joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ac000
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x57c06c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
push 0x4c
mov dword [ebp - 0x10], ecx
call fcn.004eec3a
mov esi, eax
add esp, 4
test esi, esi
jne 0x4ac044
test edi, edi
je 0x4ac032
mov dword [edi], 0x6d
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e24d7
mov esp, ebp
pop ebp
ret
push ebx
push 0x4c
push 0
push esi
call fcn.004e5200
push 0x614c
push 1
mov dword [esi + 0x34], 0
mov dword [esi + 0x14], 0
call fcn.004f6b5d
mov ebx, eax
add esp, 0x14
test ebx, ebx
jne 0x4ac098
test edi, edi
je 0x4ac07c
mov dword [edi], 0x6d
push esi
call fcn.004e4a56
add esp, 4
xor eax, eax
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e24d7
mov esp, ebp
pop ebp
ret
push 0x614c
push 0
push ebx
call fcn.004e5200
mov eax, dword [ebp - 0x10]
add esp, 0xc
mov dword [esi + 0x48], ebx
mov dword [ebx + 4], 0
mov dword [ebx + 0x38], 0
mov dword [ebx], 8
mov dword [ebx + 0x3c], 0x4a9c30
mov ecx, dword [esi + 0x48]
mov dword [esi + 0x44], eax
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x4ac0e4
push 6
lea ecx, [ebp - 0xc]
push ecx
push esi
call eax
add esp, 0xc
jmp 0x4ac0f7
push dword [ecx + 0x38]
lea eax, [ebp - 0xc]
push 6
push 1
push eax
call fcn.004eeb09
add esp, 0x10
cmp eax, 6
je 0x4ac108
test edi, edi
je 0x4ac12d
mov dword [edi], 0x66
jmp 0x4ac12d
push 3
lea eax, [ebp - 0xc]
mov byte [ebp - 6], 0
push eax
push str.GIFVER
call fcn.004f8dc0
add esp, 0xc
test eax, eax
je 0x4ac14f
test edi, edi
je 0x4ac12d
mov dword [edi], 0x67
push ebx
call fcn.004e4a56
push esi
call fcn.004e4a56
add esp, 8
xor eax, eax
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e24d7
mov esp, ebp
pop ebp
ret
mov ecx, esi
call fcn.004ac1b0
test eax, eax
jne 0x4ac186
push ebx
call fcn.004e4a56
push esi
call fcn.004e4a56
add esp, 8
test edi, edi
je 0x4ac173
mov dword [edi], 0x68
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e24d7
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
mov dword [esi + 0x40], 0
cmp byte [ebp - 9], 0x39
sete al
xor ecx, ebp
mov dword [ebx + 0x6148], eax
mov eax, esi
pop ebx
pop edi
pop esi
call fcn.004e24d7
mov esp, ebp
pop ebp
ret
Function at 0x4ac1b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x48]
test byte [eax], 8
jne 0x4ac1cd
mov dword [esi + 0x40], 0x6f
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov edx, esi
call fcn.004ac9b0
test eax, eax
je 0x4ac1c6
lea edx, [esi + 4]
mov ecx, esi
call fcn.004ac9b0
test eax, eax
je 0x4ac1c6
mov ecx, dword [esi + 0x48]
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x4ac1fe
push 3
lea ecx, [ebp - 4]
push ecx
push esi
call eax
add esp, 0xc
jmp 0x4ac211
push dword [ecx + 0x38]
lea eax, [ebp - 4]
push 3
push 1
push eax
call fcn.004eeb09
add esp, 0x10
push edi
cmp eax, 3
je 0x4ac245
mov edi, dword [esi + 0x14]
mov dword [esi + 0x40], 0x66
test edi, edi
je 0x4ac236
push dword [edi + 0xc]
call fcn.004e4a56
push edi
call fcn.004e4a56
add esp, 8
pop edi
mov dword [esi + 0x14], 0
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov dl, byte [ebp - 4]
movzx ecx, dl
mov eax, ecx
mov edi, ecx
shr eax, 4
and ecx, 7
and eax, 7
shr edi, 3
inc eax
and edi, 1
mov dword [esi + 8], eax
inc ecx
movzx eax, byte [ebp - 3]
mov dword [esi + 0xc], eax
mov al, byte [ebp - 2]
mov byte [esi + 0x10], al
push ebx
test dl, dl
jns 0x4ac33f
mov eax, 1
xor edx, edx
shl eax, cl
mov ecx, eax
call fcn.004acfa0
