joyce8/EMBER2024-capa huggingface dataset:
Function at 0x469aae
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1bc
push ebx
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebx + 0x18]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [esp + 0x3c], eax
push eax
mov eax, dword [esi + 4]
call fcn.00468952
mov edi, dword [esi + 0x1c]
mov dword [esp + 0x30], edx
mov edx, dword [esi + 0x14]
imul edx, edx, 0x28
add edx, edi
cmp byte [ebx + 0x16], 0
pop ecx
mov dword [esp + 0x28], eax
mov dword [esp + 0x38], edx
jne 0x469c9c
jmp 0x469c90
mov eax, 0x100
cmp word [edi + 0x10], ax
jne 0x469c8d
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
not eax
and eax, dword [edi + 0x20]
not ecx
and ecx, dword [edi + 0x24]
and eax, dword [ebp + 0x14]
and ecx, dword [ebp + 0x18]
or eax, ecx
jne 0x469c8d
mov ecx, dword [edi + 0xc]
mov eax, dword [ecx + 0x160]
mov esi, dword [ecx + 0x164]
and eax, dword [esp + 0x28]
and esi, dword [esp + 0x2c]
or eax, esi
je 0x469c8d
mov esi, dword [ecx + 0x14]
fldz
mov ebx, dword [ecx + 0x1c]
imul esi, esi, 0x28
fst qword [esp + 0x20]
fstp qword [esp + 0x30]
and dword [esp + 0x10], 0
add esi, ebx
and dword [esp + 0x14], 0
jmp 0x469c2c
mov eax, 0x200
cmp word [ebx + 0x10], ax
jne 0x469b8d
lea eax, [esp + 0x40]
push eax
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebx + 0xc]
jmp 0x469bda
mov eax, dword [esp + 0x3c]
cmp dword [ebx + 8], eax
jne 0x469c29
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x6c], eax
lea eax, [esp + 0x40]
push eax
push dword [ebp + 0x20]
lea eax, [esp + 0x70]
push dword [ebp + 0x1c]
mov dword [esp + 0x74], ecx
push dword [ebp + 0x18]
mov byte [esp + 0x88], 0x45
push dword [ebp + 0x14]
mov dword [esp + 0x98], ebx
mov dword [esp + 0x90], 1
push eax
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
call fcn.0046aa99
fld qword [esp + 0x68]
fadd qword [esp + 0x38]
mov ecx, dword [ebp + 0x28]
mov eax, dword [esp + 0x78]
or dword [esp + 0x28], eax
mov eax, dword [esp + 0x7c]
fstp qword [esp + 0x38]
fld qword [esp + 0x70]
or dword [esp + 0x2c], eax
fadd qword [esp + 0x48]
mov edi, dword [esp + 0x34]
mov edx, dword [esp + 0x50]
add esp, 0x18
fstp qword [esp + 0x30]
fld qword [ecx + 0x10]
fcomp qword [esp + 0x20]
fnstsw ax
test ah, 0x41
jnp 0x469c37
add ebx, 0x28
cmp ebx, esi
jb 0x469b6c
mov ecx, dword [ebp + 0x28]
cmp dword [ebp + 0x24], 0
je 0x469c5a
fld qword [esp + 0x30]
push ecx
push ecx
fstp qword [esp]
call fcn.00469a70
fmul qword [esp + 0x38]
add esp, 8
fadd qword [esp + 0x20]
fstp qword [esp + 0x20]
fld qword [ecx + 0x10]
fcomp qword [esp + 0x20]
fnstsw ax
test ah, 0x41
jne 0x469c8d
mov eax, dword [esp + 0x10]
fld qword [esp + 0x20]
fstp qword [ecx + 0x10]
mov dword [ecx + 0x20], eax
fld qword [esp + 0x30]
mov eax, dword [esp + 0x14]
fstp qword [ecx + 0x18]
mov dword [ecx + 0x24], eax
mov dword [ecx], 0x10000000
mov dword [ecx + 8], edi
add edi, 0x28
mov dword [esp + 0x1c], edi
cmp edi, edx
jb 0x469afa
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x470792
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x368
mov eax, dword [0x50e7dc]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
lea edx, [ebp - 0x21c]
push edi
mov dword [ebp - 0x368], ebx
mov eax, ebx
sub edx, ebx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4707bb
lea edi, [ebp - 0x21c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4707cc
mov esi, 0x4f6f30
movsw word es:[edi], word [esi]
lea edx, [ebp - 0x114]
movsb byte es:[edi], byte [esi]
mov eax, ebx
sub edx, ebx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4707e6
lea edi, [ebp - 0x114]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4707f7
lea eax, [ebp - 0x35c]
push eax
lea eax, [ebp - 0x21c]
mov esi, 0x4f6f34
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x364], eax
cmp eax, 0xffffffff
jne 0x47082c
xor eax, eax
jmp 0x47095b
xor eax, eax
mov cl, byte [ebp + eax - 0x114]
mov byte [ebp + eax - 0x21c], cl
inc eax
test cl, cl
jne 0x47082e
mov ebx, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov byte [ebp - 0x35d], 1
lea eax, [ebp - 0x35c]
push eax
push dword [ebp - 0x364]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x470928
push 2
mov edi, 0x4f3ad0
lea esi, [ebp - 0x330]
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x47093a
push 3
mov edi, 0x4f6f2c
lea esi, [ebp - 0x330]
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x47093a
lea eax, [ebp - 0x330]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4708a1
lea edi, [ebp - 0x114]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4708b1
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
test byte [ebp - 0x35c], 0x10
lea eax, [ebp - 0x114]
rep movsb byte es:[edi], byte [esi]
push eax
je 0x470907
call fcn.00470792
pop ecx
test eax, eax
je 0x47096a
lea eax, [ebp - 0x114]
push eax
call ebx
xor eax, eax
mov cl, byte [ebp + eax - 0x21c]
mov byte [ebp + eax - 0x114], cl
inc eax
test cl, cl
jne 0x4708f2
jmp 0x47093a
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x47096a
xor eax, eax
mov cl, byte [ebp + eax - 0x21c]
mov byte [ebp + eax - 0x114], cl
inc eax
test cl, cl
jne 0x470913
jmp 0x47093a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x47096a
mov byte [ebp - 0x35d], 0
cmp byte [ebp - 0x35d], 0
jne 0x47084e
push dword [ebp - 0x364]
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebp - 0x368]
call ebx
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049f533
leave
ret
push dword [ebp - 0x364]
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x470825
Function at 0x470a87
Capabilities:
Write file on windows

