joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4959db
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x6610e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
lea eax, [ebp - 0x20c]
push 0x208
push edi
push eax
mov dword [ebp - 0x218], edi
mov dword [ebp - 0x210], edi
mov dword [ebp - 0x214], edi
mov dword [ebp - 0x21c], edi
call fcn.004a2e40
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x218]
add esp, 0xc
mov ebx, 0x20019
push eax
push ebx
push edi
push 0x64a974
push connect
call esi
test eax, eax
je 0x495a4b
xor eax, eax
jmp 0x495b19
lea eax, [ebp - 0x210]
push eax
push ebx
push edi
push 0x5f2438
push dword [ebp - 0x218]
call esi
test eax, eax
jne 0x495a44
lea eax, [ebp - 0x214]
push eax
push ebx
push edi
push str.opencommand
push dword [ebp - 0x210]
call esi
test eax, eax
jne 0x495a44
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x21c], 0x104
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x220], 1
push eax
lea eax, [ebp - 0x220]
push eax
push edi
push 0x64a7dc
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x210]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x214]
call esi
lea eax, [ebp - 0x20c]
push eax
call fcn.004b4db2
mov edi, 0x5e463c
push edi
push eax
call fcn.004a4c0d
add esp, 0xc
test eax, eax
je 0x495a44
lea esi, [eax + 2]
push edi
push esi
call fcn.004a4c0d
pop ecx
pop ecx
test eax, eax
je 0x495a44
xor ecx, ecx
push esi
mov word [eax], cx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
neg eax
sbb eax, eax
neg eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00447f5d
mov esp, ebp
pop ebp
ret

Function at 0x495b4f
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fa4
call fcn.004480b0
mov eax, dword [0x6610e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x804]
push edi
mov edi, 0x800
xor ebx, ebx
push edi
push ebx
push eax
call fcn.004a2e40
push edi
lea eax, [ebp - 0x1004]
push ebx
push eax
call fcn.004a2e40
add esp, 0x18
lea eax, [ebp - 0x1fa4]
push 0x7d0
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Program_FilesInternet_Exploreriexplore.exe
push 0x5f24c0
call fcn.004a6baf
pop ecx
lea ecx, [ebp - 0x1fa4]
lea eax, [ecx + eax*2]
push eax
call fcn.004a6b8d
lea eax, [ebp - 0x1fa4]
push eax
lea eax, [ebp - 0x1004]
push eax
call fcn.004a6b8d
lea eax, [ebp - 0x804]
push esi
push eax
call fcn.004a6b8d
lea eax, [ebp - 0x1fa4]
push esi
push eax
call fcn.004b0beb
add esp, 0x20
push 1
push ebx
push ebx
push esi
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x495c22
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x804]
push ecx
lea ecx, [ebp - 0x1004]
push ecx
call fcn.004826c1
add esp, 0x14
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.00447f5d
mov esp, ebp
pop ebp
ret 4
Function at 0x495d59
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
push 0x5e80b4
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi], eax
call fcn.004864ab
test al, al
je 0x495d8c
pop edx
pop ebx
pop edx
push edx
pop edi
push ecx
pop edx
pop ebp
push edx
push esi
pop ecx
pop eax
pop edx
pop edi
pop edi
push edx
pop ebp
call fcn.004861b4
test al, al
je 0x495db4
push edx
pop ebp
pop ecx
push edi
push esi
pop esp
push esp
push ebx
pop ebx
pop esi
pop esp
pop eax
push esi
push eax
pop esp
pop edi
pop ecx
push ecx
pop edx
pop esp
pop esp
push esi
pop ebp
pop ebx
push ebp
push edx
pop edx
push edx
push esp
pop edi
push ecx
call fcn.00485fd1
test al, al
je 0x495dd3
push ecx
push edi
push ebx
push ebp
push esi
push esp
pop eax
