push 0x104
lea ecx, [ebp - 0x878]
push ecx
call fcn.00405fa0
lea edx, [ebp - 0x22c]
push edx
push 0x104
lea eax, [ebp - 0x878]
push eax
call fcn.00405fa0
mov ecx, dword [ebp + 8]
push ecx
push 0x104
lea edx, [ebp - 0x670]
push edx
call fcn.00405e80
lea eax, [ebp - 0x670]
push eax
call fcn.0050c71f
add esp, 4
movzx ecx, word [ebp + eax*2 - 0x670]
cmp ecx, 0x5c
je 0x493488
push 0x54e270
push 0x104
lea edx, [ebp - 0x670]
push edx
call fcn.00405fa0
lea eax, [ebp - 0x22c]
push eax
push 0x104
lea ecx, [ebp - 0x670]
push ecx
call fcn.00405fa0
mov edx, dword [ebp - 0x258]
and edx, 0x10
je 0x4934fb
cmp dword [ebp + 0x10], 0
je 0x4934f9
push 0x54e274
lea eax, [ebp - 0x22c]
push eax
call fcn.0050f9be
add esp, 8
test eax, eax
je 0x4934f9
push 0x54e278
lea ecx, [ebp - 0x22c]
push ecx
call fcn.0050f9be
add esp, 8
test eax, eax
je 0x4934f9
push 1
lea edx, [ebp - 0x878]
push edx
lea eax, [ebp - 0x670]
push eax
call fcn.00493370
add esp, 0xc
jmp 0x493511
push 0
lea ecx, [ebp - 0x878]
push ecx
lea edx, [ebp - 0x670]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea eax, [ebp - 0x258]
push eax
mov ecx, dword [ebp - 0x464]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4933e2
mov edx, dword [ebp - 0x464]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050c75f
mov esp, ebp
pop ebp
ret
Function at 0x4937d0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x579aa4]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x493805
xor eax, eax
jmp 0x493894
mov dword [ebp - 0x438], 0x428
lea ecx, [ebp - 0x438]
push ecx
mov edx, dword [ebp - 8]
push edx
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
jne 0x493831
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x493894
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x418]
push edx
call fcn.0050ed1f
add esp, 8
test eax, eax
jne 0x493873
lea eax, [ebp - 0x218]
push eax
call fcn.0050c71f
add esp, 4
add eax, 1
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x218]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.00405e80
jmp 0x493887
lea ecx, [ebp - 0x438]
push ecx
mov edx, dword [ebp - 8]
push edx
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x493831
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0050c75f
mov esp, ebp
pop ebp
ret

Function at 0x493ce0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x579aa4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x57ca40]
and eax, 1
jne 0x493d23
mov ecx, dword [0x57ca40]
or ecx, 1
mov dword [0x57ca40], ecx
mov ecx, 0x57ca3c
call fcn.00406250
push 0x54a540
call fcn.0050caef
add esp, 4
mov ecx, 0x57ca3c
call fcn.00406180
test eax, eax
jne 0x493e1f
xor edx, edx
mov word [ebp - 0x88], dx
push 0x7e
push 0
lea eax, [ebp - 0x86]
push eax
call fcn.0050c770
add esp, 0xc
push str.updatecfg.ini
push 0
lea ecx, [ebp - 0x8c]
push ecx
call fcn.00482cc0
add esp, 8
push eax
lea edx, [ebp - 0x90]
push edx
call fcn.00404ee0
add esp, 0xc
mov ecx, eax
call fcn.00406010
push eax
push 0x40
lea eax, [ebp - 0x88]
push eax
push 0
push 0x54e3d8
push 0x54e3e0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x90]
call fcn.00406190
lea ecx, [ebp - 0x8c]
call fcn.00406190
movzx ecx, word [ebp - 0x88]
test ecx, ecx
jne 0x493e0e
push 0x57ca3c
push str.SDVersion.dll
push 0
lea edx, [ebp - 0x94]
push edx
call fcn.00482cc0
add esp, 8
push eax
lea eax, [ebp - 0x98]
push eax
call fcn.00404ee0
add esp, 0xc
mov ecx, eax
call fcn.00406010
push eax
call fcn.0048be50
add esp, 8
lea ecx, [ebp - 0x98]
call fcn.00406190
lea ecx, [ebp - 0x94]
call fcn.00406190
jmp 0x493e1f
lea ecx, [ebp - 0x88]
push ecx
mov ecx, 0x57ca3c
call fcn.004057e0
push 0x57ca3c
mov ecx, dword [ebp + 8]
call fcn.00405e60
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050c75f
mov esp, ebp
pop ebp
ret
Function at 0x495ad0
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x648
mov eax, dword [0x579aa4]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x418], ax
push 0x206
push 0
lea ecx, [ebp - 0x416]
push ecx
call fcn.0050c770
add esp, 0xc
xor edx, edx
mov word [ebp - 0x628], dx
push 0x206
push 0
lea eax, [ebp - 0x626]
push eax
call fcn.0050c770
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x210], cx
