joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a58e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f4508
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x67d070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea ebx, [edi + 4]
mov dword [edi], 0
mov dword [ebx], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [ebp - 0x18], 0x104
mov dword [ebp - 0x1c], 0
call fcn.004a5690
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x4a5954
push 0x80004005
call fcn.00420bc0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0
push eax
push 0x20019
push 0
push 0x622898
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a5a4f
mov edx, dword [ebp - 0x18]
test edx, edx
jns 0x4a599c
push 0x80070057
call fcn.00420bc0
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x4a59b9
push edx
lea ecx, [ebp - 0x14]
call fcn.004a64b0
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push eax
push esi
push 0
push 0
push str.svcVersion
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4a5a1d
mov ecx, dword [ebp - 0x18]
test ecx, ecx
jns 0x4a59e5
push 0x80070057
call fcn.00420bc0
mov eax, dword [esi - 8]
mov edx, 1
sub edx, dword [esi - 4]
sub eax, ecx
or eax, edx
jge 0x4a5a02
push ecx
lea ecx, [ebp - 0x14]
call fcn.004a64b0
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push eax
push esi
push 0
push 0
push str.Version
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4a5a46
cmp dword [ebp - 0x18], 0
jbe 0x4a5a46
lea eax, [edi + 0xc]
push eax
lea eax, [edi + 8]
push eax
push ebx
push edi
push str._d._d._d._d
push esi
call fcn.00409a20
add esp, 0x18
cmp eax, 4
je 0x4a5a46
mov dword [edi], 0
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4a5a6e
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00599c70
mov esp, ebp
pop ebp
ret
Function at 0x4ae860
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x67d070]
xor eax, ebp
mov dword [ebp - 4], eax
add ecx, 0x4c
mov word [ebp - 8], 0
mov dword [ebp - 0xc], 0
cmp dword [ecx + 0x14], 8
jb 0x4ae888
mov ecx, dword [ecx]
push str.rb__ccsUTF_8
push ecx
lea eax, [ebp - 0xc]
push eax
call fcn.005c99cb
mov eax, dword [ebp - 0xc]
add esp, 0xc
test eax, eax
je 0x4ae8f5
push eax
push 2
lea eax, [ebp - 8]
push 1
push eax
call fcn.005cd8e4
push dword [ebp - 0xc]
call fcn.005c9aaa
mov cl, byte [ebp - 8]
add esp, 0x14
mov al, byte [ebp - 7]
cmp cl, 0xff
jne 0x4ae8c9
cmp al, 0xfe
je 0x4ae8d2
cmp al, 0xff
jne 0x4ae8e5
cmp cl, 0xfe
jne 0x4ae8e5
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00599c70
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00599c70
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
call fcn.00599c70
mov esp, ebp
pop ebp
ret

Function at 0x4ae910
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [0x67d070]
xor eax, esp
mov dword [esp + 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x8c], 1
jne 0x4ae958
call fcn.004ae860
test al, al
jne 0x4ae958
mov eax, dword [ebx]
test eax, eax
je 0x4ae951
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [ebx], 0
mov ecx, edi
call fcn.004b05a0
lea esi, [edi + 0x4c]
mov dl, 1
mov ecx, esi
call fcn.004b9af0
test eax, eax
je 0x4ae985
cmp eax, 1
jne 0x4ae98f
push 0
mov dl, al
mov ecx, esi
call fcn.0049de10
add esp, 4
test al, al
je 0x4ae98f
mov dword [ebx], 0xffffffff
cmp dword [esi + 0x14], 8
jb 0x4ae9a5
mov eax, dword [esi]
jmp 0x4ae9a7
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00599c70
mov esp, ebp
pop ebp
ret 4
mov eax, esi
push 0
push 0x200080
push 3
push 0
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov dword [ebx], eax
cmp eax, 0xffffffff
jne 0x4aea29
cmp dword [esi + 0x14], 8
jb 0x4ae9cf
mov esi, dword [esi]
push 0
push 0x200080
push 1
push 0
push 3
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov dword [ebx], eax
cmp eax, 0xffffffff
je 0x4ae98f
cmp dword [edi + 0x8c], 1
lea ecx, [esp + 0x10]
push 0
push ecx
jne 0x4aea0f
mov dword [esp + 0x14], 0xfeff
lea ecx, [esp + 0x14]