mov dword [esi + 0x14], eax
test eax, eax
jne 0x4ac29e
pop ebx
pop edi
mov dword [esi + 0x40], 0x6d
pop esi
mov esp, ebp
pop ebp
ret
mov dword [eax + 8], edi
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp dword [eax], ebx
jle 0x4ac346
xor edi, edi
mov ecx, dword [esi + 0x48]
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x4ac2c8
push 3
lea ecx, [ebp - 4]
push ecx
push esi
call eax
add esp, 0xc
jmp 0x4ac2db
push dword [ecx + 0x38]
lea eax, [ebp - 4]
push 3
push 1
push eax
call fcn.004eeb09
add esp, 0x10
cmp eax, 3
jne 0x4ac320
mov eax, dword [esi + 0x14]
inc ebx
mov ecx, dword [eax + 0xc]
movzx eax, byte [ebp - 4]
mov byte [edi + ecx], al
mov eax, dword [esi + 0x14]
mov ecx, dword [eax + 0xc]
movzx eax, byte [ebp - 3]
mov byte [ecx + edi + 1], al
mov eax, dword [esi + 0x14]
mov ecx, dword [eax + 0xc]
movzx eax, byte [ebp - 2]
mov byte [ecx + edi + 2], al
add edi, 3
mov eax, dword [esi + 0x14]
cmp ebx, dword [eax]
jl 0x4ac2b0
pop ebx
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0x14]
call fcn.004ad040
pop ebx
pop edi
mov dword [esi + 0x14], 0
xor eax, eax
mov dword [esi + 0x40], 0x66
pop esi
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x14], 0
pop ebx
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4ac360
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov esi, edx
mov eax, dword [edi + 0x48]
test byte [eax], 8
jne 0x4ac381
mov dword [edi + 0x40], 0x6f
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x4ac396
push 1
lea eax, [ebp - 1]
push eax
push edi
call ecx
add esp, 0xc
jmp 0x4ac3a9
push dword [eax + 0x38]
lea eax, [ebp - 1]
push 1
push 1
push eax
call fcn.004eeb09
add esp, 0x10
cmp eax, 1
je 0x4ac3bd
mov dword [edi + 0x40], 0x66
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov al, byte [ebp - 1]
cmp al, 0x21
je 0x4ac403
cmp al, 0x2c
je 0x4ac3f2
cmp al, 0x3b
je 0x4ac3e1
mov dword [edi + 0x40], 0x6b
xor eax, eax
pop edi
mov dword [esi], 0
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov dword [esi], 4
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov dword [esi], 2
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov dword [esi], 3
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4ac7a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov edi, edx
mov ebx, dword [esi + 0x48]
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x4ac7c3
push 1
lea ecx, [ebp - 1]
push ecx
push esi
call eax
add esp, 0xc
jmp 0x4ac7d6
push dword [ebx + 0x38]
lea eax, [ebp - 1]
push 1
push 1
push eax
call fcn.004eeb09
add esp, 0x10
cmp eax, 1
jne 0x4ac824
mov al, byte [ebp - 1]
test al, al
je 0x4ac834
lea ecx, [ebx + 0x44]
mov byte [ecx], al
mov eax, dword [esi + 0x48]
mov dword [edi], ecx
mov edx, dword [eax + 0x3c]
test edx, edx
je 0x4ac804
movzx eax, byte [ebp - 1]
push eax
lea eax, [ecx + 1]
push eax
push esi
call edx
add esp, 0xc
jmp 0x4ac81a
push dword [eax + 0x38]
movzx eax, byte [ebp - 1]
push eax
lea eax, [ecx + 1]
push 1
push eax
call fcn.004eeb09
add esp, 0x10
mov ecx, eax
movzx eax, byte [ebp - 1]
cmp ecx, eax
je 0x4ac83a
pop edi
mov dword [esi + 0x40], 0x66
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edi], 0
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4ac9b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov edi, edx
mov ecx, dword [esi + 0x48]
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x4ac9d2
push 2
lea ecx, [ebp - 4]
push ecx
push esi
call eax
add esp, 0xc
jmp 0x4ac9e5
push dword [ecx + 0x38]