Disassembly:
push 0x15c
mov eax, 0x4c28c3
call fcn.0049f5ab
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x15c], ecx
mov byte [ebp - 0x151], bl
mov dword [ebp - 0x158], ebx
mov dword [ebp - method.CHttpClient.virtual_0], vtable.CHttpClient.0
push eax
lea ecx, [ebp - 0x118]
mov dword [ebp - 4], ebx
call fcn.0041c01b
mov byte [ebp - 4], 1
push dword [eax]
lea ecx, [ebp - 0x150]
call fcn.00404bd0
lea eax, [ebp - 0x114]
mov byte [ebp - 4], 3
cmp dword [ebp - 0x118], eax
je 0x470af5
push dword [ebp - 0x118]
call fcn.0049f900
pop ecx
lea eax, [ebp - 0x160]
push eax
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x134]
push eax
lea edi, [ebp - 0x158]
call fcn.0041eece
cmp dword [ebp - 0x120], ebx
jbe 0x470bd9
cmp dword [ebp - 0x160], 0xc8
jne 0x470bd9
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x118]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x470b3c
lea edi, [ebp - 0x118]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x470b4d
mov eax, dword [ebp - 0x15c]
mov esi, 0x4f6f34
movsw word es:[edi], word [esi]
mov edx, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x470b64
lea edi, [ebp - 0x118]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x470b74
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x118]
and ecx, 3
push 0x4f7080
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.004a3919
mov esi, eax
pop ecx
pop ecx
cmp esi, ebx
je 0x470bd9
cmp dword [ebp - 0x11c], 0x10
mov eax, dword [ebp - 0x130]
jae 0x470bba
lea eax, [ebp - 0x130]
push esi
push dword [ebp - 0x158]
push 1
push eax
call fcn.004a276c
push esi
call fcn.004a069e
add esp, 0x14
mov byte [ebp - 0x151], 1
push ebx
push 1
lea ecx, [ebp - 0x134]
call fcn.00404ec6
push ebx
push 1
lea ecx, [ebp - 0x150]
call fcn.004058b3
mov al, byte [ebp - 0x151]
call fcn.0049f62e
ret