push 0x206
push 0
lea edx, [ebp - 0x20e]
push edx
call fcn.0050c770
add esp, 0xc
lea eax, [ebp - 0x418]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [ebp - 0x630], eax
push 0x104
lea ecx, [ebp - 0x628]
push ecx
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
mov dword [ebp - 0x62c], eax
push 0x104
lea eax, [ebp - 0x210]
push eax
push str._userprofile_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x630], 0
je 0x495c1a
mov ecx, dword [ebp - 0x630]
sub ecx, 1
push ecx
mov ecx, dword [ebp + 8]
call fcn.00406010
push eax
lea edx, [ebp - 0x418]
push edx
call fcn.0050c679
add esp, 0xc
test eax, eax
jne 0x495c1a
mov ecx, dword [ebp + 8]
call fcn.00406180
sub eax, dword [ebp - 0x630]
push eax
lea eax, [ebp - 0x634]
push eax
mov ecx, dword [ebp + 8]
call fcn.0049b160
push eax
push 0x54f890
lea ecx, [ebp - 0x638]
push ecx
call fcn.0048c240
add esp, 0xc
push eax
mov ecx, dword [ebp + 8]
call fcn.00404a40
lea ecx, [ebp - 0x638]
call fcn.00406190
lea ecx, [ebp - 0x634]
call fcn.00406190
jmp 0x495d1e
cmp dword [ebp - 0x62c], 0
je 0x495c9d
mov edx, dword [ebp - 0x62c]
push edx
mov ecx, dword [ebp + 8]
call fcn.00406010
push eax
lea eax, [ebp - 0x628]
push eax
call fcn.0050c679
add esp, 0xc
test eax, eax
jne 0x495c9d
mov ecx, dword [ebp + 8]
call fcn.00406180
sub eax, dword [ebp - 0x62c]
push eax
lea ecx, [ebp - 0x63c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0049b160
push eax
push str._temp__
lea edx, [ebp - 0x640]
push edx
call fcn.0048c240
add esp, 0xc
push eax
mov ecx, dword [ebp + 8]
call fcn.00404a40
lea ecx, [ebp - 0x640]
call fcn.00406190
lea ecx, [ebp - 0x63c]
call fcn.00406190
jmp 0x495d1e
cmp dword [ebp - 0x41c], 0
je 0x495d1e
mov eax, dword [ebp - 0x41c]
sub eax, 1
push eax
mov ecx, dword [ebp + 8]
call fcn.00406010
push eax
lea ecx, [ebp - 0x210]
push ecx
call fcn.0050c679
add esp, 0xc
test eax, eax
jne 0x495d1e
mov ecx, dword [ebp + 8]
call fcn.00406180
sub eax, dword [ebp - 0x41c]
push eax
lea edx, [ebp - 0x644]
push edx
mov ecx, dword [ebp + 8]
call fcn.0049b160
push eax
push str._userprofile__
lea eax, [ebp - 0x648]
push eax
call fcn.0048c240
add esp, 0xc
push eax
mov ecx, dword [ebp + 8]
call fcn.00404a40
lea ecx, [ebp - 0x648]
call fcn.00406190
lea ecx, [ebp - 0x644]
call fcn.00406190
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050c75f
mov esp, ebp
pop ebp
ret
Function at 0x496df0
Capabilities:
Check if file exists
Copy file
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x579aa4]
xor eax, ebp
mov dword [ebp - 0xc], eax
xor eax, eax
mov word [ebp - 0x218], ax
push 0x206
push 0
lea ecx, [ebp - 0x216]
push ecx
call fcn.0050c770
add esp, 0xc
lea ecx, [ebp - 8]
call fcn.00406250
push 0x54fb9c
push 0
lea edx, [ebp - 0x21c]
push edx
call fcn.00482cc0
add esp, 8
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.00404ee0
add esp, 0xc
push eax
lea ecx, [ebp - 8]
call fcn.00404a40
lea ecx, [ebp - 0x220]
call fcn.00406190
lea ecx, [ebp - 0x21c]
call fcn.00406190
push str.repair.exe
lea ecx, [ebp - 0x224]
push ecx
call fcn.004976a0
add esp, 4
push eax
lea edx, [ebp - 4]
push edx
call fcn.00404ee0
add esp, 0xc
lea ecx, [ebp - 0x224]
call fcn.00406190
push 0
lea ecx, [ebp - 4]
call fcn.00406010
push eax
lea ecx, [ebp - 8]
call fcn.00406010
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [ebp - 8]
call fcn.00406010
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x496f8e
cmp dword [ebp + 8], 0
je 0x496edd
mov eax, dword [ebp + 8]
mov dword [ebp - 0x238], eax
jmp 0x496ee7
mov dword [ebp - 0x238], 0x54fc48
lea ecx, [ebp - 0x228]
push ecx
call fcn.0048ce30
add esp, 4
mov ecx, eax
call fcn.00406010
push eax
push 0x104
lea edx, [ebp - 0x218]
push edx
push str._URL:http:__pinst.qihucdn.com_360safebeta_safebeta_home.cab
mov eax, dword [ebp - 0x238]
push eax
push 0x54fc58
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x228]
call fcn.00406190
push 1
push 0
push 0x64
push 0
lea ecx, [ebp - 0x230]
push ecx
call fcn.00482cc0
add esp, 8
mov ecx, eax
call fcn.00406010
push eax
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 4]
call fcn.00406010
push eax
push 0
call fcn.0048ebf0