lea eax, [ebp - 4]
push 2
push 1
push eax
call fcn.004eeb09
add esp, 0x10
cmp eax, 2
je 0x4ac9f9
pop edi
mov dword [esi + 0x40], 0x66
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov ax, word [ebp - 4]
movzx ecx, ah
movzx eax, al
shl ecx, 8
or ecx, eax
mov eax, 1
mov dword [edi], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4aca20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov edi, dword [esi + 0x48]
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x4aca43
push 1
lea ecx, [ebp - 1]
push ecx
push esi
call eax
add esp, 0xc
jmp 0x4aca56
push dword [edi + 0x38]
lea eax, [ebp - 1]
push 1
push 1
push eax
call fcn.004eeb09
add esp, 0x10
cmp eax, 1
jne 0x4acaa4
mov al, byte [ebp - 1]
test al, al
je 0x4acab4
add edi, 0x44
mov dword [ebx], edi
mov byte [edi], al
mov eax, dword [esi + 0x48]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x4aca84
movzx eax, byte [ebp - 1]
push eax
lea eax, [edi + 1]
push eax
push esi
call ecx
add esp, 0xc
jmp 0x4aca9a
push dword [eax + 0x38]
movzx eax, byte [ebp - 1]
push eax
lea eax, [edi + 1]
push 1
push eax
call fcn.004eeb09
add esp, 0x10
mov ecx, eax
movzx eax, byte [ebp - 1]
cmp ecx, eax
je 0x4acac5
pop edi
mov dword [esi + 0x40], 0x66
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebx], 0
mov byte [edi + 0x44], 0
mov dword [edi + 0x34], 0
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ace20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
mov dword [ebp - 4], edx
push edi
mov edi, dword [ebx + 0x48]
mov eax, dword [edi + 0x18]
cmp eax, 0xc
jle 0x4ace45
pop edi
mov dword [ebx + 0x40], 0x70
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push esi
cmp dword [edi + 0x2c], eax
jge 0x4acf08
lea esi, [edi + 0x44]
mov dl, byte [esi]
test dl, dl
jne 0x4acedc
mov ecx, dword [ebx + 0x48]
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x4ace71
push 1
push esi
push ebx
call eax
add esp, 0xc
jmp 0x4ace81
push dword [ecx + 0x38]
push 1
push 1
push esi
call fcn.004eeb09
add esp, 0x10
cmp eax, 1
jne 0x4acf67
mov al, byte [esi]
test al, al
je 0x4acf57
mov ecx, dword [ebx + 0x48]
movzx eax, al
mov edx, dword [ecx + 0x3c]
lea ecx, [esi + 1]
test edx, edx
je 0x4aceae
push eax
push ecx
push ebx
call edx
add esp, 0xc
jmp 0x4acec0
mov edx, dword [ebx + 0x48]
push dword [edx + 0x38]
push eax
push 1
push ecx
call fcn.004eeb09
add esp, 0x10
mov cl, byte [esi]
mov edx, eax
movzx eax, cl
cmp edx, eax
jne 0x4acf67
mov dh, byte [esi + 1]
dec cl
mov byte [esi + 1], 2
mov byte [esi], cl
jmp 0x4aceee
mov cl, byte [esi + 1]
movzx eax, cl
inc cl
dec dl
mov dh, byte [eax + esi]
mov byte [esi + 1], cl
mov byte [esi], dl
mov ecx, dword [edi + 0x2c]
movzx eax, dh
shl eax, cl
or dword [edi + 0x30], eax
lea eax, [ecx + 8]
mov dword [edi + 0x2c], eax
cmp eax, dword [edi + 0x18]
jl 0x4ace52
mov ecx, dword [edi + 0x18]
mov edx, dword [edi + 0x30]
mov esi, dword [ebp - 4]
sub dword [edi + 0x2c], ecx
movzx eax, word [ecx*2 + 0x552afc]
and eax, edx
shr edx, cl
mov dword [esi], eax
mov eax, dword [edi + 0x14]
mov dword [edi + 0x30], edx
cmp eax, 0x1001
jge 0x4acf4b
mov edx, dword [edi + 0x1c]
inc eax
mov dword [edi + 0x14], eax
cmp eax, edx
jle 0x4acf4b
cmp ecx, 0xc
jge 0x4acf4b
lea eax, [edx + edx]
mov dword [edi + 0x1c], eax
lea eax, [ecx + 1]
mov dword [edi + 0x18], eax
pop esi
pop edi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
pop edi
mov dword [ebx + 0x40], 0x70
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
