joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ae480
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x20]
lea eax, [esp + 4]
push ebp
mov ebp, dword [esp + 0x28]
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x34]
push eax
push ebp
push ebx
push dword [esp + 0x34]
mov dword [esp + 0x20], edi
push esi
push dword [esp + 0x34]
call fcn.004acbb0
test al, al
je 0x4ae4c2
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x18
push esi
push dword [esp + 0x24]
call fcn.004aec30
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edi
test eax, eax
je 0x4ae508
lea ecx, [esp + 0x14]
push ecx
push ebx
lea ecx, [esp + 0x20]
push ecx
push 0
push dword [esp + 0x38]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x10]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4ae508
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x4ae530
push edi
test ebp, ebp
je 0x4ae523
push ebp
push ebx
call fcn.00504fb0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x18
push 0
push ebx
call fcn.00505530
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x18

Function at 0x4ae590
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x814
mov eax, dword [0x5513d4]
xor eax, esp
mov dword [esp + 0x810], eax
mov ecx, dword [esp + 0x820]
lea edx, [esp + 0x10]
mov eax, dword [esp + 0x81c]
push ebx
mov ebx, dword [esp + 0x82c]
push ebp
mov ebp, dword [esp + 0x820]
push esi
mov esi, dword [esp + 0x830]
push edi
push 0x400
push edx
push ecx
push eax
push ebp
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
call fcn.004ad250
test al, al
jne 0x4ae68d
mov edi, dword [esp + 0x83c]
push edi
push ebx
push esi
call fcn.0049ce90
cmp byte [0x54f429], 0
sete al
test al, al
jne 0x4ae6ab
push dword [esp + 0x14]
push ebp
call fcn.004aec30
mov ebp, eax
mov byte [esp + 0x13], 0
test ebp, ebp
je 0x4ae67f
lea eax, [esp + 0x14]
push eax
push esi
lea eax, [esp + 0x24]
push eax
push 0
push dword [esp + 0x28]
lea ecx, [edi + edi]
push ebp
mov dword [esp + 0x2c], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
push ebp
sete byte [esp + 0x17]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [esp + 0x13], 0
je 0x4ae67f
mov eax, dword [esp + 0x14]
shr eax, 1
test edi, edi
jne 0x4ae66c
xor eax, eax
mov word [esi], ax
mov al, byte [esp + 0x13]
jmp 0x4ae6ad
dec edi
cmp eax, edi
jb 0x4ae673
mov eax, edi
xor ecx, ecx
mov word [esi + eax*2], cx
mov al, byte [esp + 0x13]
jmp 0x4ae6ad
push edi
push ebx
push esi
call fcn.0049ce90
mov al, byte [esp + 0x13]
jmp 0x4ae6ad
lea eax, [esp + 0x20]
push eax
call fcn.004ace60
test eax, eax
je 0x4ae69d
mov ebx, eax
push dword [esp + 0x83c]
push ebx
push esi
call fcn.0049ce90
mov al, 1
mov ecx, dword [esp + 0x820]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00502f8e
add esp, 0x814
ret 0x18
Function at 0x4ae700
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x40c
mov eax, dword [0x5513d4]
xor eax, esp
mov dword [esp + 0x408], eax
mov eax, dword [esp + 0x414]
lea ecx, [esp + 8]
push ebx
mov ebx, dword [esp + 0x41c]
push esi