push 2
jmp 0x4aea21
mov word [esp + 0x14], 0xbbef
lea ecx, [esp + 0x14]
mov byte [esp + 0x16], 0xbf
push 3
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov ecx, dword [esp + 0x14]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00599c70
mov esp, ebp
pop ebp
ret 4
Function at 0x4aea40
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f5126
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x67d070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4aeb04
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x260]
call fcn.00406e60
xor bl, bl
lea eax, [ebp - 0x260]
cmp dword [ebp - 0x24c], 8
push 0
cmovae eax, dword [ebp - 0x260]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
je 0x4aead9
cmp eax, 0xb7
je 0x4aead9
cmp eax, 0x50
jne 0x4aeadb
mov bl, 1
mov eax, dword [ebp - 0x24c]
cmp eax, 8
jb 0x4aeaf9
inc eax
lea ecx, [ebp - 0x260]
push eax
push dword [ebp - 0x260]
call fcn.00407b40
test bl, bl
jne 0x4aeb04
xor al, al
jmp 0x4aec22
xor eax, eax
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
cmp word [ebp - 0x218], ax
jne 0x4aeb2e
xor ecx, ecx
jmp 0x4aeb46
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4aeb37
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00407060
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0x234], 7
mov dword [ebp - 0x238], 0
mov word [ebp - 0x248], ax
cmp word [esi], ax
jne 0x4aeb86
xor ecx, ecx
jmp 0x4aeb9f
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4aeb90
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x248]
call fcn.00407060
lea edx, [ebp - 0x248]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x230]
call fcn.004d64a0
mov byte [ebp - 4], 0
mov bl, al
mov ecx, dword [ebp - 0x234]
cmp ecx, 8
jb 0x4aebe5
inc ecx
push ecx
push dword [ebp - 0x248]
lea ecx, [ebp - 0x248]
call fcn.00407b40
test bl, bl
je 0x4aec02
lea ecx, [edi + 0x4c]
lea eax, [ebp - 0x230]
cmp ecx, eax
je 0x4aec00
push 0xffffffffffffffff
push 0
push eax
call fcn.00407550
mov bl, 1
mov ecx, dword [ebp - 0x21c]
cmp ecx, 8
jb 0x4aec20
inc ecx
push ecx
push dword [ebp - 0x230]
lea ecx, [ebp - 0x230]
call fcn.00407b40
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00599c70
mov esp, ebp
pop ebp
ret 4
Function at 0x4aee50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x67d070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
mov esi, edi
lea ecx, [esi + 2]
nop dword [eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4aee70
push 2
push 0
push 0
push dword [ebx + 0x68]
sub esi, ecx
sar esi, 1
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
add esi, esi
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_WriteFile]
push edi
push dword [ebx + 0x68]
call esi
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 4
push 0x640170
push dword [ebx + 0x68]
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00599c70
mov esp, ebp
pop ebp
ret 4

Function at 0x4aeee0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x67d070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
mov esi, edi
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x4aef00
push 2
push 0
push 0
push dword [ebx + 0x68]
sub esi, ecx
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_WriteFile]
push edi
push dword [ebx + 0x68]
call esi
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 2
push 0x640144
push dword [ebx + 0x68]
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00599c70
mov esp, ebp
pop ebp
ret 4
Function at 0x4b05a0
Capabilities:
Check if file exists
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f53c0
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x67d070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor eax, eax
mov dword [ebp - 0x14], 7
push 0xffffffffffffffff
push eax
lea esi, [edi + 0x4c]
mov dword [ebp - 0x18], 0
push esi
lea ecx, [ebp - 0x28]
mov word [ebp - 0x28], ax
call fcn.00407550
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.004d6550
xor eax, eax