pop edi
mov dword [ebx + 0x40], 0x66
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4adbf0
Capabilities:
Check if file exists
Delete directory
Enumerate files on windows
Enumerate files recursively
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x538ec1
mov eax, dword fs:[0]
push eax
sub esp, 0xa64
mov eax, dword [0x57c06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov byte [ebp - 0xa61], dl
mov esi, ecx
call fcn.004adb50
test al, al
jne 0x4adc36
xor eax, eax
jmp 0x4ade3f
sub esp, 0x10
lea ecx, [ebp - 0x938]
xor ebx, ebx
push ebx
push esi
call fcn.004b2790
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x92c]
cmp byte [ebp - 0x81c], bl
cmove eax, dword [ebp - 0x930]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4adcf2
shr eax, 4
not al
and al, 1
je 0x4adcf2
sub esp, 0x10
lea ecx, [ebp - 0xa60]
push ebx
push esi
call fcn.004b2790
mov byte [ebp - 0xa68], bl
mov dword [ebp - 0xa6c], ebx
sub esp, 8
mov byte [ebp - 4], 2
lea eax, [ebp - 0xa6c]
lea ecx, [ebp - 0xa60]
push eax
call fcn.004b2c80
lea ecx, [ebp - 0xa6c]
call fcn.004af6c0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
cmp byte [ebp - 0x944], bl
jne 0x4ade11
mov eax, dword [ebp - 0xa58]
lea ecx, [ebp - 0xa54]
cmp eax, ecx
je 0x4ade11
push eax
call fcn.004e4a56
add esp, 4
jmp 0x4ade11
lea ecx, [ebp - 0x938]
call fcn.004b2a80
test al, al
jne 0x4add08
xor ebx, ebx
jmp 0x4ade11
push esi
lea eax, [ebp - 0x810]
push 0x561dec
push eax
call fcn.0049e420
add esp, 0xc
lea eax, [ebp - 0x810]
push 0x5a95b8
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4addff
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov edx, 0x5517b4
mov ecx, 0x5a95e4
nop word [eax + eax]
mov ax, word [ecx]
cmp ax, word [edx]
jne 0x4add76
test ax, ax
je 0x4add72
mov ax, word [ecx + 2]
cmp ax, word [edx + 2]
jne 0x4add76
add ecx, 4
add edx, 4
test ax, ax
jne 0x4add50
xor eax, eax
jmp 0x4add7b
sbb eax, eax
or eax, 1
test eax, eax
je 0x4adde6
mov ecx, 0x561e08
mov eax, 0x5a95e4
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4addb6
test dx, dx
je 0x4addb2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4addb6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4add90
xor eax, eax
jmp 0x4addbb
sbb eax, eax
or eax, 1
test eax, eax
je 0x4adde6
push 0x5a95e4
push esi
lea eax, [ebp - 0x810]
push 0x5613f0
push eax
call fcn.0049e420
add esp, 0x10
lea ecx, [ebp - 0x810]
mov dl, 1
call fcn.004adbf0
push 0x5a95b8
push edi
call ebx
test eax, eax
jne 0x4add40
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor ebx, ebx
cmp byte [ebp - 0xa61], 0
je 0x4ade11
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ebx, eax
cmp byte [ebp - 0x81c], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x4ade3d
mov ecx, dword [ebp - 0x930]
lea eax, [ebp - 0x92c]
cmp ecx, eax
je 0x4ade3d
push ecx
call fcn.004e4a56
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e24d7
mov esp, ebp
pop ebp
ret
Function at 0x4ae1c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x538f51
mov eax, dword fs:[0]
push eax
sub esp, 0x394
mov eax, dword [0x57c06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x208
push 0
push esi
call fcn.004e5200
add esp, 0xc
mov dword [ebp - method.t_reg.virtual_0], vtable.t_reg.0
lea ecx, [ebp - 0x264]
call fcn.004ad0c0
push str.MACHINE
lea ecx, [ebp - 0x264]
mov dword [ebp - 0x26c], 0
mov dword [ebp - 0x268], reloc.OLEAUT32.dll_SysReAllocString
call fcn.004ad300
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x134]