mov esi, dword [esp + 0x418]
push edi
push 0x200
push ecx
push eax
push esi
call fcn.004aebb0
test al, al
je 0x4ae793
lea eax, [esp + 0xc]
push eax
mov eax, dword [0x5997fc]
or eax, 9
push eax
push 0
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4ae793
mov edi, dword [esp + 0xc]
test edi, edi
je 0x4ae793
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
neg esi
sbb esi, esi
not esi
and esi, dword [esp + 0x10]
mov eax, esi
jmp 0x4ae795
xor eax, eax
mov ecx, dword [esp + 0x414]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00502f8e
add esp, 0x40c
ret 0xc
Function at 0x4ae7f0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x5b0
mov eax, dword [0x5513d4]
xor eax, esp
mov dword [esp + 0x5ac], eax
push ebx
mov ebx, dword [esp + 0x5b8]
push esi
mov esi, dword [esp + 0x5c0]
push 0xf
push str.SoftwareWinRAR
push esi
mov dword [esp + 0x2c], esi
call fcn.004a0630
test eax, eax
je 0x4ae830
xor al, al
jmp 0x4aea15
lea eax, [esp + 0x10]
push eax
push 0x20019
push 0
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4ae829
push edi
push 0x100000
call fcn.005097b7
mov edi, eax
add esp, 4
test edi, edi
jne 0x4ae86d
mov ecx, 0x58c304
call fcn.0046db90
xor al, al
jmp 0x4aea14
push ebp
lea eax, [esp + 0x1c]
mov dword [esp + 0x10], 0x200
push eax
push edi
lea eax, [esp + 0x1c]
mov dword [esp + 0x24], 0x100000
push eax
xor ebp, ebp
lea eax, [esp + 0x1c]
push ebp
push eax
lea eax, [esp + 0x1d0]
push eax
push ebp
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x4ae96f
lea eax, [esi + 0x1e]
mov dword [esp + 0x20], eax
mov esi, eax
cmp word [esi], 0x5c
jne 0x4ae8be
add esi, 2
mov eax, dword [esp + 0x14]
cmp eax, 3
jne 0x4ae8df
push dword [esp + 0x1c]
lea eax, [esp + 0x1c0]
push edi
push eax
push esi
push ebx
call fcn.004ad4a0
mov eax, dword [esp + 0x14]
cmp eax, 4
jne 0x4ae8fb
push 0
push dword [edi]
lea eax, [esp + 0x1c4]
push eax
push esi
push ebx
call fcn.004ad580
mov eax, dword [esp + 0x14]
cmp eax, 0xb
jne 0x4ae918
push dword [edi + 4]
lea eax, [esp + 0x1c0]
push dword [edi]
push eax
push esi
push ebx
call fcn.004ad580
mov eax, dword [esp + 0x14]
cmp eax, 1
jne 0x4ae92d
push edi
lea eax, [esp + 0x1c0]
push eax
push esi
push ebx
call fcn.004ad410
lea eax, [esp + 0x1c]
mov dword [esp + 0x10], 0x200
push eax
push edi
lea eax, [esp + 0x1c]
mov dword [esp + 0x24], 0x100000
push eax
push 0
lea eax, [esp + 0x20]
inc ebp
push eax
lea eax, [esp + 0x1d0]
push eax
push ebp
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
mov eax, dword [esp + 0x20]
je 0x4ae8b3
push edi
call fcn.005097b2
add esp, 4
mov dword [esp + 0x10], 0xc8
xor esi, esi
lea eax, [esp + 0x20]
push eax
push esi
push esi
push esi
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x40]
push eax
push esi
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
pop ebp
test eax, eax
jne 0x4aea03
mov edi, dword [esp + 0x24]
jmp 0x4ae9b0
push 0x200
lea eax, [esp + 0x1bc]
push eax
lea eax, [esp + 0x30]
push eax
push edi
call fcn.00484d90
lea eax, [esp + 0x1b8]
push eax
push ebx
call fcn.004ae7f0