mov dword [ebp - 0x44], 7
mov dword [ebp - 0x48], 0
mov word [ebp - 0x58], ax
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
call fcn.004d62f0
lea eax, [ebp - 0x58]
mov edx, 0x622944
push eax
lea ecx, [ebp - 0x70]
call fcn.0042b470
add esp, 4
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.00408dc0
mov eax, dword [ebp - 0x5c]
cmp eax, 8
jb 0x4b0659
inc eax
lea ecx, [ebp - 0x70]
push eax
push dword [ebp - 0x70]
call fcn.00407b40
xor eax, eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
lea edx, [ebp - 0x40]
mov byte [ebp - 4], 3
mov ecx, esi
call fcn.004d67e0
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.004d65e0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
je 0x4b06f0
mov dl, 1
mov ecx, esi
call fcn.004b9af0
test eax, eax
jne 0x4b06f0
cmp dword [esi + 0x10], eax
je 0x4b06f0
cmp dword [ebp - 0x18], eax
je 0x4b06f0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
cmp dword [esi + 0x14], 8
jb 0x4b06c7
mov esi, dword [esi]
push eax
push esi
call fcn.005cd994
add esp, 8
test eax, eax
jne 0x4b06f0
lea ecx, [edi + 0xd4]
lea eax, [ebp - 0x28]
cmp ecx, eax
je 0x4b06ec
push 0xffffffffffffffff
push 0
push eax
call fcn.00407550
mov bl, 1
jmp 0x4b06f2
xor bl, bl
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x4b0707
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00407b40
xor eax, eax
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x30], 0
cmp eax, 8
jb 0x4b0730
inc eax
lea ecx, [ebp - 0x58]
push eax
push dword [ebp - 0x58]
call fcn.00407b40
mov ecx, dword [ebp - 0x14]
xor eax, eax
mov dword [ebp - 0x44], 7
mov dword [ebp - 0x48], 0
mov word [ebp - 0x58], ax
cmp ecx, 8
jb 0x4b0759
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.00407b40
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00599c70
mov esp, ebp
pop ebp
ret
Function at 0x4b2310
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f56c0
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x67d070]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [esi + 0x64], edi
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], eax
call fcn.004d6410
test al, al
je 0x4b250e
xor ecx, ecx
mov dword [ebp - 0x30], 7
push 0xffffffffffffffff
push ecx
lea eax, [esi + 0x34]
mov word [ebp - 0x44], cx
push eax
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x34], 0
call fcn.00407550
push 0x640298
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 1
call fcn.00406e60
lea edx, [ebp - 0x5c]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x44]
call fcn.004d6690
mov byte [ebp - 4], 1
mov bl, al
mov ecx, dword [ebp - 0x48]
cmp ecx, 8
jb 0x4b23c8
inc ecx
push ecx
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x5c]
call fcn.00407b40
test bl, bl
je 0x4b24e5
lea edx, [ebp - 0x44]
lea ecx, [ebp - 0x2c]
call fcn.004d64a0
test al, al
je 0x4b24e5
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x4b2406
mov dword [esi + 0x64], 0xa
jmp 0x4b24e5
push str..debug
lea ecx, [ebp - 0x5c]
call fcn.00406e60
lea edx, [ebp - 0x5c]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2c]
call fcn.004d6690
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 1
mov bl, al
call fcn.00406e20
test bl, bl
je 0x4b2444
lea ecx, [ebp - 0x2c]
call fcn.004d63f0
test al, al
jne 0x4b24d9
lea ecx, [ebp - 0x2c]
call fcn.004d6740
test al, al
je 0x4b24e5
push str.asu.trace
lea ecx, [ebp - 0x5c]
call fcn.00406e60
lea edx, [ebp - 0x5c]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2c]
call fcn.004d64a0
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 1
mov bl, al
call fcn.00406e20
test bl, bl
je 0x4b24e5
lea ecx, [ebp - 0x2c]
call fcn.004d63f0
test al, al
je 0x4b2497
mov dword [esi + 0x64], 0xa
jmp 0x4b24e5
lea ecx, [ebp - 0x2c]
call fcn.004d6740
test al, al
je 0x4b24e5
push str.asu.debug
lea ecx, [ebp - 0x5c]
call fcn.00406e60
lea edx, [ebp - 0x5c]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x2c]
call fcn.004d64a0
lea ecx, [ebp - 0x5c]
mov bl, al
call fcn.00406e20