push edx
pop edx
pop ebx
push eax
pop esi
pop esi
push edx
pop eax
pop esp
pop edx
push edi
push esp
push eax
pop ecx
push esp
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
jne 0x495de2
xor eax, eax
jmp 0x495eac
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x5f16a8
push dword [ebx]
call esi
push str.IsWow64Process
push dword [ebx]
mov dword [ebx + 8], eax
call esi
push str.Wow64DisableWow64FsRedirection
push dword [ebx]
mov dword [ebx + 0xc], eax
call esi
push str.Wow64RevertWow64FsRedirection
push dword [ebx]
mov dword [ebx + 0x18], eax
call esi
push str.GetSystemWow64DirectoryW
push dword [ebx]
mov dword [ebx + 0x14], eax
call esi
push str.advapi32.dll
mov dword [ebx + 0x10], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebx + 4], eax
call fcn.004861b4
test al, al
je 0x495e56
push eax
push esi
push edi
pop ebp
pop esi
pop edi
pop ebx
push esi
pop ecx
pop esp
push edi
pop eax
pop ebp
push ebp
pop ecx
push edx
pop esp
pop esi
pop esp
push esp
pop eax
pop ebp
push edi
push ebx
pop ecx
push esi
push ecx
call fcn.0048605b
test al, al
je 0x495e7d
push edi
pop edi
push ebx
push eax
push ebp
push ecx
push edi
push edx
pop esp
push edi
pop edi
pop ecx
push esp
push eax
pop esi
pop edx
push ecx
pop esi
pop ecx
pop edi
pop ebx
push esi
pop edx
push esi
pop edx
pop ecx
pop ecx
pop eax
pop ebx
pop esp
mov esi, dword [ebp - 4]
cmp dword [esi + 4], 0
je 0x495ddb
mov ebx, str.Wow64RevertWow64FsRedirection
push ebx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
push dword [esi + 4]
mov dword [esi + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x1c], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x496185
Capabilities:
Create directory

Disassembly:
push 0x4a8
mov eax, 0x5df523
call fcn.00447fd9
mov dword [ebp - 0x4b4], ecx
mov esi, dword [ebp + 8]
test esi, esi
jne 0x4961a8
xor eax, eax
jmp 0x4963ac
push 0x100
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.004a2e40
lea eax, [ebp - 0x110]
push esi
push eax
call fcn.004b0c20
and dword [ebp - 0x4b0], 0
push esi
call fcn.004b0b60
add esp, 0x18
mov dword [ebp - 0x4ac], eax
call fcn.004864ab
test al, al
je 0x4961f8
pop edx
pop ebx
pop edx
push edx
pop edi
push ecx
pop edx
pop ebp
push edx
push esi
pop ecx
pop eax
pop edx
pop edi
pop edi
push edx
pop ebp
call fcn.004861b4
test al, al
je 0x496220
push edx
pop ebp
pop ecx
push edi
push esi
pop esp
push esp
push ebx
pop ebx
pop esi
pop esp
pop eax
push esi
push eax
pop esp
pop edi
pop ecx
push ecx
pop edx
pop esp
pop esp
push esi
pop ebp
pop ebx
push ebp
push edx
pop edx
push edx
push esp
pop edi
push ecx
call fcn.00485fd1
test al, al
je 0x49623f
push ecx
push edi
push ebx
push ebp
push esi
push esp
pop eax
push edx
pop edx
pop ebx
push eax
pop esi
pop esi
push edx
pop eax
pop esp
pop edx
push edi
push esp
push eax
pop ecx
push esp
xor ecx, ecx
mov dword [ebp - 0x214], 7
xor eax, eax
mov dword [ebp - 0x218], ecx
mov word [ebp - 0x228], ax
mov edi, 0x100
mov dword [ebp - 4], ecx
push edi
push ecx
lea eax, [ebp - 0x210]
push eax
call fcn.004a2e40
mov eax, dword [ebp - 0x4ac]
add esp, 0xc
cmp byte [ebp + eax - 0x111], 0x5c
je 0x49628b
mov byte [ebp + eax - 0x110], 0x5c
cmp byte [ebp - 0x110], 0
je 0x49639a
mov ebx, dword [ebp - 0x4b0]
mov esi, dword [ebp - 0x4b4]
mov al, byte [ebp + ebx - 0x110]
cmp al, 0x3a
jne 0x4962b7
push 2
pop eax
jmp 0x49638a
cmp al, 0x5c
jne 0x496387
push ebx
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.004a2340
add esp, 0xc
cmp ebx, edi
jae 0x4963c8