lea eax, [esp + 0x1c]
mov dword [esp + 0xc], 0xc8
push eax
push 0
push 0
push 0
lea eax, [esp + 0x1c]
inc esi
push eax
lea eax, [esp + 0x3c]
push eax
push esi
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x4ae9b0
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4aea12
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop edi
mov ecx, dword [esp + 0x5b4]
pop esi
pop ebx
xor ecx, esp
call fcn.00502f8e
add esp, 0x5b0
ret 8
Function at 0x4aeee0
Capabilities:
Set registry value

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x14]
push edi
push dword [esp + 0x20]
mov edi, dword [esp + 0x18]
push dword [esp + 0x20]
push esi
push edi
push dword [esp + 0x20]
call fcn.004ad580
test al, al
je 0x4aef0a
pop edi
xor eax, eax
pop esi
pop ecx
ret 0x14
lea eax, [esp + 8]
push eax
push edi
push dword [esp + 0x18]
call fcn.004ad9c0
mov edi, eax
test edi, edi
je 0x4aef43
push 8
lea eax, [esp + 0x20]
push eax
push 0xb
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ecx
ret 0x14
mov esi, dword [esp + 8]
mov eax, esi
pop edi
pop esi
pop ecx
ret 0x14

Function at 0x4aef70
Capabilities:
Set registry value

Disassembly:
sub esp, 0x808
mov eax, dword [0x5513d4]
xor eax, esp
mov dword [esp + 0x804], eax
push ebx
mov ebx, dword [esp + 0x814]
lea eax, [esp + 8]
push ebp
mov ebp, dword [esp + 0x81c]
push esi
mov esi, dword [esp + 0x824]
push edi
mov edi, dword [esp + 0x81c]
push 0x400
push eax
push ebp
push ebx
push edi
call fcn.004ad250
test al, al
jne 0x4af019
cmp byte [0x54f429], al
sete al
test al, al
jne 0x4af026
lea eax, [esp + 0x10]
push eax
push ebx
push edi
call fcn.004ad9c0
mov edi, eax
test edi, edi
je 0x4af011
mov ecx, esi
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4aefe0
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push esi
push 1
push 0
push ebp
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x4af028
mov esi, dword [esp + 0x10]
mov eax, esi
jmp 0x4af028
push 1
push esi
lea eax, [esp + 0x1c]
push eax
call fcn.004ac350
xor eax, eax
mov ecx, dword [esp + 0x814]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00502f8e
add esp, 0x808
ret 0x10
Function at 0x4af190
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x10]
lea eax, [esp + 4]
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push eax
push esi
mov edi, ecx
mov dword [esp + 0x18], 0
call fcn.004af4d0
test eax, eax
je 0x4af1bf
pop edi
pop esi
xor al, al
pop ebp
pop ecx
ret 8
push ebx
push ebp
lea eax, [esp + 0x14]
mov ecx, edi
push eax
push esi
call fcn.004af4d0
mov dword [edi + 0x10], eax
mov ecx, edi
push ebp
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004af4d0
mov dword [edi + 0x18], eax
mov ecx, edi
push ebp
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004af4d0
mov dword [edi + 0x1c], eax
mov ecx, edi
push ebp
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004af4d0
mov dword [edi + 0x20], eax
mov ecx, edi
push ebp
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004af4d0
mov dword [edi + 0x24], eax
mov ecx, edi
push ebp