add esp, 0x1c
mov dword [ebp - 0x22c], eax
lea ecx, [ebp - 0x230]
call fcn.00406190
lea ecx, [ebp - 4]
call fcn.00406190
lea ecx, [ebp - 8]
call fcn.00406190
mov eax, dword [ebp - 0x22c]
jmp 0x496fae
mov dword [ebp - 0x234], 0
lea ecx, [ebp - 4]
call fcn.00406190
lea ecx, [ebp - 8]
call fcn.00406190
mov eax, dword [ebp - 0x234]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0050c75f
mov esp, ebp
pop ebp
ret
Function at 0x497590
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x579aa4]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x208
push 0
lea eax, [ebp - 0x210]
push eax
call fcn.0050c770
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x210]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.firstaidSuperKiller.exe
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x497613
lea edx, [ebp - 0x210]
push edx
mov ecx, dword [ebp + 8]
call fcn.00405520
mov eax, dword [ebp + 8]
jmp 0x497627
push str._firstaidSuperKiller.exe
mov eax, dword [ebp + 8]
push eax
call fcn.00497640
add esp, 8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050c75f
mov esp, ebp
pop ebp
ret

Function at 0x497700
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x15
call fcn.00497740
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x497725
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
mov dword [ebp - 8], eax
jmp 0x497732
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 4

Function at 0x4977a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0x130], 0
jb 0x497840
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x130]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x497840
push 8
call fcn.00497880
mov ecx, eax
call fcn.00497850
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x49782e
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
call dword [ebp - 0xc]
mov byte [ebp - 0xd], al
movzx ecx, byte [ebp - 0xd]
test ecx, ecx
je 0x49782e
cmp dword [ebp - 0x14], 0x10001049
jb 0x49782e
push 7
call fcn.00497880
mov ecx, eax
call fcn.00497850
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x49782e
push 1
call dword [ebp - 0x18]
push 1
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x49a270
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x49a328
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x49a328
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 4]
add eax, 1
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0050acfa
add esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [0x57c164], eax
cmp dword [0x57c164], 0
je 0x49a31e
push 0
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [0x57c164]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor edx, edx
mov eax, dword [ebp - 4]
mov ecx, dword [0x57c164]
mov word [ecx + eax*2], dx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x49a460
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0
push str.emalware.001
lea eax, [ebp - 0xc]
push eax
call fcn.0049a5c0
add esp, 4
or dword [ebp - 0x24], 1
push eax
lea ecx, [ebp - 0x10]
push ecx
call fcn.00404ee0
add esp, 0xc
or dword [ebp - 0x24], 2
mov ecx, eax
call fcn.00406010
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x49a525
push str.emalware.002
lea edx, [ebp - 0x14]
push edx
call fcn.0049a5c0
add esp, 4
or dword [ebp - 0x24], 4
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00404ee0
add esp, 0xc
or dword [ebp - 0x24], 8
mov ecx, eax
call fcn.00406010
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x49a525
push 0x5503e8
lea ecx, [ebp - 0x1c]
push ecx
call fcn.0049a5c0
add esp, 4
or dword [ebp - 0x24], 0x10
push eax
lea edx, [ebp - 0x20]
push edx
call fcn.00404ee0
add esp, 0xc
or dword [ebp - 0x24], 0x20
mov ecx, eax
call fcn.00406010
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x49a525
mov dword [ebp - 0x28], 0
jmp 0x49a52c
mov dword [ebp - 0x28], 1
mov al, byte [ebp - 0x28]
mov byte [ebp - 5], al
mov ecx, dword [ebp - 0x24]
and ecx, 0x20
je 0x49a546
and dword [ebp - 0x24], 0xffffffdf
lea ecx, [ebp - 0x20]
call fcn.00406190
mov edx, dword [ebp - 0x24]
and edx, 0x10
je 0x49a55a
and dword [ebp - 0x24], 0xffffffef
lea ecx, [ebp - 0x1c]
call fcn.00406190
mov eax, dword [ebp - 0x24]