test bl, bl
je 0x4b24e5
lea ecx, [ebp - 0x2c]
call fcn.004d63f0
test al, al
je 0x4b24e5
cmp edi, 0x14
jle 0x4b24e5
mov dword [esi + 0x64], 0x14
mov eax, dword [ebp - 0x30]
cmp eax, 8
jb 0x4b24fa
inc eax
lea ecx, [ebp - 0x44]
push eax
push dword [ebp - 0x44]
call fcn.00407b40
xor eax, eax
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x34], 0
mov word [ebp - 0x44], ax
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x4b2523
inc eax
lea ecx, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
call fcn.00407b40
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00599c70
mov esp, ebp
pop ebp
ret 4
Function at 0x4b5530
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f5b97
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x67d070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor ecx, ecx
mov dword [ebp - 0x14], esi
mov dword [esi + 8], 0
call fcn.004b9090
mov dword [esi + 0xc], 0
mov dword [ebp - 4], 2
xor ecx, ecx
mov dword [esi + 0x14], 0
call fcn.004b9090
mov dword [esi + 0x18], 0
mov byte [ebp - 4], 3
xor ecx, ecx
mov dword [esi + 0x20], 0
call fcn.004b9090
mov dword [esi + 0x24], 0
mov byte [ebp - 4], 4
xor ecx, ecx
mov dword [esi + 0x2c], 0
call fcn.004b9090
mov dword [esi + 0x30], 0
mov byte [ebp - 4], 5
lea edi, [esi + 0x34]
cmp dword [0x689970], 0
mov dword [ebp - 0x10], edi
jne 0x4b55e4
call fcn.004f53a0
mov dword [0x689970], 0x4eaaf0
mov dword [edi], vtable.CryptoPP::Integer.0
mov ecx, 2
mov dword [edi + 8], 2
call fcn.004fa250
mov ecx, 8
call fcn.005007b0
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 0
mov dword [eax + 4], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov byte [ebp - 4], 6
lea edi, [esi + 0x48]
cmp dword [0x689970], 0
mov dword [ebp - 0x10], edi
jne 0x4b5641
call fcn.004f53a0
mov dword [0x689970], 0x4eaaf0
mov dword [edi], vtable.CryptoPP::Integer.0
mov ecx, 2
mov dword [edi + 8], 2
call fcn.004fa250
mov ecx, 8
call fcn.005007b0
mov dword [edi + 0xc], eax
mov ecx, eax
mov dword [edi + 0x10], 0
mov eax, esi
mov dword [ecx + 4], 0
mov ecx, dword [edi + 0xc]
mov dword [ecx], 0
mov byte [esi + 0x5c], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4b5f30
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x67d070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
mov ebx, edx
cmp dword [ecx + 0x14], 8
jb 0x4b5f4f
mov ecx, dword [ecx]
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4b5f85
mov eax, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00599c70
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileSizeEx]
test eax, eax
mov ecx, 4
push esi
cmove edi, ecx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [ebp - 0x10]
mov eax, edi
mov dword [ebx], ecx
mov ecx, dword [ebp - 0xc]
mov dword [ebx + 4], ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00599c70
mov esp, ebp
pop ebp
ret
Function at 0x4b74d0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f6010
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x67d070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
mov dword [ebp - 0x10], edx
mov dword [edx + 4], 0
mov dword [edx + 8], 0
mov byte [edx + 0x51], 0
mov dword [edx + 0x58], 0x10
cmp byte [edx + 0x51], 0
jne 0x4b7522
mov byte [edx + 0x51], 1
lea ecx, [edx + 0x10]
jmp 0x4b7524
xor ecx, ecx
mov dword [edx + 0x5c], ecx
mov byte [edx + 0xa1], 0
mov dword [edx + 0xa8], 0x10
cmp byte [edx + 0xa1], 0
jne 0x4b754d
mov byte [edx + 0xa1], 1
lea ecx, [edx + 0x60]
jmp 0x4b754f
xor ecx, ecx
mov dword [edx + 0xac], ecx
mov eax, edx
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x4b7850
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f6010
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x67d070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
mov dword [ebp - 0x10], edx
mov dword [edx + 4], 0
mov dword [edx + 8], 0
mov byte [edx + 0x51], 0
mov dword [edx + 0x58], 0x10
cmp byte [edx + 0x51], 0
jne 0x4b78a2
mov byte [edx + 0x51], 1