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004af4d0
push ebp
mov dword [edi + 0x28], eax
mov ecx, edi
lea eax, [esp + 0x14]
push eax
push esi
push 0x100
lea eax, [edi + 0x2c]
push eax
call fcn.004af530
push ebp
lea eax, [esp + 0x14]
mov ecx, edi
push eax
push esi
call fcn.004af4d0
push ebp
mov dword [edi + 0x12c], eax
mov ecx, edi
lea eax, [esp + 0x14]
push eax
push esi
push 0x100
lea eax, [edi + 0x130]
push eax
call fcn.004af530
push ebp
lea eax, [esp + 0x14]
mov ecx, edi
push eax
push esi
call fcn.004af4d0
mov dword [edi + 0x230], eax
lea eax, [esp + 0x10]
push ebp
push eax
push esi
push 0x100
lea eax, [edi + 0x234]
push eax
mov ecx, edi
call fcn.004af530
push ebp
lea eax, [esp + 0x14]
mov ecx, edi
push eax
push esi
call fcn.004af4d0
mov dword [edi + 0x334], eax
mov ecx, edi
push ebp
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004af4d0
mov dword [edi + 0x338], eax
mov ecx, edi
push ebp
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004af4d0
push ebp
mov dword [edi + 0x33c], eax
mov ecx, edi
lea eax, [esp + 0x14]
push eax
push esi
push 0x20
lea eax, [edi + 0x340]
push eax
call fcn.004af530
push ebp
lea eax, [esp + 0x14]
mov ecx, edi
push eax
push esi
push 0x100
lea eax, [edi + 0x380]
push eax
call fcn.004af530
mov ecx, dword [esp + 0x10]
xor bl, bl
xor eax, eax
test ecx, ecx
je 0x4af31a
xor bl, byte [eax + esi]
inc eax
cmp eax, ecx
jb 0x4af312
push ebp
lea eax, [esp + 0x14]
mov ecx, edi
push eax
push esi
call fcn.004af4d0
movzx ecx, bl
xor edx, edx
pop ebx
pop edi
cmp ecx, eax
pop esi
sete al
pop ebp
pop ecx
ret 8

Function at 0x4af5b0
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, ecx
xor ecx, ecx
xor esi, esi
jmp 0x4af5c0
xor byte [esi + edi], cl
mov eax, 0xaaaaaaab
mul ecx
add ecx, 3
inc esi
shr edx, 1
add ecx, edx
and ecx, 0xffffff
cmp esi, 0x480
jb 0x4af5c0
pop edi
pop esi
ret
Function at 0x4b14d0
Capabilities:
Create process on windows
Query environment variable

Disassembly:
mov eax, 0x4324
call fcn.00502fa0
mov eax, dword [0x5513d4]
xor eax, esp
mov dword [esp + 0x4320], eax
push esi
push edi
mov edi, dword [esp + 0x4330]
push edi
call fcn.00484630
mov esi, eax
test esi, esi
je 0x4b16f0
push 0xc8
push 0x52452c
lea eax, [esp + 0x10]
push eax
push 0x52452c
push esi
push SysReAllocString
call fcn.004ae590
cmp word [esp + 8], 0
je 0x4b16f0
push 0xc8
push str._shellprintcommand
lea eax, [esp + 0x10]
push eax
call fcn.0049ce50
push 0x800
push 0x52452c
lea eax, [esp + 0x330]
push eax
push 0x52452c
lea eax, [esp + 0x18]
push eax
push SysReAllocString
call fcn.004ae590
cmp word [esp + 0x328], 0
jne 0x4b1619
push esi
push str.SoftwareClasses_s
lea eax, [esp + 0x1a0]
push 0xc8
push eax
call fcn.004027c0
add esp, 0x10
lea eax, [esp + 8]
push 0xc8
push 0x52452c
push eax
push 0x52452c
lea eax, [esp + 0x1a8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004ae590
cmp word [esp + 8], 0
je 0x4b16f0
lea eax, [esp + 8]
push eax
push str.SoftwareClasses_s_shellprintcommand
lea eax, [esp + 0x1a0]
push 0xc8
push eax