Function at 0x470c01
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x50e7dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
lea ecx, [ebp - 0x148]
push ecx
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x470c90
cmp byte [ebp - 0x11c], 0x2e
je 0x470c72
test byte [ebp - 0x148], 0x10
je 0x470c72
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x11c]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x470c69
test dl, dl
je 0x470c65
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x470c69
inc eax
inc eax
inc ecx
inc ecx
test dl, dl
jne 0x470c4b
xor eax, eax
jmp 0x470c6e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x470c87
lea eax, [ebp - 0x148]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp eax, 1
je 0x470c30
jmp 0x470c89
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0049f533
leave
ret
Function at 0x470ca0
Capabilities:
Create directory

Disassembly:
push 0x98
mov eax, 0x4bf172
call fcn.0049f5ab
mov eax, dword [ebp + 8]
mov esi, ecx
push eax
lea ecx, [ebp - 0x9c]
call fcn.00404922
and dword [ebp - 4], 0
push esi
lea ecx, [ebp - 0x80]
call fcn.00404922
xor edx, edx
lea ebx, [ebp - 0x80]
mov byte [ebp - 4], 1
xor esi, esi
call fcn.00472560
mov edi, eax
jmp 0x470dc2
mov eax, edi
sub eax, esi
push eax
push esi
lea eax, [ebp - 0x80]
push eax
lea esi, [ebp - 0x2c]
call fcn.004286d9
push 0x4f6f28
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x64]
push eax
mov byte [ebp - 4], 2
call fcn.004725df
add esp, 0xc
mov byte [ebp - 4], 3
cmp dword [ebp - 0x14], 0x10
mov ecx, dword [ebp - 0x28]
jae 0x470d22
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x4c], 0x10
mov eax, dword [ebp - 0x60]
jae 0x470d2e
lea eax, [ebp - 0x60]
push ecx
push eax
call fcn.00470c01
pop ecx
pop ecx
test al, al
jne 0x470d79
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00472625
mov eax, dword [ebp - 0x44]
add esp, 0xc
cmp dword [ebp - 0x30], 0x10
jae 0x470d5e
lea eax, [ebp - 0x44]
xor ebx, ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push ebx
lea ecx, [ebp - 0x48]
push 1
cmp eax, ebx
je 0x470dd6
call fcn.00404ec6
jmp 0x470d7b
xor ebx, ebx
push 0x4f6f34
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x2c]
lea esi, [ebp - 0x9c]
call fcn.0041c127
push eax
call fcn.0041c045
lea esi, [edi + 1]
mov edx, esi
lea ebx, [ebp - 0x80]
call fcn.00472560
push 0
push 1
lea ecx, [ebp - 0x64]
mov edi, eax
call fcn.00404ec6
push 0
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00404ec6
cmp edi, 0xffffffff
jne 0x470ce4
mov byte [ebp - 0x9d], 1
xor ebx, ebx
jmp 0x470df7
call fcn.00404ec6
push ebx
push 1
lea ecx, [ebp - 0x64]
call fcn.00404ec6
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.00404ec6
mov byte [ebp - 0x9d], bl
push ebx
push 1
lea ecx, [ebp - 0x80]
call fcn.00404ec6
push ebx
push 1
lea ecx, [ebp - 0x9c]
call fcn.00404ec6
mov al, byte [ebp - 0x9d]
call fcn.0049f62e
ret
Function at 0x4894d8
Capabilities:
Set registry value