lea ecx, [edx + 0x10]
jmp 0x4b78a4
xor ecx, ecx
mov dword [edx + 0x5c], ecx
mov byte [edx + 0xa1], 0
mov dword [edx + 0xa8], 0x10
cmp byte [edx + 0xa1], 0
jne 0x4b78cd
mov byte [edx + 0xa1], 1
lea ecx, [edx + 0x60]
jmp 0x4b78cf
xor ecx, ecx
mov dword [edx + 0xac], ecx
mov eax, edx
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0xc3d2e1f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4b9af0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f63e0
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x67d070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov bl, dl
mov esi, ecx
cmp dword [esi + 0x14], 8
jb 0x4b9b29
mov eax, dword [esi]
jmp 0x4b9b2b
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4b9b48
test eax, 0x400
je 0x4b9b48
mov eax, 1
jmp 0x4b9c5e
test bl, bl
je 0x4b9c5c
xor eax, eax
mov dword [ebp - 0x14], 7
push 0xffffffffffffffff
push eax
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.00407550
xor eax, eax
mov dword [ebp - 4], 0
push 0xffffffffffffffff
push eax
push esi
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
call fcn.00407550
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0049c780
test al, al
je 0x4b9c13
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
push dword [ebp - 0x18]
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x40]
mov ebx, dword [ebp - 0x2c]
cmp esi, 8
cmovae ecx, edi
cmp ebx, 8
push ecx
cmovae eax, dword [ebp - 0x40]
push dword [ebp - 0x30]
push eax
call fcn.00408ed0
add esp, 0x10
test eax, eax
je 0x4b9c1c
cmp esi, 8
lea eax, [ebp - 0x28]
cmovae eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4b9bf7
test eax, 0x400
jne 0x4b9c7a
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x40]
call fcn.00407550
lea ecx, [ebp - 0x28]
call fcn.0049c780
test al, al
jne 0x4b9ba7
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x2c]
cmp ebx, 8
jb 0x4b9c36
lea eax, [ebx + 1]
push eax
push dword [ebp - 0x40]
lea ecx, [ebp - 0x40]
call fcn.00407b40
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
cmp esi, 8
jb 0x4b9c5c
lea eax, [esi + 1]
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.00407b40
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00599c70
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x40]
call fcn.00406e20
lea ecx, [ebp - 0x28]
call fcn.00406e20
mov eax, 2
jmp 0x4b9c5e
Function at 0x4b9dc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f3a38
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x67d070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
xor eax, eax
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x34]
push eax
push 0x20019
push 0
push str.SoftwareAdobeALCID
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4b9e5d
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov ecx, esi
mov word [esi], ax
lea eax, [ebp - 0x2c]
push eax
call fcn.004098a0
mov ecx, dword [ebp - 0x18]
cmp ecx, 8
jb 0x4b9f1a
inc ecx
push ecx
jmp 0x4b9f0f
lea eax, [ebp - 0x30]
mov dword [ebp - 0x14], 0
push eax
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x30], 0
push eax
push 0
push str.CCLangPref
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4b9ede
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x4b9ede
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0059a123
mov edi, eax
add esp, 4
test edi, edi
je 0x4b9ede
lea eax, [ebp - 0x30]
push eax
push edi
lea eax, [ebp - 0x14]
push eax
push 0
push str.CCLangPref
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4b9ed5
push edi
lea ecx, [ebp - 0x2c]
call fcn.00407010
push edi
call fcn.00599f1f
add esp, 4
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov ecx, esi
mov word [esi], ax
lea eax, [ebp - 0x2c]
push eax
call fcn.004098a0
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x4b9f1a
inc eax
push eax
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x2c]
call fcn.00407b40
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00599c70
mov esp, ebp
pop ebp
ret