call fcn.004027c0
add esp, 0x10
lea eax, [esp + 0x328]
push 0x800
push 0x52452c
push eax
push 0x52452c
lea eax, [esp + 0x1a8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004ae590
cmp word [esp + 0x328], 0
je 0x4b16f0
push 0x1000
lea eax, [esp + 0x232c]
push eax
lea eax, [esp + 0x330]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x4b16f0
cmp eax, 0x1000
jae 0x4b16f0
lea eax, [esp + 0x2328]
push 0x5338b4
push eax
call fcn.00505b13
add esp, 8
test eax, eax
je 0x4b16f0
push ebx
lea ecx, [esp + 0x232c]
xor bl, bl
cmp eax, ecx
jbe 0x4b167b
cmp word [eax - 2], 0x22
jne 0x4b167b
mov bl, 1
xor ecx, ecx
push 0x1000
mov word [eax], cx
lea eax, [esp + 0x2330]
push edi
push eax
call fcn.0049ce50
test bl, bl
pop ebx
je 0x4b16af
push 0x1000
push 0x5333dc
lea eax, [esp + 0x2330]
push eax
call fcn.0049ce50
push 0x800
lea eax, [esp + 0x132c]
push eax
lea eax, [esp + 0x2330]
push eax
call fcn.0049c630
push 8
push 0
push eax
lea eax, [esp + 0x1334]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 0x20
cmp ecx, eax
sbb eax, eax
neg eax
jmp 0x4b16f2
xor al, al
mov ecx, dword [esp + 0x4328]
pop edi
pop esi
xor ecx, esp
call fcn.00502f8e
add esp, 0x4324
ret 4
Function at 0x4b1e10
Capabilities:
Write file on windows

Disassembly:
mov eax, 0xa808
call fcn.00502fa0
mov eax, dword [0x5513d4]
xor eax, esp
mov dword [esp + 0xa804], eax
push esi
mov esi, dword [esp + 0xa810]
lea eax, [esp + 0xa81c]
push eax
push 0
push dword [esp + 0xa820]
lea eax, [esp + 0x1810]
push 0x1800
push eax
call fcn.004027b0
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.0050942c
xor eax, eax
add esp, 0x1c
mov word [esp + 0x4802], ax
mov eax, dword [esp + 0xa814]
sub eax, 0
je 0x4b1edc
sub eax, 1
je 0x4b1eb3
sub eax, 1
jne 0x4b1f1d
push 0x1800
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x180c]
push eax
call fcn.004a0240
lea ecx, [esp + 4]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4b1ea6
lea eax, [esp + 4]
jmp 0x4b1f0e
lea ecx, [esp + 0x1804]
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b1ec0
sub ecx, edx
lea eax, [esp + 0x1804]
push esi
sar ecx, 1
push ecx
push 2
jmp 0x4b1f14
push 0x6000
lea eax, [esp + 0x480c]
push eax
lea eax, [esp + 0x180c]
push eax
call fcn.004a02c0
lea ecx, [esp + 0x4808]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4b1f00
lea eax, [esp + 0x4808]
push esi
sub ecx, edx
push ecx
push 1
push eax
call fcn.0050a0c5
add esp, 0x10
mov ecx, dword [esp + 0xa808]
pop esi
xor ecx, esp
call fcn.00502f8e
add esp, 0xa808
ret
Function at 0x4b2e30
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x408
mov eax, dword [0x5513d4]
xor eax, esp
mov dword [esp + 0x404], eax
mov eax, dword [esp + 0x410]
push ebp
mov ebp, dword [esp + 0x410]
push esi
push edi
push 0x526a10
push eax
mov esi, ecx
call fcn.004d6190
mov edi, eax
test edi, edi
sete cl
mov byte [esi + 0x3028], cl
test cl, cl
jne 0x4b2fa3
push edi
call fcn.0050e974
add esp, 4
cmp eax, 0x42
jne 0x4b2f9a
push edi
call fcn.0050e974
add esp, 4
cmp eax, 0x4d
jne 0x4b2f9a
push ebx
push 0