lea eax, [ebp - 0x210]
mov byte [ebp + ebx - 0x210], 0
push eax
lea ecx, [ebp - 0x240]
call fcn.00423107
lea eax, [ebp - 0x240]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x258]
mov ecx, esi
push eax
call fcn.00496992
push eax
lea ecx, [ebp - 0x228]
call fcn.00403900
push 0
push 1
lea ecx, [ebp - 0x258]
call fcn.00401de0
push 0
push 1
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0
call fcn.00422a84
cmp dword [ebp - 0x214], 8
lea ecx, [ebp - 0x4a8]
lea eax, [ebp - 0x228]
cmovae eax, dword [ebp - 0x228]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x496387
cmp dword [ebp - 0x214], 8
lea eax, [ebp - 0x228]
push 0
cmovae eax, dword [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4963b4
xor eax, eax
inc eax
add ebx, eax
cmp byte [ebp + ebx - 0x110], 0
jne 0x4962a4
push 0
push 1
lea ecx, [ebp - 0x228]
call fcn.00401de0
xor eax, eax
inc eax
call fcn.00447f83
ret 4
push 0
push 1
lea ecx, [ebp - 0x228]
call fcn.00401de0
jmp 0x4961a1
call fcn.0044820e
int3
Function at 0x496964
Capabilities:
Create thread

Disassembly:
mov edx, dword [ecx + 0x300]
or eax, 0xffffffff
cmp edx, eax
je 0x496976
cmp edx, 1
jne 0x496991
xor eax, eax
push eax
push eax
push ecx
push 0x496702
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
ret

Function at 0x497a78
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, ecx
mov byte [ebp - 1], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
lea ecx, [eax + 0x210]
mov dword [ebp - 8], eax
mov esi, dword [ecx]
push edi
mov dword [ebp - 0xc], ecx
cmp esi, dword [eax + 0x214]
je 0x497b46
lea edi, [esi + 0x28]
mov dword [ebp + 8], edi
lea ecx, [ebx + 0xa8]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x64ef0c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
sub edi, 0xffffff80
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x64ef0c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebx + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x64ef0c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x64ef0c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebx + 0xa8]
push edi
push eax
call fcn.004b12a0
mov edi, dword [ebp + 8]
pop ecx
pop ecx
test eax, eax
jne 0x497b26
lea eax, [ebx + 0x28]
push edi
push eax
call fcn.004b12a0
pop ecx
pop ecx
test eax, eax
je 0x497b42
mov eax, 0x1b0
add edi, eax
add esi, eax
mov eax, dword [ebp - 8]
mov dword [ebp + 8], edi
cmp esi, dword [eax + 0x214]
je 0x497b46
jmp 0x497aaa
mov byte [ebp - 1], 1
call fcn.00485f02
test al, al
je 0x497b5f
pop ebp
push ecx
push ebx
push ebp
pop edx
pop edi
push edx
push esp
push esi
pop ebp
push edx
push edx
pop ecx
pop esp
pop esp
pop esi
cmp byte [ebp - 1], 0
jne 0x497b83
lea edx, [ebx + 0xa8]
push edx
call fcn.004b0b60
pop ecx
test eax, eax
je 0x497b83
mov ecx, dword [ebp - 0xc]
push ebx
call fcn.004988b6
mov al, 1
jmp 0x497b85
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x498783
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x6610e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0x210]
push ebx
push esi
push edi
mov dword [ebp - 0x11c], ecx
mov dword [ecx + 0x214], eax
call fcn.00486283
test al, al
je 0x4987c8
push ebp
pop ebp
push eax
push esp
pop ebp
push ebx
pop ebp
push esi
pop ebx
push edi
pop eax
pop esp
push esi
push eax
push ebp
pop eax
pop esi
push ecx
push ebx
push edx
call fcn.004860a0
test al, al
je 0x4987ef
push ebp
push ecx
push edi
push edx
push ebx
push ecx
pop esp
pop ebx
pop ebp
pop edx
pop ecx
pop edi
pop ebx
push esp