mov dword [ebp - method.t_reg.virtual_0], vtable.t_reg.0
call fcn.004ad0c0
push 0x56252c
lea ecx, [ebp - 0x134]
mov dword [ebp - 0x13c], 0
mov dword [ebp - 0x138], reloc.WS2_32.dll_accept
call fcn.004ad300
mov byte [ebp - 0x398], 0
mov dword [ebp - 0x39c], 0
sub esp, 0xc
mov byte [ebp - 4], 2
lea eax, [ebp - 0x39c]
lea ecx, [ebp - 0x270]
push str.SoftwareSogouExplorer
push eax
call fcn.004b2fe0
test al, al
jne 0x4ae2d0
sub esp, 0xc
lea eax, [ebp - 0x39c]
lea ecx, [ebp - 0x140]
push str.SoftwareSogouExplorer
push eax
call fcn.004b2fe0
test al, al
je 0x4ae2fc
lea ecx, [ebp - 0x140]
jmp 0x4ae2d6
lea ecx, [ebp - 0x270]
push 1
push 0
lea eax, [ebp - 0x3a0]
mov dword [ebp - 0x3a0], 0x208
push eax
push esi
lea eax, [ebp - 0x39c]
push eax
call fcn.004b3130
test al, al
jne 0x4ae300
xor esi, esi
jmp 0x4ae37c
push str.SogouExplorer.exe
push 0x104
push esi
call fcn.004f8bce
push ecx
push 0
push esi
lea ecx, [ebp - 0x394]
call fcn.004b2790
cmp byte [ebp - 0x278], 0
lea eax, [ebp - 0x388]
cmove eax, dword [ebp - 0x38c]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4ae346
xor al, al
jmp 0x4ae34d
shr eax, 4
not al
and al, 1
cmp byte [ebp - 0x278], 0
movzx esi, al
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x4ae37c
mov eax, dword [ebp - 0x38c]
lea ecx, [ebp - 0x388]
cmp eax, ecx
je 0x4ae37c
push eax
call fcn.004e4a56
add esp, 4
lea ecx, [ebp - 0x39c]
call fcn.004af6c0
mov eax, dword [ebp - 0x13c]
mov dword [ebp - method.t_reg.virtual_0], vtable.t_reg.0
test eax, eax
je 0x4ae3a2
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x18], 0
mov dword [ebp - 0x13c], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x4ae3d5
mov eax, dword [ebp - 0x12c]
lea ecx, [ebp - 0x128]
cmp eax, ecx
je 0x4ae3d5
push eax
call fcn.004e4a56
add esp, 4
mov eax, dword [ebp - 0x26c]
mov dword [ebp - method.t_reg.virtual_0], vtable.t_reg.0
test eax, eax
je 0x4ae3f0
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x148], 0
mov dword [ebp - 0x26c], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x4ae426
mov eax, dword [ebp - 0x25c]
lea ecx, [ebp - 0x258]
cmp eax, ecx
je 0x4ae426
push eax
call fcn.004e4a56
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e24d7
mov esp, ebp
pop ebp
ret
Function at 0x4ae7e0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov eax, ecx
mov dword [ebp - 4], 0
push edi
lea ecx, [ebp - 4]
mov dword [ebp - 0xc], eax
push ecx
push eax
mov edi, edx
mov dword [ebp - 8], 0
xor bl, bl
mov dword [ebp - 0x10], 0
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [ebp - 4], eax
test eax, eax
jne 0x4ae820
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push eax
call fcn.004eec3a
add esp, 4
mov esi, eax
push esi
push dword [ebp - 4]
push 0
push dword [ebp - 0xc]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x4ae8a1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0x551b6c
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x4ae8a1
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
movzx eax, word [ecx + 0xa]
mov word [edi], ax
movzx eax, word [ecx + 8]
mov word [edi + 2], ax
movzx eax, word [ecx + 0xe]
mov word [edi + 4], ax
movzx eax, word [ecx + 0xc]
mov word [edi + 6], ax
test edx, edx
je 0x4ae89f
movzx eax, word [ecx + 0x12]
mov word [edx], ax
movzx eax, word [ecx + 0x10]
mov word [edx + 2], ax
movzx eax, word [ecx + 0x16]
mov word [edx + 4], ax
movzx eax, word [ecx + 0x14]
mov word [edx + 6], ax
mov bl, 1
test esi, esi