Disassembly:
push ebp
sub esp, 0x410
lea ebp, [esp - 4]
mov eax, dword [0x50e7dc]
xor eax, ebp
mov dword [ebp + 0x410], eax
push 0x18
mov eax, 0x4bcc48
call fcn.0049f542
mov edi, ecx
call fcn.00402359
xor esi, esi
cmp eax, esi
jle 0x489697
lea eax, [ebp - 0x1c]
push eax
push 0x4cfde0
mov dword [ebp - 0x1c], esi
call dword [sym.imp.RPCRT4.dll_UuidToStringW]
push 0x4ca6d0
lea ecx, [ebp - 0x10]
call fcn.00404a87
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], esi
call fcn.00410081
push 0x4ca6cc
lea ecx, [ebp - 0x10]
call fcn.00410081
lea ecx, [ebp - 0x10]
call fcn.0041fa3d
push esi
lea ecx, [ebp - 0x10]
call fcn.00404ffd
push eax
lea ecx, [ebp - 0x20]
call fcn.00401618
xor eax, eax
push 0x206
mov word [ebp], ax
lea eax, [ebp + 2]
push esi
push eax
call fcn.0049f650
add esp, 0xc
mov ebx, 0x104
push ebx
lea eax, [ebp]
push eax
push 0x76
push dword [edi]
call dword [sym.imp.USER32.dll_LoadStringW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push esi
lea eax, [ebp - 0x18]
push eax
push esi
push 0x20006
push esi
push esi
push esi
lea eax, [ebp]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x489680
mov eax, dword [ebp - 0x20]
cmp eax, esi
je 0x4895bf
mov eax, dword [eax]
jmp 0x4895c1
xor eax, eax
push esi
lea ecx, [ebp - 0x14]
push ecx
push esi
push 0x20006
push esi
push esi
push esi
push eax
push dword [ebp - 0x18]
call edi
test eax, eax
jne 0x489677
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea eax, [ebp - 0x24]
push eax
push 4
push esi
push str.Policy
push dword [ebp - 0x14]
mov dword [ebp - 0x24], 3
call edi
push 0x20
push 0x4e53a8
push 1
push esi
push str.AppName
push dword [ebp - 0x14]
call edi
xor eax, eax
push 0x206
mov word [ebp + 0x208], ax
lea eax, [ebp + 0x20a]
push esi
push eax
call fcn.0049f650
add esp, 0xc
push ebx
lea eax, [ebp + 0x208]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp + 0x208]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, si
jne 0x489647
sub eax, ecx
sar eax, 1
lea eax, [eax + eax - 0x20]
push eax
lea eax, [ebp + 0x208]
push eax
push 1
push esi
push str.AppPath
push dword [ebp - 0x14]
call edi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x20]
cmp ecx, esi
je 0x48968c
call fcn.004016c8
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401713
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x410]
xor ecx, ebp
call fcn.0049f533
add ebp, 0x414
leave
ret
Function at 0x4896ba
Capabilities:
Delete registry key

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x50e7dc]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x10
mov eax, 0x4bcc78
call fcn.0049f542
mov edi, ecx
call fcn.00402359
xor esi, esi
cmp eax, esi
jle 0x4897c4
xor eax, eax
push 0x206
mov word [ebp], ax
lea eax, [ebp + 2]
push esi
push eax
call fcn.0049f650
add esp, 0xc
push 0x104
lea eax, [ebp]
push eax
push 0x76
push dword [edi]
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x18]
push eax
push 0x4cfde0
mov dword [ebp - 0x18], esi
call dword [sym.imp.RPCRT4.dll_UuidToStringW]
push 0x4ca6d0
lea ecx, [ebp - 0x10]
call fcn.00404a87
push dword [ebp - 0x18]
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], esi
call fcn.00410081
push 0x4ca6cc
lea ecx, [ebp - 0x10]
call fcn.00410081
lea ecx, [ebp - 0x10]
call fcn.0041fa3d
push esi
lea ecx, [ebp - 0x10]
call fcn.00404ffd
push eax
lea ecx, [ebp - 0x1c]
call fcn.00401618
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push 0x20006
push esi
push esi
push esi
lea eax, [ebp]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, dword [ebp - 0x1c]
cmp edi, esi
je 0x489796
mov eax, dword [edi]
jmp 0x489798
xor eax, eax
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], esi
cmp edi, esi
je 0x4897b9
mov ecx, edi
call fcn.004016c8
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401713
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0049f533
add ebp, 0x20c
leave
ret