push eax
push edi
pop ebx
push edi
pop ebx
push eax
pop edx
push ebp
pop ecx
pop eax
pop eax
pop ebx
push ebx
pop ebx
push esp
push ebp
call fcn.0048616f
test al, al
je 0x498817
push esi
push esp
push esp
push eax
pop ebx
pop esi
push ebp
push ecx
push eax
push esp
push esp
push edi
pop ebp
pop ebx
push edi
pop ecx
pop esi
push edi
push ecx
push esp
pop ebp
pop ecx
pop ebp
push eax
pop ebp
pop edi
push ecx
pop ebp
pop eax
pop ecx
push ecx
mov esi, 0x114
lea eax, [ebp - 0x118]
push esi
xor ebx, ebx
push ebx
push eax
call fcn.004a2e40
add esp, 0xc
mov dword [ebp - 0x118], esi
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x108], 2
mov esi, dword [ebp - 0x11c]
jne 0x49885a
mov ecx, esi
call fcn.00498043
jmp 0x49886f
mov edi, ebx
test ebx, ebx
jne 0x49886f
mov ecx, esi
call fcn.00497e9a
inc edi
mov ebx, eax
cmp edi, 0xa
jl 0x49885c
mov eax, dword [esi + 0x214]
mov ecx, 0x1b0
sub eax, dword [esi + 0x210]
cdq
idiv ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00447f5d
mov esp, ebp
pop ebp
ret

Function at 0x49bdbb
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfe0
mov eax, dword [0x6610e4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xfa4]
push edi
push 0x7d0
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0xfa4]
push esi
push eax
call fcn.004a6b8d
push 0x3c
xor edi, edi
lea eax, [ebp - 0xfe0]
push edi
push eax
call fcn.004a2e40
add esp, 0x14
mov dword [ebp - 0xfdc], 0x200
xor eax, eax
mov dword [ebp - 0xfcc], esi
inc eax
mov ecx, str.open
mov dword [ebp - 0xfd4], ecx
push eax
push edi
push edi
push esi
push ecx
push edi
mov dword [ebp - 0xfc4], eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x49be4d
push edi
push edi
lea eax, [ebp - 0xfa4]
push edi
push eax
call fcn.0049bfeb
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00447f5d
mov esp, ebp
pop ebp
ret
Function at 0x49be5d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x6610e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0x208
push 0
push eax
call fcn.004a2e40
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.004a2e40
add esp, 0x18
lea eax, [ebp - 0x414]
push 0
push 0x19
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x49bf38
push esi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push str._s_s.url
push eax
call fcn.00405710
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea eax, [ebp - 0x20c]
add esp, 0x10
push eax
push ebx
push 0x5f25f0
mov ebx, str.InternetShortcut
push ebx
call esi
lea eax, [ebp - 0x20c]
push eax
push edi
push str.IconFile
push ebx
call esi
lea eax, [ebp - 0x20c]
mov edi, 0x5e19a8
push eax
push edi
push str.HotKey
push ebx
call esi
lea eax, [ebp - 0x20c]
push eax
push edi
push str.IDList
push ebx
call esi
lea eax, [ebp - 0x20c]
push eax
push edi
push str.IconIndex
push ebx
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00447f5d
mov esp, ebp
pop ebp
ret

Function at 0x49bf49
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x6610e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 0x414]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0x208
push 0
push eax
call fcn.004a2e40
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004a2e40
add esp, 0x18
lea eax, [ebp - 0x20c]
push 0
push 0x19
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x49bfda
push esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push 0x5f25c8
push eax
call fcn.00405710
xor eax, eax
push eax
push eax
push eax
push 1
push edi
push eax