je 0x4ae8ae
push esi
call fcn.004e4a56
add esp, 4
pop esi
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4ae8c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x57c06c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
lea eax, [ebp - 0x20c]
mov esi, edx
push 0
push eax
mov edi, ecx
call fcn.004e5200
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x4ae917
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e24d7
mov esp, ebp
pop ebp
ret
push 0x561fa8
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004f8bce
lea eax, [ebp - 0x21c]
push eax
lea edx, [ebp - 0x214]
lea ecx, [ebp - 0x20c]
call fcn.004ae7e0
add esp, 0x10
test al, al
je 0x4ae905
movzx eax, word [ebp - 0x214]
mov dword [edi + 4], eax
movzx eax, word [ebp - 0x212]
mov dword [edi + 8], eax
movzx eax, word [ebp - 0x210]
mov dword [edi + 0xc], eax
xor eax, eax
mov dword [edi], 0x114
mov dword [edi + 0x10], 2
mov word [edi + 0x14], ax
test esi, esi
je 0x4ae9b2
movzx eax, word [ebp - 0x21c]
mov dword [esi + 4], eax
movzx eax, word [ebp - 0x21a]
mov dword [esi + 8], eax
movzx eax, word [ebp - 0x218]
mov dword [esi + 0xc], eax
xor eax, eax
mov dword [esi], 0x114
mov dword [esi + 0x10], 2
mov word [esi + 0x14], ax
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.004e24d7
mov esp, ebp
pop ebp
ret
Function at 0x4b2540
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53923b
mov eax, dword fs:[0]
push eax
sub esp, 0x134
mov eax, dword [0x57c06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x140], ecx
mov ebx, dword [ebp + 0xc]
xor esi, esi
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x138], esi
cmp dword [ebx + 4], esi
jbe 0x4b25c1
nop
mov eax, edi
lea esi, [ebp - 0x138]
and eax, 1
mov ecx, ebx
lea esi, [esi + eax*2]
call fcn.004ad690
movzx eax, word [eax + edi*2]
push eax
call fcn.004f7788
xor word [esi], ax
inc edi
add esp, 4
cmp edi, dword [ebx + 4]
jb 0x4b2590
mov esi, dword [ebp - 0x138]
mov eax, 4
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
mov word [ebp - 0x1a], ax
lea ecx, [ebp - 0x12c]
lea eax, [ebp - 0x128]
mov byte [ebp - 0x18], 1
push 1
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x130], 0
call fcn.004ada80
cmp byte [ebp - 0x18], 0
lea eax, [ebp - 0x128]
cmove eax, dword [ebp - 0x12c]
xor ecx, ecx
mov word [eax + 4], cx
push str.Local_
lea eax, [ebp - 0x134]
mov dword [ebp - 4], ecx
push 0x561dd0
push eax
call fcn.004ad730
push str.mutex_file_
lea eax, [ebp - 0x134]
push 0x561dd0
push eax
call fcn.004ad730
push esi
lea eax, [ebp - 0x134]
push str.0x_p
push eax
call fcn.004ad730
mov esi, dword [ebp - 0x13c]
lea eax, [ebp - 0x128]
mov ecx, dword [ebp - 0x140]
add esp, 0x24
cmp byte [ebp - 0x18], 0
cmove eax, dword [ebp - 0x12c]
add eax, 4
push eax
push esi
call fcn.004b9120
test al, al
jne 0x4b26b0
mov ecx, esi
call fcn.004af720
push 0x5624b0
push 0x561dd0
push eax
call fcn.004ad730
add esp, 0xc
xor bl, bl
jmp 0x4b26b2
mov bl, 1
cmp byte [ebp - 0x18], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x4b26db
mov eax, dword [ebp - 0x12c]
lea ecx, [ebp - 0x128]
cmp eax, ecx
je 0x4b26db
push eax
call fcn.004e4a56
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e24d7
mov esp, ebp
pop ebp
ret 8

Function at 0x4b2a50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp byte [ecx + 0x11c], 0
lea eax, [ecx + 0xc]
jne 0x4b2a5f
mov eax, dword [ecx + 8]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4b2a71
xor al, al
ret
shr eax, 4
not al
and al, 1
ret