and eax, 8
je 0x49a56e
and dword [ebp - 0x24], 0xfffffff7
lea ecx, [ebp - 0x18]
call fcn.00406190
mov ecx, dword [ebp - 0x24]
and ecx, 4
je 0x49a582
and dword [ebp - 0x24], 0xfffffffb
lea ecx, [ebp - 0x14]
call fcn.00406190
mov edx, dword [ebp - 0x24]
and edx, 2
je 0x49a596
and dword [ebp - 0x24], 0xfffffffd
lea ecx, [ebp - 0x10]
call fcn.00406190
mov eax, dword [ebp - 0x24]
and eax, 1
je 0x49a5aa
and dword [ebp - 0x24], 0xfffffffe
lea ecx, [ebp - 0xc]
call fcn.00406190
movzx ecx, byte [ebp - 5]
test ecx, ecx
je 0x49a5b9
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x49a600
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0
push str._savapi_vbase000.vdf
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.00482cc0
add esp, 8
or dword [ebp - 0x24], 1
push eax
lea ecx, [ebp - 0x10]
push ecx
call fcn.00404ee0
add esp, 0xc
or dword [ebp - 0x24], 2
mov ecx, eax
call fcn.00406010
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x49a6cb
push str._savapi_aeoffice.dll
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.00482cc0
add esp, 8
or dword [ebp - 0x24], 4
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00404ee0
add esp, 0xc
or dword [ebp - 0x24], 8
mov ecx, eax
call fcn.00406010
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x49a6cb
push str._savapi_aebb.dll
push 0
lea ecx, [ebp - 0x1c]
push ecx
call fcn.00482cc0
add esp, 8
or dword [ebp - 0x24], 0x10
push eax
lea edx, [ebp - 0x20]
push edx
call fcn.00404ee0
add esp, 0xc
or dword [ebp - 0x24], 0x20
mov ecx, eax
call fcn.00406010
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x49a6cb
mov dword [ebp - 0x28], 0
jmp 0x49a6d2
mov dword [ebp - 0x28], 1
mov al, byte [ebp - 0x28]
mov byte [ebp - 5], al
mov ecx, dword [ebp - 0x24]
and ecx, 0x20
je 0x49a6ec
and dword [ebp - 0x24], 0xffffffdf
lea ecx, [ebp - 0x20]
call fcn.00406190
mov edx, dword [ebp - 0x24]
and edx, 0x10
je 0x49a700
and dword [ebp - 0x24], 0xffffffef
lea ecx, [ebp - 0x1c]
call fcn.00406190
mov eax, dword [ebp - 0x24]
and eax, 8
je 0x49a714
and dword [ebp - 0x24], 0xfffffff7
lea ecx, [ebp - 0x18]
call fcn.00406190
mov ecx, dword [ebp - 0x24]
and ecx, 4
je 0x49a728
and dword [ebp - 0x24], 0xfffffffb
lea ecx, [ebp - 0x14]
call fcn.00406190
mov edx, dword [ebp - 0x24]
and edx, 2
je 0x49a73c
and dword [ebp - 0x24], 0xfffffffd
lea ecx, [ebp - 0x10]
call fcn.00406190
mov eax, dword [ebp - 0x24]
and eax, 1
je 0x49a750
and dword [ebp - 0x24], 0xfffffffe
lea ecx, [ebp - 0xc]
call fcn.00406190
movzx ecx, byte [ebp - 5]
test ecx, ecx
je 0x49a75f
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x49abd0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x579aa4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
je 0x49acd9
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 2]
cmp ecx, 0x5c
je 0x49ac05
mov edx, dword [ebp + 8]
movzx eax, word [edx + 4]
cmp eax, 0x5c
jne 0x49ac19
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x49acdb
xor edx, edx
mov word [ebp - 0x210], dx
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.0050c770
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.system32
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x49acd1
push 0x550554
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x550554
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
jmp 0x49acdb
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050c75f
mov esp, ebp
pop ebp
ret

Function at 0x49adb0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x57c924], 0
jne 0x49add2
mov dword [0x57c920], 0x11c
push 0x57c920
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [0x57c930], 2
jne 0x49aded
cmp dword [0x57c924], 6
jb 0x49aded
mov dword [ebp - 4], 1
jmp 0x49adf4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x49ae80
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
add eax, 8
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xb7
je 0x49aebe
mov ecx, dword [ebp - 4]
cmp dword [ecx + 4], 5
jne 0x49aedf
mov edx, dword [ebp - 4]
cmp dword [edx], 0
je 0x49aedb
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [edx], 0
xor al, al
jmp 0x49aee1
mov al, 1
mov esp, ebp
pop ebp
ret