Function at 0x4897f8
Capabilities:
Create process on windows

Disassembly:
push 1
xor eax, eax
push eax
push eax
push 0x4cb5c0
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret

Function at 0x48980c
Capabilities:
Create process on windows

Disassembly:
push 1
xor eax, eax
push eax
push eax
push str.calc.exe
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret

Function at 0x489820
Capabilities:
Create process on windows

Disassembly:
push 1
xor eax, eax
push eax
push eax
push str.explorer.exe
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret
Function at 0x489ee7
Capabilities:
Create process on windows

Disassembly:
push ebp
sub esp, 0x98
lea ebp, [esp - 4]
mov eax, dword [0x50e7dc]
xor eax, ebp
mov dword [ebp + 0x98], eax
push 0x58
mov eax, 0x4bcde5
call fcn.0049f542
mov dword [ebp - 0x10], ecx
mov esi, 0x4d51f0
push esi
lea ecx, [ebp - 0x48]
call fcn.00404bd0
xor ebx, ebx
push str.PARTNER_NAME
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], ebx
call fcn.00404bd0
push str.General
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 1
call fcn.00404bd0
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp + 0x44]
push eax
mov byte [ebp - 4], 2
call fcn.004082c8
add esp, 0x10
xor edi, edi
push ebx
inc edi
push edi
lea ecx, [ebp - 0x64]
call fcn.004058b3
push ebx
push edi
lea ecx, [ebp - 0x2c]
call fcn.004058b3
push ebx
push edi
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 6
call fcn.004058b3
cmp dword [ebp + 0x58], ebx
jne 0x489fb7
push 2
pop esi
push ebx
push edi
lea ecx, [ebp + 0x44]
call fcn.004058b3
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x98]
xor ecx, ebp
call fcn.0049f533
add ebp, 0x9c
leave
ret
push edi
push reloc.OLEAUT32.dll_SysReAllocString
lea eax, [ebp + 0x44]
push eax
lea ecx, [ebp]
call fcn.004069e3
push esi
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 7
call fcn.00404bd0
push str.Uninstall
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 8
call fcn.00404bd0
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp + 0x7c]
push eax
lea ecx, [ebp]
mov byte [ebp - 4], 9
call fcn.00406d31
push ebx
push edi
lea ecx, [ebp - 0x48]
call fcn.004058b3
push ebx
push edi
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0xc
call fcn.004058b3
cmp dword [ebp + 0x90], ebx
je 0x48a08a
mov eax, dword [ebp - 0x10]
cmp byte [eax + 4], bl
mov eax, str._UNINSTALL__RESETSAPS
jne 0x48a031
mov eax, str._UNINSTALL
push eax
lea ecx, [ebp + 0x60]
call fcn.00404bd0
cmp dword [ebp + 0x78], 8
mov ecx, dword [ebp + 0x64]
jae 0x48a046
lea ecx, [ebp + 0x64]
cmp dword [ebp + 0x94], 8
mov eax, dword [ebp + 0x80]
jae 0x48a05b
lea eax, [ebp + 0x80]
push edi
push ebx
push ecx
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push ebx
push edi
lea ecx, [ebp + 0x60]
mov esi, eax
call fcn.004058b3
push ebx
push edi
lea ecx, [ebp + 0x7c]
call fcn.004058b3
lea ecx, [ebp]
call fcn.004017b6
jmp 0x489f88
push ebx
push edi
lea ecx, [ebp + 0x7c]
call fcn.004058b3
lea ecx, [ebp]
call fcn.004017b6
push 0x64