push 2
push edi
call fcn.0050d9a9
push edi
push 1
lea eax, [esp + 0x24]
push 4
push eax
call fcn.0050d63f
mov eax, dword [esp + 0x2c]
sub eax, 0xe
push eax
mov dword [esp + 0x30], eax
call fcn.005097b7
mov ebx, eax
add esp, 0x20
test ebx, ebx
jne 0x4b2ef5
push edi
call fcn.00509ce0
add esp, 4
xor al, al
pop ebx
mov ecx, dword [esp + 0x410]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00502f8e
add esp, 0x408
ret 8
push 0
push 0xe
push edi
call fcn.0050d9a9
push edi
push dword [esp + 0x20]
push 1
push ebx
call fcn.0050d63f
add esp, 0x1c
cmp eax, dword [esp + 0x10]
je 0x4b2f65
push str.BMP__PNG
push 0x686
call fcn.00496b20
push eax
lea eax, [esp + 0x1c]
push 0x200
push eax
call fcn.004027c0
add esp, 0x10
push 0x10
push 0x66
call fcn.00496b20
push eax
lea eax, [esp + 0x1c]
push eax
push dword [0x558aa8]
call fcn.004d6c50
push ebx
call fcn.005097b2
push edi
call fcn.00509ce0
add esp, 8
jmp 0x4b2ed8
push edi
call fcn.00509ce0
add esp, 4
push dword [esp + 0x10]
push ebx
push 0x400
push 0x65
push 2
push ebp
call dword [sym.imp.KERNEL32.dll_UpdateResourceW]
push ebx
mov esi, eax
call fcn.005097b2
xor eax, eax
add esp, 4
test esi, esi
setne al
jmp 0x4b2eda
push edi
call fcn.00509ce0
add esp, 4
xor al, al
jmp 0x4b2edb
Function at 0x4b34a0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov eax, 0x2004
call fcn.00502fa0
mov eax, dword [0x5513d4]
xor eax, esp
mov dword [esp + 0x2000], eax
mov eax, dword [esp + 0x2008]
push ebx
mov ebx, dword [esp + 0x2010]
push esi
push edi
push 0x526a10
push eax
mov esi, ecx
call fcn.004d6190
mov edi, eax
test edi, edi
sete cl
mov byte [esi + 0x3028], cl
test cl, cl
je 0x4b34eb
xor al, al
jmp 0x4b3536
push edi
push 0x2000
lea eax, [esp + 0x14]
push 1
push eax
call fcn.0050d63f
add esp, 0x10
test eax, eax
je 0x4b352b
push ebx
push eax
lea eax, [esp + 0x14]
push 1
push eax
call fcn.0050a0c5
push edi
push 0x2000
lea eax, [esp + 0x24]
push 1
push eax
call fcn.0050d63f
add esp, 0x20
test eax, eax
jne 0x4b3504
push edi
call fcn.00509ce0
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x200c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00502f8e
add esp, 0x2004
ret 8

Function at 0x4b3550
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov eax, 0x2008
call fcn.00502fa0
mov eax, dword [0x5513d4]
xor eax, esp
mov dword [esp + 0x2004], eax
mov eax, dword [esp + 0x200c]
push ebp
push esi
push 0x533d08
push eax
mov esi, ecx
call fcn.004d6190
mov ebp, eax
test ebp, ebp
sete cl
mov byte [esi + 0x3028], cl
test cl, cl
je 0x4b3596
xor al, al
jmp 0x4b363c
push ebx
push edi
push ebp
xor eax, eax
push 0x2000
mov dword [esp + 0x18], eax
lea eax, [esp + 0x1c]
push 1
push eax
call fcn.0050d63f
mov ebx, eax
add esp, 0x10
cmp ebx, 0x20
jbe 0x4b362f
lea ebx, [ebx]
lea edi, [ebx - 0x20]
xor esi, esi
test edi, edi
jle 0x4b35fd
lea esp, [esp]
cmp byte [esp + esi + 0x14], 0x61
jne 0x4b35f8
cmp byte [esp + esi + 0x15], 0x73
jne 0x4b35f8
push 0x14
lea eax, [esp + 0x1a]
add eax, esi
push str.Invoker_
push eax
call fcn.0050a6e0
add esp, 0xc