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.0049c15b
add esp, 0x30
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00447f5d
mov esp, ebp
pop ebp
ret
Function at 0x49bfeb
Capabilities:
Create process on windows

Disassembly:
push 0x88
mov eax, 0x5dfbbb
call fcn.00447fd9
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x94]
mov edi, dword [ebp + 0xc]
push 0x44
pop ebx
push ebx
push 0
push eax
call fcn.004a2e40
push 0x10
lea eax, [ebp - 0x50]
mov dword [ebp - 0x94], ebx
push 0
push eax
call fcn.004a2e40
add esp, 0x18
xor edx, edx
xor eax, eax
mov dword [ebp - 0x18], edx
mov word [ebp - 0x28], ax
push 7
pop ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
mov word [ebp - 0x40], ax
or ebx, 0xffffffff
mov byte [ebp - 4], 1
test edi, edi
je 0x49c0c9
cmp word [edi], dx
jne 0x49c05a
mov eax, edx
jmp 0x49c061
push edi
call fcn.004a6baf
pop ecx
push eax
push edi
lea ecx, [ebp - 0x40]
call fcn.00401ea0
cmp dword [ebp - 0x30], 0
je 0x49c0c9
mov edi, 0x5e463c
push edi
call fcn.004a6baf
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.00401ea0
xor edi, edi
cmp word [esi], di
jne 0x49c092
mov eax, edi
jmp 0x49c099
push esi
call fcn.004a6baf
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00403b60
mov esi, 0x5f0338
push esi
call fcn.004a6baf
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00403b60
push ebx
push edi
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00403c90
jmp 0x49c0e5
xor edi, edi
cmp word [esi], di
jne 0x49c0d4
mov eax, edi
jmp 0x49c0db
push esi
call fcn.004a6baf
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00401ea0
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 0x94]
push ecx
push edi
push edi
push edi
push 1
push edi
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x49c112
mov esi, edi
jmp 0x49c13d
cmp byte [ebp + 0x10], 0
je 0x49c12a
cmp dword [ebp + 0x14], 0
cmovg ebx, dword [ebp + 0x14]
push ebx
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x50]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x4c]
call esi
xor esi, esi
inc esi
push edi
push 1
lea ecx, [ebp - 0x40]
call fcn.00401de0
push edi
push 1
lea ecx, [ebp - 0x28]
call fcn.00401de0
mov eax, esi
call fcn.00447f83
ret
Function at 0x49c325
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x160
mov eax, dword [0x6610e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x49c452
push esi
push 0x11c
xor esi, esi
lea eax, [ebp - 0x120]
push esi
push eax
call fcn.004a2e40
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0x3c
lea eax, [ebp - 0x160]
push esi
push eax
call fcn.004a2e40
mov eax, dword [ebp - 0x150]
add esp, 0xc
test edi, edi
mov dword [ebp - 0x160], 0x3c
mov dword [ebp - 0x15c], 0x40
cmovne eax, edi
mov dword [ebp - 0x158], esi
mov dword [ebp - 0x154], str.Open
mov dword [ebp - 0x150], eax
test ebx, ebx
je 0x49c3e1
push ebx
call fcn.004a6baf
pop ecx
mov ecx, dword [ebp - 0x14c]
test eax, eax
cmovg ecx, ebx
mov dword [ebp - 0x14c], ecx
lea eax, [ebp - 0x160]
mov dword [ebp - 0x148], esi
push eax
mov dword [ebp - 0x144], 1
mov dword [ebp - 0x140], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x49c41c
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push edi
call fcn.0049bfeb
add esp, 0x10
mov esi, eax
jmp 0x49c44f
cmp byte [ebp + 0x10], 0
je 0x49c44f
or eax, 0xffffffff
cmp dword [ebp + 0x14], esi
cmovg eax, dword [ebp + 0x14]
push eax
push dword [ebp - 0x128]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x124]
push eax
push dword [ebp - 0x128]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