jmp 0x489f87
Function at 0x48bb5d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x138
mov eax, dword [0x50e7dc]
xor eax, ebp
mov dword [ebp + 0x70], eax
movzx eax, word [ebp + 0x7c]
push esi
mov esi, dword [0x511134]
push 0xf0
push eax
push esi
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0x98], 1
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x48bcd3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x48bcd3
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x48bcd3
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendDlgItemMessageW]
push edi
movzx eax, word [esi]
xor ecx, ecx
cmp cx, ax
je 0x48bcd1
inc esi
inc esi
movzx edi, ax
movzx eax, word [esi]
inc esi
inc esi
mov ecx, dword [esi]
mov dword [ebp - 0xa0], ecx
mov ecx, 0x403
add esi, 4
cmp cx, ax
jne 0x48bc4c
push esi
lea ecx, [ebp - 0x94]
call fcn.0041c01b
push dword [ebp - 0x94]
movzx eax, di
push 0
push 0x143
push eax
mov eax, dword [ebp - 0x9c]
push dword [eax + 4]
call ebx
cmp eax, 0xffffffff
jne 0x48bc2c
and dword [ebp - 0x98], 0
lea eax, [ebp - 0x90]
cmp dword [ebp - 0x94], eax
je 0x48bcbe
push dword [ebp - 0x94]
call fcn.0049f900
pop ecx
jmp 0x48bcbe
mov ecx, 0x1234
cmp cx, ax
jne 0x48bcbe
or dword [ebp - 0xc0], 0xffffffff
push esi
lea ecx, [ebp - 0x94]
mov dword [ebp - 0xc4], 1
call fcn.0041c01b
mov eax, dword [eax]
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x90]
cmp dword [ebp - 0x94], eax
je 0x48bc95
push dword [ebp - 0x94]
call fcn.0049f900
pop ecx
lea eax, [ebp - 0xc4]
push eax
push 0
movzx eax, di
push 0x40b
push eax
mov eax, dword [ebp - 0x9c]
push dword [eax + 4]
call ebx
cmp eax, 0xffffffff
jne 0x48bcbe
and dword [ebp - 0x98], 0
add esi, dword [ebp - 0xa0]
cmp dword [ebp - 0x98], 0
jne 0x48bbcb
pop edi
pop ebx
mov ecx, dword [ebp + 0x70]
mov eax, dword [ebp - 0x98]
xor ecx, ebp
pop esi
call fcn.0049f533
add ebp, 0x74
leave
ret 4
Function at 0x492537
Capabilities:
Check if file exists

Disassembly:
push 0x38
mov eax, 0x4bd456
call fcn.0049f542
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0xc8], ebx
jne 0x4925da
lea eax, [ebp - 0x44]
push str.ProgramFiles
push eax
call fcn.0040479d
pop ecx
pop ecx
push 0xffffffffffffffff
push ebx
lea edi, [esi + 0xb4]
push eax
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.00405301
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp - 0x44]
call fcn.004058b3
push 0x4d5480
mov ecx, edi
call fcn.004052dd
push 0xffffffffffffffff
push ebx
lea eax, [esi + 0x98]
push eax
mov ecx, edi
call fcn.00405c92
push 0x4d62f8
mov ecx, edi
call fcn.004052dd
push str.CGenericWnd:_InitConfigurationXmlPath___configuration.xml_path:
lea ecx, [ebp - 0x28]
call fcn.00404bd0
lea eax, [ebp - 0x28]
push edi
push eax
mov dword [ebp - 4], 1
call fcn.00401985
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.004058b3
lea eax, [esi + 0xb4]
cmp dword [eax + 0x18], 8
jb 0x4925eb
mov eax, dword [eax + 4]
jmp 0x4925ee
add eax, 4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne al
call fcn.0049f61a
ret