test eax, eax
je 0x4b3655
inc esi
cmp esi, edi
jl 0x4b35d0
mov eax, dword [esp + 0x10]
add eax, 0xffffffe0
add eax, ebx
push 0
push eax
push ebp
mov dword [esp + 0x1c], eax
call fcn.0050d9a9
push ebp
push 0x2000
lea eax, [esp + 0x28]
push 1
push eax
call fcn.0050d63f
mov ebx, eax
add esp, 0x1c
cmp ebx, 0x20
ja 0x4b35c0
push ebp
call fcn.00509ce0
add esp, 4
xor al, al
pop edi
pop ebx
mov ecx, dword [esp + 0x200c]
pop esi
pop ebp
xor ecx, esp
call fcn.00502f8e
add esp, 0x2008
ret 4
mov eax, dword [esp + 0x10]
push 0
add eax, esi
push eax
push ebp
call fcn.0050d9a9
push ebp
push 0x15
push 1
push str.requireAdministrator_
call fcn.0050a0c5
cmp eax, 0x15
push ebp
sete bl
call fcn.00509ce0
add esp, 0x20
mov al, bl
jmp 0x4b363a
Function at 0x4b3c40
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x200c
call fcn.00502fa0
mov eax, dword [0x5513d4]
xor eax, esp
mov dword [esp + 0x2008], eax
mov eax, dword [esp + 0x2010]
push edi
push 0x526a10
push eax
call fcn.00475430
mov edi, eax
mov dword [esp + 8], edi
test edi, edi
jne 0x4b3c8f
xor al, al
pop edi
mov ecx, dword [esp + 0x2008]
xor ecx, esp
call fcn.00502f8e
add esp, 0x200c
ret 4
push ebp
xor ebp, ebp
push ebx
mov dword [esp + 0xc], ebp
push esi
jmp 0x4b3ca0
push edi
push 0x2000
lea eax, [esp + 0x20]
push 1
push eax
call fcn.0050d63f
mov ebx, eax
add esp, 0x10
cmp ebx, 0x20
jle 0x4b3d16
lea edi, [ebx - 0x20]
xor esi, esi
test edi, edi
jle 0x4b3cf0
cmp byte [esp + esi + 0x18], 0x72
jne 0x4b3ceb
cmp byte [esp + esi + 0x19], 0x65
jne 0x4b3ceb
push 0x14
lea eax, [esp + esi + 0x1e]
push str.quireAdministrator_
push eax
call fcn.0050a6e0
add esp, 0xc
test eax, eax
je 0x4b3d3c
inc esi
cmp esi, edi
jl 0x4b3cc5
mov edi, dword [esp + 0x14]
add ebp, 0xffffffe0
push 0
add ebp, ebx
push ebp
push edi
call fcn.0050d9a9
mov esi, dword [esp + 0x1c]
add esp, 0xc
inc esi
mov dword [esp + 0x10], esi
cmp esi, 0x100
jb 0x4b3ca0
push edi
call fcn.00509ce0
add esp, 4
xor al, al
mov ecx, dword [esp + 0x2018]
pop esi
pop ebx
pop ebp
pop edi
xor ecx, esp
call fcn.00502f8e
add esp, 0x200c
ret 4
push dword [esp + 0x14]
call fcn.00509ce0
add esp, 4
mov al, 1
jmp 0x4b3d21

Function at 0x4b3d50
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x404
mov eax, dword [0x5513d4]
xor eax, esp
mov dword [esp + 0x400], eax
mov eax, dword [esp + 0x408]
push esi
push edi
push 0x526a10
push eax
mov esi, ecx
call fcn.004d6190
mov edi, eax
test edi, edi
sete cl
mov byte [esi + 0x3028], cl
test cl, cl
je 0x4b3d8f
mov al, 1
jmp 0x4b3dd8
push edi
push 0x400
lea eax, [esp + 0x10]
push 1
push eax
call fcn.0050d63f
push edi
mov esi, eax
call fcn.00509ce0
add esi, 0xfffffffc
add esp, 0x14
xor eax, eax
test esi, esi
jle 0x4b3dd6
cmp byte [esp + eax + 8], 0x55
jne 0x4b3dd1
cmp byte [esp + eax + 9], 0x50
jne 0x4b3dd1
cmp byte [esp + eax + 0xa], 0x58
jne 0x4b3dd1
cmp byte [esp + eax + 0xb], 0x30
je 0x4b3d8b
inc eax
cmp eax, esi
jl 0x4b3db5
xor al, al
mov ecx, dword [esp + 0x408]
pop edi
pop esi
xor ecx, esp
call fcn.00502f8e
add esp, 0x404
ret 4