xor esi, esi
inc esi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00447f5d
mov esp, ebp
pop ebp
ret

Function at 0x49c462
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.004a6baf
pop ecx
test eax, eax
je 0x49c4c5
push ebx
push edi
push 0x3c
xor edi, edi
lea eax, [ebp - 0x3c]
push edi
push eax
call fcn.004a2e40
add esp, 0xc
mov dword [ebp - 0x38], 0x200
xor ebx, ebx
mov dword [ebp - 0x28], esi
inc ebx
mov eax, str.open
mov dword [ebp - 0x30], eax
push ebx
push edi
push edi
push esi
push eax
push edi
mov dword [ebp - 0x20], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x49c4c1
push edi
push edi
push edi
push esi
call fcn.0049bfeb
add esp, 0x10
jmp 0x49c4c3
mov eax, ebx
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x49c4f1
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x870
mov eax, dword [0x6610e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0x208
mov dword [ebp - 0x870], eax
xor edi, edi
lea eax, [ebp - 0x61c]
push edi
push eax
call fcn.004a2e40
push 0x208
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.004a2e40
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.004a6b8d
push dword [ebp - 0x870]
lea eax, [ebp - 0x61c]
push str._s.
push eax
call fcn.00405710
add esp, 0x2c
lea eax, [ebp - 0x86c]
push eax
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x49c698
lea eax, [ebp - 0x86c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x49c698
push 0x2e
pop eax
cmp word [ebp - 0x840], ax
je 0x49c582
cmp word [ebp - 0x83e], di
je 0x49c582
cmp word [ebp - 0x83e], ax
jne 0x49c5bf
cmp word [ebp - 0x83c], di
je 0x49c582
test byte [ebp - 0x86c], 0x10
je 0x49c613
push 0x208
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.004a2e40
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x840]
push eax
push dword [ebp - 0x870]
lea eax, [ebp - 0x20c]
push 0x5e1a1c
push eax
call fcn.00405710
add esp, 0x20
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x49c686
lea eax, [ebp - 0x414]
push eax
call fcn.004b4db2
pop ecx
push eax
lea eax, [ebp - 0x840]
push eax
call fcn.004b4db2
pop ecx
push eax
call fcn.004ab16b
pop ecx
pop ecx
test eax, eax
jne 0x49c582
push 0x208
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.004a2e40
lea eax, [ebp - 0x840]
push eax
push dword [ebp - 0x870]
lea eax, [ebp - 0x20c]
push 0x5e46d0
push eax
call fcn.00405710
add esp, 0x1c
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x49c582
lea eax, [ebp - 0x20c]
xor edi, edi
push eax
push ebx
inc edi
call fcn.004a6b8d
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00447f5d
mov esp, ebp
pop ebp
ret

Function at 0x49c6e1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x6610e4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
xor edi, edi
push 0x208
push edi
push eax
mov dword [ebp - 0x210], edi
call fcn.004a2e40
add esp, 0xc
lea eax, [ebp - 0x20c]
push edi
push 0x1a
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00401d40
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00447f5d
mov esp, ebp
pop ebp
ret
Function at 0x49d046
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x6610e4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
xor edi, edi
push 0x208
push edi
push eax
mov dword [ebp - 0x210], edi
call fcn.004a2e40
add esp, 0xc
lea eax, [ebp - 0x20c]
push edi
push 0x26
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00401d40
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00447f5d
mov esp, ebp
pop ebp
ret